deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Ransom_Ragnarlocker_July_2020_1
Repository: Neo23x0/signature-base
Detects: Detects Ragnarlocker by strings (July 2020)
Author: Arkbird_SOLG
Reference: https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]88851969

Pattern signatures:
$f1 = "bootfont.bin" fullword wide
      $f2 = "bootmgr.efi" fullword wide
      $f3 = "bootsect.bak" fullword wide
      $r1 = "$!.txt" fullword wide
      $r2 = "---BEGIN KEY R_R---" fullword ascii
      $r3 = "!$R4GN4R_" wide
      $r4 = "RAGNRPW" fullword ascii /* parser */
      $r5 = "---END KEY R_R---" fullword ascii
      $a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii    
      $a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide /* parse disks */
      $a3 = "WinSta0\\Default" fullword wide /* Token ref */
      $a4 = "%s-%s-%s-%s-%s" fullword wide /* GUID parser*/
      $a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide /* Ref crypto used */
      $c1 = "-backup" fullword wide
      $c2 = "-force" fullword wide
      $c3 = "-vmback" fullword wide
      $c4 = "-list" fullword wide
      $s1 = ".ragn@r_" wide /* ref */
      $s2 = "\\notepad.exe" wide /* Show ransom note to the victim*/
      $s3 = "Opera Software" fullword wide  /* Don't 

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and ( pe.imphash() == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( (2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*)) ) )

Full rule:
rule MAL_Ransom_Ragnarlocker_July_2020_1 {
   meta:
      description = "Detects Ragnarlocker by strings (July 2020)"
      author = "Arkbird_SOLG"
      reference = "https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]88851969"
      date = "2020-07-30"
      hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
      id = "60e09057-d9f8-5e89-8f47-c5dda32806c6"
   strings:
      $f1 = "bootfont.bin" fullword wide
      $f2 = "bootmgr.efi" fullword wide
      $f3 = "bootsect.bak" fullword wide
      $r1 = "$!.txt" fullword wide
      $r2 = "---BEGIN KEY R_R---" fullword ascii
      $r3 = "!$R4GN4R_" wide
      $r4 = "RAGNRPW" fullword ascii /* parser */
      $r5 = "---END KEY R_R---" fullword ascii
      $a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii    
      $a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide /* parse disks */
      $a3 = "WinSta0\\Default" fullword wide /* Token ref */
      $a4 = "%s-%s-%s-%s-%s" fullword wide /* GUID parser*/
      $a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide /* Ref crypto used */
      $c1 = "-backup" fullword wide
      $c2 = "-force" fullword wide
      $c3 = "-vmback" fullword wide
      $c4 = "-list" fullword wide
      $s1 = ".ragn@r_" wide /* ref */
      $s2 = "\\notepad.exe" wide /* Show ransom note to the victim*/
      $s3 = "Opera Software" fullword wide  /* Don't touch browsers for contact him*/
      $s4 = "Tor browser" fullword wide /*Ref ransom note*/
   condition:
      uint16(0) == 0x5a4d and filesize < 30KB and ( pe.imphash() == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( (2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*)) ) )
}
YARA Detection Rule: MAL_RANSOM_LockBit_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found in LockBit ransomware
Author: Florian Roth
Reference: https://objective-see.org/blog/blog_0x75.html

Pattern signatures:
$xe1 = "-i '/path/to/crypt'" xor
      $xe2 = "http://lockbit" xor
      
      $s1 = "idelayinmin" ascii
      $s2 = "bVMDKmode" ascii
      $s3 = "bSelfRemove" ascii
      $s4 = "iSpotMaximum" ascii

      $fp1 = "<html"

Detection condition:
(
         1 of ($x*)
         or 4 of them
      )
      and not 1 of ($fp*)

Full rule:
rule MAL_RANSOM_LockBit_Apr23_1 {
   meta:
      description = "Detects indicators found in LockBit ransomware"
      author = "Florian Roth"
      reference = "https://objective-see.org/blog/blog_0x75.html"
      date = "2023-04-17"
      score = 75
      id = "75dc8b95-16f0-5170-a7d6-fc10bb778348"
   strings:
      $xe1 = "-i '/path/to/crypt'" xor
      $xe2 = "http://lockbit" xor
      
      $s1 = "idelayinmin" ascii
      $s2 = "bVMDKmode" ascii
      $s3 = "bSelfRemove" ascii
      $s4 = "iSpotMaximum" ascii

      $fp1 = "<html"
   condition:
      (
         1 of ($x*)
         or 4 of them
      )
      and not 1 of ($fp*)
}
YARA Detection Rule: MAL_RANSOM_LockBit_Locker_LOG_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found in LockBit ransomware log files
Author: Florian Roth
Reference: https://objective-see.org/blog/blog_0x75.html

Pattern signatures:
$s1 = " is encrypted. Checksum after encryption "
      $s2 = "~~~~~Hardware~~~~"
      $s3 = "[+] Add directory to encrypt:"
      $s4 = "][+] Launch parameters: "

Detection condition:
2 of them

Full rule:
rule MAL_RANSOM_LockBit_Locker_LOG_Apr23_1 {
   meta:
      description = "Detects indicators found in LockBit ransomware log files"
      author = "Florian Roth"
      reference = "https://objective-see.org/blog/blog_0x75.html"
      date = "2023-04-17"
      score = 75
      id = "aa0a2393-e5a2-5151-8afb-91a9bb922179"
   strings:
      $s1 = " is encrypted. Checksum after encryption "
      $s2 = "~~~~~Hardware~~~~"
      $s3 = "[+] Add directory to encrypt:"
      $s4 = "][+] Launch parameters: "
   condition:
      2 of them
}
YARA Detection Rule: MAL_RANSOM_LockBit_ForensicArtifacts_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found in LockBit intrusions
Author: Florian Roth
Reference: https://objective-see.org/blog/blog_0x75.html

Pattern signatures:
$x1 = "/tmp/locker.log" ascii fullword
      $x2 = "Executable=LockBit/locker_" ascii
      /* Tor Browser Links:\x0d\x0ahttp://lockbit */
      $xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }

Detection condition:
1 of ($x*)

Full rule:
rule MAL_RANSOM_LockBit_ForensicArtifacts_Apr23_1 {
   meta:
      description = "Detects forensic artifacts found in LockBit intrusions"
      author = "Florian Roth"
      reference = "https://objective-see.org/blog/blog_0x75.html"
      date = "2023-04-17"
      score = 75
      id = "e716030c-ee78-51dc-919c-cf59e93da976"
   strings:
      $x1 = "/tmp/locker.log" ascii fullword
      $x2 = "Executable=LockBit/locker_" ascii
      /* Tor Browser Links:\x0d\x0ahttp://lockbit */
      $xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }
   condition:
      1 of ($x*)
}
YARA Detection Rule: HiddenCobra_r4_wiper_1
Repository: Neo23x0/signature-base
Detects: Detects HiddenCobra Wiper
Author: NCCIC Partner
Reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf

Pattern signatures:
$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
      $controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }

Detection condition:
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them

Full rule:
rule HiddenCobra_r4_wiper_1 {
   meta:
      author = "NCCIC Partner"
      date = "2017-12-12"
      description = "Detects HiddenCobra Wiper"
      reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
      id = "4978c190-7b66-5cea-96df-809f85620986"
   strings:
      $mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
      $controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
   condition:
      uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them
}
YARA Detection Rule: HiddenCobra_r4_wiper_2
Repository: Neo23x0/signature-base
Detects: Detects HiddenCobra Wiper
Author: NCCIC Partner
Reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf

Pattern signatures:
// BIOS Extended Write
      $PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
      $ExtendedWrite = { B4 43 B0 00 CD 13 }

Detection condition:
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them

Full rule:
rule HiddenCobra_r4_wiper_2 {
   meta:
      author = "NCCIC Partner"
      date = "2017-12-12"
      description = "Detects HiddenCobra Wiper"
      reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
      id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"
   strings:
      // BIOS Extended Write
      $PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
      $ExtendedWrite = { B4 43 B0 00 CD 13 }
   condition:
      uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them
}
YARA Detection Rule: Flash_CVE_2015_5119_APT3_leg
Repository: Neo23x0/signature-base
Detects: Exploit Sample CVE-2015-5119
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "HT_exploit" fullword ascii
        $s1 = "HT_Exploit" fullword ascii
        $s2 = "flash_exploit_" ascii
        $s3 = "exp1_fla/MainTimeline" ascii fullword
        $s4 = "exp2_fla/MainTimeline" ascii fullword
        $s5 = "_shellcode_32" ascii
        $s6 = "todo: unknown 32-bit target" fullword ascii

Detection condition:
uint16(0) == 0x5746 and 1 of them

Full rule:
rule Flash_CVE_2015_5119_APT3_leg {
    meta:
        description = "Exploit Sample CVE-2015-5119"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        score = 70
        yaraexchange = "No distribution without author's consent"
        date = "2015-08-01"
        id = "d9efaea3-0644-501a-990b-665e257beb86"
    strings:
        $s0 = "HT_exploit" fullword ascii
        $s1 = "HT_Exploit" fullword ascii
        $s2 = "flash_exploit_" ascii
        $s3 = "exp1_fla/MainTimeline" ascii fullword
        $s4 = "exp2_fla/MainTimeline" ascii fullword
        $s5 = "_shellcode_32" ascii
        $s6 = "todo: unknown 32-bit target" fullword ascii
    condition:
        uint16(0) == 0x5746 and 1 of them
}
YARA Detection Rule: No_PowerShell
Repository: Neo23x0/signature-base
Detects: Detects an C# executable used to circumvent PowerShell detection - file nps.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Ben0xA/nps

Pattern signatures:
$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($s*) ) ) or ( all of them )

Full rule:
rule No_PowerShell {
	meta:
		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Ben0xA/nps"
		date = "2016-05-21"
		score = 80
		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
		id = "362a61bc-2c10-5076-93be-9f8b5a9ae8ba"
	strings:
		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: blackenergy3_installer
Repository: Neo23x0/signature-base
Detects: Matches unique code block for import name construction 
Author: Mike Schladt
Reference: https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf

Full rule:
rule blackenergy3_installer
{
	meta:
		author = "Mike Schladt"
		date = "2015-05-29"
		description = "Matches unique code block for import name construction "
		md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
		sha1 = "78636F7BBD52EA80D79B4E2A[PII_REDACTED]BBB02D"
		reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
		id = "4afeb7ac-ce8d-506c-9c97-db7ec6102490"
	strings:
		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }            
	condition : 
		any of them
}
YARA Detection Rule: MAL_LNX_RedMenshen_BPFDoor_May23_1
Repository: Neo23x0/signature-base
Detects: Detects BPFDoor malware
Author: Florian Roth
Reference: https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game

Pattern signatures:
$x1 = "[-] Execute command failed" ascii fullword
      $x2 = "/var/run/initd.lock" ascii fullword
      
      $xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }

      $sc1 = { 9F CD 30 44 }
      $sc2 = { 66 27 14 5E }

      $sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword

      $sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
      $sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
      $sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }

Detection condition:
// file-based detection
      uint16(0) == 0x457f and
      filesize < 900KB and (
         ( 1 of ($x*) and 1 of ($s*) )
         or 4 of them
         /* looks for the magic byte sequences in close proximity to each other */
         or ( 
            all of ($sc*) 
            and $sc1 in (@sc2[1

Full rule:
rule MAL_LNX_RedMenshen_BPFDoor_May23_1 {
   meta:
      description = "Detects BPFDoor malware"
      author = "Florian Roth"
      reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
      date = "2023-05-11"
      score = 80
      hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
      id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"
   strings:
      $x1 = "[-] Execute command failed" ascii fullword
      $x2 = "/var/run/initd.lock" ascii fullword
      
      $xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }

      $sc1 = { 9F CD 30 44 }
      $sc2 = { 66 27 14 5E }

      $sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword

      $sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
      $sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
      $sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
   condition:
      // file-based detection
      uint16(0) == 0x457f and
      filesize < 900KB and (
         ( 1 of ($x*) and 1 of ($s*) )
         or 4 of them
         /* looks for the magic byte sequences in close proximity to each other */
         or ( 
            all of ($sc*) 
            and $sc1 in (@sc2[1]-50..@sc2[1]+50) 
         )
      // in-memory detection
      ) or (
         2 of ($x*)
         or 5 of them
      )
}
YARA Detection Rule: APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_1
Repository: Neo23x0/signature-base
Detects: Detects unknown Linux implants (uploads from KR and MO)
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Pattern signatures:
$s1 = "[-] Connect failed." ascii fullword
      $s2 = "export MYSQL_HISTFILE=" ascii fullword
      $s3 = "udpcmd" ascii fullword
      $s4 = "getshell" ascii fullword

      $op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
      $op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
      $op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
      $op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }

Detection condition:
uint16(0) == 0x457f and
      filesize < 80KB and 2 of them or 5 of them

Full rule:
rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_1 {
   meta:
      description = "Detects unknown Linux implants (uploads from KR and MO)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
      date = "2022-05-05"
      score = 90
      hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
      hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
      hash3 = "599ae527f10ddb[PII_REDACTED]b7d3734ee51673b664f2e5d0346e64f85e185683"
      hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
      hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
      hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
      hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
      hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
      hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
      hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
      id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
   strings:
      $s1 = "[-] Connect failed." ascii fullword
      $s2 = "export MYSQL_HISTFILE=" ascii fullword
      $s3 = "udpcmd" ascii fullword
      $s4 = "getshell" ascii fullword

      $op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
      $op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
      $op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
      $op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
   condition:
      uint16(0) == 0x457f and
      filesize < 80KB and 2 of them or 5 of them
}
YARA Detection Rule: APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_2
Repository: Neo23x0/signature-base
Detects: Detects BPFDoor implants used by Chinese actor Red Menshen
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Pattern signatures:
$opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
      $opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }

      $op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
      $op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
      $op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }

Detection condition:
uint16(0) == 0x457f and
      filesize < 100KB and 2 of ($opx*) or 4 of them

Full rule:
rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_2 {
   meta:
      description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
      date = "2022-05-07"
      score = 85
      hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
      hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
      hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
      hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
      id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"
   strings:
      $opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
      $opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }

      $op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
      $op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
      $op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
   condition:
      uint16(0) == 0x457f and
      filesize < 100KB and 2 of ($opx*) or 4 of them
}
YARA Detection Rule: APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3
Repository: Neo23x0/signature-base
Detects: Detects BPFDoor implants used by Chinese actor Red Menshen
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Pattern signatures:
$s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
      $s2 = "/sbin/mingetty /dev" ascii fullword
      $s3 = "pickup -l -t fifo -u" ascii fullword

Detection condition:
uint16(0) == 0x457f and
      filesize < 200KB and 2 of them or all of them

Full rule:
rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3 {
   meta:
      description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
      date = "2022-05-08"
      score = 85
      hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
      hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
      id = "91c2153a-a6e0-529e-852c-61f799838798"
   strings:
      $s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
      $s2 = "/sbin/mingetty /dev" ascii fullword
      $s3 = "pickup -l -t fifo -u" ascii fullword
   condition:
      uint16(0) == 0x457f and
      filesize < 200KB and 2 of them or all of them
}