deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_Toolset_Apr17_EpWrapper
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "* Failed to get remote TCP socket address" fullword wide
      $x2 = "* Failed to get 'LPStart' export" fullword wide
      $s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_EpWrapper {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
      id = "81b72f7f-ba5a-5f45-b77c-071cfb4571d3"
   strings:
      $x1 = "* Failed to get remote TCP socket address" fullword wide
      $x2 = "* Failed to get 'LPStart' export" fullword wide
      $s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DiBa_Target_2000
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "0M1U1Z1p1" fullword ascii

      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DiBa_Target_2000 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
      id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
   strings:
      $s1 = "0M1U1Z1p1" fullword ascii

      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DllLoad_Target
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "BzWKJD+" fullword ascii

      $op1 = { 44 24 6c 6c 88 5c 24 6d }
      $op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
      $op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DllLoad_Target {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
      id = "9def0814-c86a-5fae-abc2-4185596a74aa"
   strings:
      $s1 = "BzWKJD+" fullword ascii

      $op1 = { 44 24 6c 6c 88 5c 24 6d }
      $op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
      $op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_EXPA
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
      $x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
      $x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
      $x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_EXPA {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
      id = "106efe9b-f70f-51cf-bbb2-b9bf61df1dd1"
   strings:
      $x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
      $x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
      $x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
      $x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_RemoteExecute_Target
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Win32_Process" fullword ascii
      $s2 = "\\\\%ls\\root\\cimv2" fullword wide

      $op1 = { 83 7b 18 01 75 12 83 63 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_RemoteExecute_Target {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
      id = "608e5244-2d3f-573c-a0de-44637051f4ba"
   strings:
      $s1 = "Win32_Process" fullword ascii
      $s2 = "\\\\%ls\\root\\cimv2" fullword wide

      $op1 = { 83 7b 18 01 75 12 83 63 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DS_ParseLogs
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
      $x2 = "* Capture header not found at start of buffer" fullword wide
      $x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DS_ParseLogs {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
      id = "1906c0fc-3fbc-5995-8789-f1c02e574672"
   strings:
      $x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
      $x2 = "* Capture header not found at start of buffer" fullword wide
      $x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_Oracle_Implant
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
      $op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
      $op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_Oracle_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
      id = "6ff4cd21-1060-5901-842e-c04bde4f16ec"
   strings:
      $op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
      $op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
      $op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DmGz_Target
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\\\.\\%ls" fullword ascii
      $s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DmGz_Target {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "[PII_REDACTED]f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
      id = "182a2488-ac3f-5dc6-aa61-d6d267574d10"
   strings:
      $s1 = "\\\\.\\%ls" fullword ascii
      $s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SetResourceName
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
      $x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
      $x3 = "2 = [appinit.dll] level4 dll" fullword ascii
      $x4 = "1 = [spcss32.exe] level3 exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SetResourceName {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
      id = "dc261147-3b52-57c3-9729-2645a0999a99"
   strings:
      $x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
      $x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
      $x3 = "2 = [appinit.dll] level4 dll" fullword ascii
      $x4 = "1 = [spcss32.exe] level3 exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_drivers_Implant
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = ".?AVFeFinallyFailure@@" fullword ascii
      $s2 = "hZwLoadDriver" fullword ascii

      $op1 = { b0 01 e8 58 04 00 00 c3 33 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 30KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_drivers_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
      id = "727a0a8c-0019-53e9-9632-c610299305fc"
   strings:
      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
      $s2 = "hZwLoadDriver" fullword ascii

      $op1 = { b0 01 e8 58 04 00 00 c3 33 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_Shares_Target
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Select * from Win32_Share" fullword ascii
      $s2 = "slocalhost" fullword wide
      $s3 = "\\\\%ls\\root\\cimv2" fullword wide
      $s4 = "\\\\%ls\\%ls" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_Shares_Target {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
      id = "51245be4-6d24-57e4-8c92-c8c1ae5e3cf9"
   strings:
      $s1 = "Select * from Win32_Share" fullword ascii
      $s2 = "slocalhost" fullword wide
      $s3 = "\\\\%ls\\root\\cimv2" fullword wide
      $s4 = "\\\\%ls\\%ls" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_ntfltmgr
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
      $s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii

      $op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
      $op2 = { ff 15 0b 34 00 00 eb 92 }
      $op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
      $op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
      $op5 = { 8a 40 01 00 c7 47 70 }
      $op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
      $op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 4 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_ntfltmgr {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
      hash2 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
      hash3 = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
      id = "402b14f5-4a7a-58fb-8f4a-0a29d6d34440"
   strings:
      $s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
      $s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii

      $op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
      $op2 = { ff 15 0b 34 00 00 eb 92 }
      $op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
      $op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
      $op5 = { 8a 40 01 00 c7 47 70 }
      $op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
      $op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 4 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DiBa_Target_BH
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
      $op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
      $op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DiBa_Target_BH {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac[PII_REDACTED]1fce9f"
      id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
   strings:
      $op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
      $op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
      $op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_PC_LP
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
      $s2 = "Format: <command> <target port> [lp port]" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_PC_LP {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
      id = "c3f8f0f9-80ab-5d8e-be42-59b90dc291cb"
   strings:
      $s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
      $s2 = "Format: <command> <target port> [lp port]" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_RemoteCommand_Lp
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
      $s2 = "Unable to get TCP listen port: %08x" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_RemoteCommand_Lp {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
      id = "98ace4d7-edd0-5e84-bac8-b69e5307f567"
   strings:
      $s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
      $s2 = "Unable to get TCP listen port: %08x" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_lp_mstcp
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
      $s3 = "_LDNdis5RegDeleteKeys@4" ascii

      $op1 = { 89 7e 04 75 06 66 21 46 02 eb }
      $op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
      $op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($s*) or all of ($op*) ) )

Full rule:
rule EquationGroup_Toolset_Apr17_lp_mstcp {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
      id = "afa4985e-7c8f-58fc-9881-219ccba6a495"
   strings:
      $s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
      $s3 = "_LDNdis5RegDeleteKeys@4" ascii

      $op1 = { 89 7e 04 75 06 66 21 46 02 eb }
      $op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
      $op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($s*) or all of ($op*) ) )
}