deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_DarkHydrus_Jul18_3
Repository: Neo23x0/signature-base
Detects: Detects strings found in malware samples in APT report in DarkHydrus
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

Pattern signatures:
$s2 = "Ws2_32.dll" fullword ascii
      $s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "478eacfbe2b201dabe63be53f34148a5" or
         all of them
      )

Full rule:
rule APT_DarkHydrus_Jul18_3 {
   meta:
      description = "Detects strings found in malware samples in APT report in DarkHydrus"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      date = "2018-07-28"
      hash1 = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df[PII_REDACTED]3a1a3"
      id = "1f766b49-3173-5f8a-ba52-a9ce9000be79"
   strings:
      $s2 = "Ws2_32.dll" fullword ascii
      $s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "478eacfbe2b201dabe63be53f34148a5" or
         all of them
      )
}
YARA Detection Rule: HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
Repository: Neo23x0/signature-base
Detects: Detects strings found in CobaltStrike shellcode
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

Pattern signatures:
$x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

      $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
      $s2 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and (
         pe.imphash() == "829da329ce140d873b4a8bde2cbfaa7e" or
         all of ($s*) or
         $x1
      )

Full rule:
rule HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5 {
   meta:
      description = "Detects strings found in CobaltStrike shellcode"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      date = "2018-07-28"
      modified = "2021-06-17"
      hash1 = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
      id = "d52536b8-dd6b-59be-8761-d22b6a279114"
   strings:
      $x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

      $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
      $s2 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and (
         pe.imphash() == "829da329ce140d873b4a8bde2cbfaa7e" or
         all of ($s*) or
         $x1
      )
}
YARA Detection Rule: apt_backspace
Repository: Neo23x0/signature-base
Detects: Detects APT backspace
Author: Bit Byte Bitten

Pattern signatures:
$s1 = "!! Use Splice Socket !!"
		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule apt_backspace{
	meta:
		description = "Detects APT backspace"
		author = "Bit Byte Bitten"
		date = "2015-05-14"
		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
		id = "3da3337d-b6d3-5661-b43e-535e06817303"
	strings:
		$s1 = "!! Use Splice Socket !!"
		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
	condition:
		uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: Bytes_used_in_AES_key_generation
Repository: Neo23x0/signature-base
Detects: Detects Backdoor.goodor
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
      /* $a2 = {fb ff ff ff 00 00}  disabled due to performance issues */

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and all of ($a*)

Full rule:
rule Bytes_used_in_AES_key_generation {
   meta:
      author = "NCSC"
      description = "Detects Backdoor.goodor"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "b5278301da06450fe4442a25dda2d83d21485be[PII_REDACTED]3f59c59e980ad46"
      id = "26a549dd-cbd2-5abc-8d9d-5ea354d0ece8"
   strings:
      $a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
      /* $a2 = {fb ff ff ff 00 00}  disabled due to performance issues */
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and all of ($a*)
}
YARA Detection Rule: Partial_Implant_ID
Repository: Neo23x0/signature-base
Detects: Detects implant from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$a1 = {38 38 31 34 35 36 46 43}
      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)

Full rule:
rule Partial_Implant_ID {
   meta:
      author = "NCSC"
      description = "Detects implant from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "b5278301da06450fe4442a25dda2d83d21485be[PII_REDACTED]3f59c59e980ad46"
      id = "15144f4a-2c96-57f0-b7e9-adbac477c38a"
   strings:
      $a1 = {38 38 31 34 35 36 46 43}
      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)
}
YARA Detection Rule: Sleep_Timer_Choice
Repository: Neo23x0/signature-base
Detects: Detects malware from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)

Full rule:
rule Sleep_Timer_Choice {
   meta:
      author = "NCSC"
      description = "Detects malware from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "b5278301da06450fe4442a25dda2d83d21485be[PII_REDACTED]3f59c59e980ad46"
      id = "c64db0dd-2858-5508-ac51-d3318113a060"
   strings:
      $a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)
}
YARA Detection Rule: User_Function_String
Repository: Neo23x0/signature-base
Detects: Detects user function string from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
/* $b1 = {fb ff ff ff 00 00} disabled due to performance issues */
      $a2 = "e.RandomHashString"
      $a3 = "e.Decode"
      $a4 = "e.Decrypt"
      $a5 = "e.HashStr"
      $a6 = "e.FromB64"

Detection condition:
/* $b1 and */ 4 of ($a*)

Full rule:
rule User_Function_String {
   meta:
      author = "NCSC"
      description = "Detects user function string from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "b5278301da06450fe4442a25dda2d83d21485be[PII_REDACTED]3f59c59e980ad46"
      id = "563ac6af-6b37-53c6-ae13-d97e31edb088"
   strings:
      /* $b1 = {fb ff ff ff 00 00} disabled due to performance issues */
      $a2 = "e.RandomHashString"
      $a3 = "e.Decode"
      $a4 = "e.Decrypt"
      $a5 = "e.HashStr"
      $a6 = "e.FromB64"
   condition:
      /* $b1 and */ 4 of ($a*)
}
YARA Detection Rule: generic_shellcode_downloader_specific
Repository: Neo23x0/signature-base
Detects: Detects Doorshell from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$push1 = {68 6C 6C 6F 63}
    $push2 = {68 75 61 6C 41}
    $push3 = {68 56 69 72 74}
    $a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
    $b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3C)) == 0x4550) and ($a or $b) and @push1 < @push2 and @push2 < @push3

Full rule:
rule generic_shellcode_downloader_specific {
  meta:
    author = "NCSC"
    description = "Detects Doorshell from NCSC report"
    reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
    date = "2018/04/06"
    hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
    id = "ddd25add-ff84-5106-ac3c-5d5b4c1ef2a9"
  strings:
    $push1 = {68 6C 6C 6F 63}
    $push2 = {68 75 61 6C 41}
    $push3 = {68 56 69 72 74}
    $a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
    $b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3C)) == 0x4550) and ($a or $b) and @push1 < @push2 and @push2 < @push3
}
YARA Detection Rule: Batch_Script_To_Run_PsExec
Repository: Neo23x0/signature-base
Detects: Detects malicious batch file from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$ = "Tokens=1 delims=" ascii
      $ = "SET ws=%1" ascii
      $ = "Checking %ws%" ascii
      $ = "%TEMP%\\%ws%ns.txt" ascii
      $ = "ps.exe -accepteula" ascii

Detection condition:
3 of them

Full rule:
rule Batch_Script_To_Run_PsExec {
   meta:
      author = "NCSC"
      description = "Detects malicious batch file from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "b7d7c4bc8f9fd0e[PII_REDACTED]22a431f93062358ed36ce[PII_REDACTED]75ee1a18"
      id = "1fbeeec8-a5bd-569e-b435-c7d82d32e47b"
   strings:
      $ = "Tokens=1 delims=" ascii
      $ = "SET ws=%1" ascii
      $ = "Checking %ws%" ascii
      $ = "%TEMP%\\%ws%ns.txt" ascii
      $ = "ps.exe -accepteula" ascii
   condition:
      3 of them
}
YARA Detection Rule: Batch_Powershell_Invoke_Inveigh
Repository: Neo23x0/signature-base
Detects: Detects malicious batch file from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$ = "Inveigh.ps1" ascii
      $ = "Invoke-Inveigh" ascii
      $ = "-LLMNR N -HTTP N -FileOutput Y" ascii
      $ = "powershell.exe" ascii

Detection condition:
all of them

Full rule:
rule Batch_Powershell_Invoke_Inveigh {
   meta:
      author = "NCSC"
      description = "Detects malicious batch file from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
      id = "c5dab029-6515-5d58-9ccd-bf438ba692d5"
   strings:
      $ = "Inveigh.ps1" ascii
      $ = "Invoke-Inveigh" ascii
      $ = "-LLMNR N -HTTP N -FileOutput Y" ascii
      $ = "powershell.exe" ascii
   condition:
      all of them
}
YARA Detection Rule: lnk_detect
Repository: Neo23x0/signature-base
Detects: Detects malicious LNK file from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
      $lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
      $s1 = {5C 00 5C 00 31 00}
      $s2 = {5C 00 5C 00 32 00}
      $s3 = {5C 00 5C 00 33 00}
      $s4 = {5C 00 5C 00 34 00}
      $s5 = {5C 00 5C 00 35 00}
      $s6 = {5C 00 5C 00 36 00}
      $s7 = {5C 00 5C 00 37 00}
      $s8 = {5C 00 5C 00 38 00}
      $s9 = {5C 00 5C 00 39 00}

Detection condition:
uint32be(0) == 0x4c000000 and
      uint32be(4) == 0x01140200 and
      (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)

Full rule:
rule lnk_detect {
   meta:
      author = "NCSC"
      description = "Detects malicious LNK file from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      id = "76d382f3-b2f2-5ede-94b2-5ae8b766c194"
   strings:
      $lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
      $lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
      $s1 = {5C 00 5C 00 31 00}
      $s2 = {5C 00 5C 00 32 00}
      $s3 = {5C 00 5C 00 33 00}
      $s4 = {5C 00 5C 00 34 00}
      $s5 = {5C 00 5C 00 35 00}
      $s6 = {5C 00 5C 00 36 00}
      $s7 = {5C 00 5C 00 37 00}
      $s8 = {5C 00 5C 00 38 00}
      $s9 = {5C 00 5C 00 39 00}
   condition:
      uint32be(0) == 0x4c000000 and
      uint32be(4) == 0x01140200 and
      (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)
}
YARA Detection Rule: RDP_Brute_Strings
Repository: Neo23x0/signature-base
Detects: Detects RDP brute forcer from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$ = "RDP Brute" ascii wide
      $ = "RdpChecker" ascii
      $ = "RdpBrute" ascii
      $ = "Brute_Count_Password" ascii
      $ = "BruteIPList" ascii
      $ = "Chilkat_Socket_Key" ascii
      $ = "Brute_Sync_Stat" ascii
      $ = "(Error! Hyperlink reference not valid.)" wide
      $ = "BadRDP" wide
      $ = "GoodRDP" wide
      $ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
      $ = "Coded by z668" wide

Detection condition:
4 of them

Full rule:
rule RDP_Brute_Strings {
   meta:
      author = "NCSC"
      description = "Detects RDP brute forcer from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
      id = "d6f0cdbc-a910-5826-b25a-61c2924f8e2a"
   strings:
      $ = "RDP Brute" ascii wide
      $ = "RdpChecker" ascii
      $ = "RdpBrute" ascii
      $ = "Brute_Count_Password" ascii
      $ = "BruteIPList" ascii
      $ = "Chilkat_Socket_Key" ascii
      $ = "Brute_Sync_Stat" ascii
      $ = "(Error! Hyperlink reference not valid.)" wide
      $ = "BadRDP" wide
      $ = "GoodRDP" wide
      $ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
      $ = "Coded by z668" wide
   condition:
      4 of them
}
YARA Detection Rule: WEBSHELL_Z_WebShell_1
Repository: Neo23x0/signature-base
Detects: Detects Z Webshell from NCSC report
Author: NCSC
Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control

Pattern signatures:
$ = "Z_PostBackJS" ascii wide
      $ = "z_file_download" ascii wide
      $ = "z_WebShell" ascii wide
      $ = "1367948c7859d[PII_REDACTED]549228228" ascii wide

Detection condition:
3 of them

Full rule:
rule WEBSHELL_Z_WebShell_1 {
   meta:
      author = "NCSC"
      description = "Detects Z Webshell from NCSC report"
      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
      date = "2018/04/06"
      old_rule_name = "Z_WebShell"
      hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
      id = "f4b50760-bd3a-5e1f-bf32-50f16a42c381"
   strings:
      $ = "Z_PostBackJS" ascii wide
      $ = "z_file_download" ascii wide
      $ = "z_WebShell" ascii wide
      $ = "1367948c7859d[PII_REDACTED]549228228" ascii wide
   condition:
      3 of them
}
YARA Detection Rule: HKTL_CobaltStrike_SleepMask_Jul22
Repository: Neo23x0/signature-base
Detects: Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated
Author: CodeX
Reference: https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs

Pattern signatures:
$sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }

Detection condition:
$sleep_mask

Full rule:
rule HKTL_CobaltStrike_SleepMask_Jul22 {
   meta:
      description = "Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated"
      author = "CodeX"
      date = "2022-07-04"
      reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
      score = 80
      id = "d396ab0e-b584-5a7c-8627-5f318a20f9dd"
   strings:
      $sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }
   condition:
      $sleep_mask
}
YARA Detection Rule: HKTL_CobaltStrike_CS_Core_Oct23
Repository: Neo23x0/signature-base
Detects: Hunts for opcodes used in Cobaltstrike 4.9.1 and earlier
Author: @ninjaparanoid
Reference: https://github.com/paranoidninja/Cobaltstrike-Detection/blob/main/cs49.yara

Pattern signatures:
$socks = { 49 8D 55 02 48 8D 4C 24 30 44 0F B7 F8 B8 FF 03 00 00 }
        $core = { 49 B9 01 01 01 01 01 01 01 01 49 0F AF D1 49 83 F8 40 }

Detection condition:
1 of them

Full rule:
rule HKTL_CobaltStrike_CS_Core_Oct23 {
    meta:
        description = "Hunts for opcodes used in Cobaltstrike 4.9.1 and earlier"
        version = "0.1"
        author = "@ninjaparanoid"
        reference = "https://github.com/paranoidninja/Cobaltstrike-Detection/blob/main/cs49.yara"
        date = "2023-10-12"
        score = 75
    strings:
        $socks = { 49 8D 55 02 48 8D 4C 24 30 44 0F B7 F8 B8 FF 03 00 00 }
        $core = { 49 B9 01 01 01 01 01 01 01 01 49 0F AF D1 49 83 F8 40 }
    condition:
        1 of them
}
YARA Detection Rule: MAL_Hogfish_Report_Related_Sample
Repository: Neo23x0/signature-base
Detects: Detects APT10 / Hogfish related samples
Author: Florian Roth (Nextron Systems)
Reference: https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf

Pattern signatures:
$s1 = "R=user32.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
         1 of them
      )

Full rule:
rule MAL_Hogfish_Report_Related_Sample {
   meta:
      description = "Detects APT10 / Hogfish related samples"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
      date = "2018-05-01"
      hash1 = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
      hash2 = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
      hash3 = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
      id = "7fc4fdda-b71f-5c9c-87a4-5d8290b99348"
   strings:
      $s1 = "R=user32.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
         1 of them
      )
}
YARA Detection Rule: MAL_RedLeaves_Apr18_1
Repository: Neo23x0/signature-base
Detects: Detects RedLeaves malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or
         pe.imphash() == "566a7a4ef613a797389b570f8b4f79df"
      )

Full rule:
rule MAL_RedLeaves_Apr18_1 {
   meta:
      description = "Detects RedLeaves malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
      date = "2018-05-01"
      hash1 = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
      hash2 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
      hash3 = "d956e2ff1b22ccee2c5d[PII_REDACTED]d4c31ecefde3ce463a6dea19ecaaf418a1"
      id = "578b40d7-6818-56d5-92ce-535141c0aa8e"
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or
         pe.imphash() == "566a7a4ef613a797389b570f8b4f79df"
      )
}