deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Unpack_TBack
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file TBack.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "\\final\\new\\lcc\\public.dll"

Detection condition:
all of them

Full rule:
rule Unpack_TBack {
	meta:
		description = "Webshells Auto-generated - file TBack.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a9d1007823bf96fb163ab38726b48464"
		id = "b5f93621-e1e9-5aed-b574-471b4c1f9570"
	strings:
		$s5 = "\\final\\new\\lcc\\public.dll"
	condition:
		all of them
}
YARA Detection Rule: DarkSpy105
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file DarkSpy105.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"

Detection condition:
all of them

Full rule:
rule DarkSpy105 {
	meta:
		description = "Webshells Auto-generated - file DarkSpy105.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
		id = "9d519ccf-fe52-5b82-a39d-c9f86c1089e1"
	strings:
		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
	condition:
		all of them
}
YARA Detection Rule: EditServer_EXE
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file EditServer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "Server %s Have Been Configured"
		$s5 = "The Server Password Exceeds 32 Characters"
		$s8 = "9--Set Procecess Name To Inject DLL"

Detection condition:
all of them

Full rule:
rule EditServer_EXE {
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f945de25e0eba3bdaf1455b3a62b9832"
		id = "[PII_REDACTED]-8f95-acf7a0d56e71"
	strings:
		$s2 = "Server %s Have Been Configured"
		$s5 = "The Server Password Exceeds 32 Characters"
		$s8 = "9--Set Procecess Name To Inject DLL"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_reader
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file reader.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "mailto:mailbomb@hotmail."

Detection condition:
all of them

Full rule:
rule FSO_s_reader {
	meta:
		description = "Webshells Auto-generated - file reader.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
		id = "d596f7f4-5b0d-5f17-94d3-2582ec041eb1"
	strings:
		$s2 = "mailto:mailbomb@hotmail."
	condition:
		all of them
}
YARA Detection Rule: ASP_CmdAsp
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file CmdAsp.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "' -- Read the output from our command and remove the temp file -- '"
		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
		$s9 = "' -- create the COM objects that we will be using -- '"

Detection condition:
all of them

Full rule:
rule ASP_CmdAsp {
	meta:
		description = "Webshells Auto-generated - file CmdAsp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
		id = "e4b48843-1936-5717-b2b6-add5b4a14d04"
	strings:
		$s2 = "' -- Read the output from our command and remove the temp file -- '"
		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
		$s9 = "' -- create the COM objects that we will be using -- '"
	condition:
		all of them
}
YARA Detection Rule: KA_uShell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file KA_uShell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"

Detection condition:
all of them

Full rule:
rule KA_uShell {
	meta:
		description = "Webshells Auto-generated - file KA_uShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "685f5d4f7f6751eaefc[PII_REDACTED]aab"
		id = "34e220db-2fb5-59dc-b5e8-d88f844d3977"
	strings:
		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
	condition:
		all of them
}
YARA Detection Rule: PHP_Backdoor_v1
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file PHP Backdoor v1.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"

Detection condition:
all of them

Full rule:
rule PHP_Backdoor_v1 {
	meta:
		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0506ba90759d11d78befd21cabf41f3d"
		id = "f47298a9-a47c-5088-ab1f-1bd76bfd0ca8"
	strings:

		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
	condition:
		all of them
}
YARA Detection Rule: svchostdll
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file svchostdll.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "InstallService"
		$s1 = "RundllInstallA"
		$s2 = "UninstallService"
		$s3 = "&G3 Users In RegistryD"
		$s4 = "OL_SHUTDOWN;I"
		$s5 = "SvcHostDLL.dll"
		$s6 = "RundllUninstallA"
		$s7 = "InternetOpenA"
		$s8 = "Check Cloneomplete"

Detection condition:
all of them

Full rule:
rule svchostdll {
	meta:
		description = "Webshells Auto-generated - file svchostdll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0f6756c8cb0b454c452055f189e4c3f4"
		id = "b369d702-1f29-56ec-a742-f87d9c42c775"
	strings:
		$s0 = "InstallService"
		$s1 = "RundllInstallA"
		$s2 = "UninstallService"
		$s3 = "&G3 Users In RegistryD"
		$s4 = "OL_SHUTDOWN;I"
		$s5 = "SvcHostDLL.dll"
		$s6 = "RundllUninstallA"
		$s7 = "InternetOpenA"
		$s8 = "Check Cloneomplete"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_server
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file server.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<!-- PageServer Below -->"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_server {
	meta:
		description = "Webshells Auto-generated - file server.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1d38526a215df13c7373da4635541b43"
		id = "0e4fee1b-8a16-5738-9600-fa965f8c84c2"
	strings:
		$s0 = "<!-- PageServer Below -->"
	condition:
		all of them
}
YARA Detection Rule: vanquish
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file vanquish.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"

Detection condition:
all of them

Full rule:
rule vanquish {
	meta:
		description = "Webshells Auto-generated - file vanquish.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "684450adde37a93e8bb362994efc898c"
		id = "143e5e46-ffbc-5aee-9f9b-13374a6c3c10"
	strings:
		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
	condition:
		all of them
}
YARA Detection Rule: winshell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file winshell.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
		$s1 = "WinShell Service"
		$s2 = "__GLOBAL_HEAP_SELECTED"
		$s3 = "__MSVCRT_HEAP_SELECT"
		$s4 = "Provide Windows CmdShell Service"
		$s5 = "URLDownloadToFileA"
		$s6 = "RegisterServiceProcess"
		$s7 = "GetModuleBaseNameA"
		$s8 = "WinShell v5.0 (C)2002 janker.org"

Detection condition:
all of them

Full rule:
rule winshell {
	meta:
		description = "Webshells Auto-generated - file winshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3144410a37dd4c29d004a814a294ea26"
		id = "24edd03a-df71-5d84-9764-ba7903b68064"
	strings:
		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
		$s1 = "WinShell Service"
		$s2 = "__GLOBAL_HEAP_SELECTED"
		$s3 = "__MSVCRT_HEAP_SELECT"
		$s4 = "Provide Windows CmdShell Service"
		$s5 = "URLDownloadToFileA"
		$s6 = "RegisterServiceProcess"
		$s7 = "GetModuleBaseNameA"
		$s8 = "WinShell v5.0 (C)2002 janker.org"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_remview
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file remview.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"

Detection condition:
all of them

Full rule:
rule FSO_s_remview {
	meta:
		description = "Webshells Auto-generated - file remview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4a09911a5b23e00b55abe546ded691c"
		id = "5040ddbc-2e61-50ca-b738-a4ac8feec3f1"
	strings:
		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
	condition:
		all of them
}
YARA Detection Rule: saphpshell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file saphpshell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"

Detection condition:
all of them

Full rule:
rule saphpshell {
	meta:
		description = "Webshells Auto-generated - file saphpshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d7bba8def713512ddda14baf9cd6889a"
		id = "42bcd739-714e-5dbf-a3a1-929f3d16ed6f"
	strings:
		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006Z
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2006Z.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006Z {
	meta:
		description = "Webshells Auto-generated - file 2006Z.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "fd1b6129abd4ab177fed135e3b665488"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
	strings:
		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
	condition:
		all of them
}
YARA Detection Rule: admin_ad
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file admin-ad.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"

Detection condition:
all of them

Full rule:
rule admin_ad {
	meta:
		description = "Webshells Auto-generated - file admin-ad.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
		id = "7d87b4f6-3227-53cb-803c-4f9c7327f203"
	strings:
		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_casus15
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file casus15.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"

Detection condition:
all of them

Full rule:
rule FSO_s_casus15 {
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8d155b4239d922367af5d0a1b89533a3"
		id = "305842e4-26ad-573d-8df3-e32e239e434b"
	strings:
		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
	condition:
		all of them
}
YARA Detection Rule: BIN_Client
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file Client.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "=====Remote Shell Closed====="
		$s2 = "All Files(*.*)|*.*||"
		$s6 = "WSAStartup Error!"
		$s7 = "SHGetFileInfoA"
		$s8 = "CreateThread False!"
		$s9 = "Port Number Error"

Detection condition:
4 of them

Full rule:
rule BIN_Client {
	meta:
		description = "Webshells Auto-generated - file Client.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
		id = "515ab1b3-7923-55de-8c19-71ef5d9b4366"
	strings:
		$s0 = "=====Remote Shell Closed====="
		$s2 = "All Files(*.*)|*.*||"
		$s6 = "WSAStartup Error!"
		$s7 = "SHGetFileInfoA"
		$s8 = "CreateThread False!"
		$s9 = "Port Number Error"
	condition:
		4 of them
}
YARA Detection Rule: shelltools_g0t_root_uptime
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file uptime.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "JDiamondCSlC~"
		$s1 = "CharactQA"
		$s2 = "$Info: This file is packed with the UPX executable packer $"
		$s5 = "HandlereateConso"
		$s7 = "ION\\System\\FloatingPo"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_uptime {
	meta:
		description = "Webshells Auto-generated - file uptime.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
		id = "4f[PII_REDACTED]-5640-bc17-11cad6c779f4"
	strings:
		$s0 = "JDiamondCSlC~"
		$s1 = "CharactQA"
		$s2 = "$Info: This file is packed with the UPX executable packer $"
		$s5 = "HandlereateConso"
		$s7 = "ION\\System\\FloatingPo"
	condition:
		all of them
}
YARA Detection Rule: Simple_PHP_BackDooR
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file Simple_PHP_BackDooR.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
		$s9 = "// a simple php backdoor"

Detection condition:
1 of them

Full rule:
rule Simple_PHP_BackDooR {
	meta:
		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a401132363eecc3a1040774bec9cb24f"
		id = "bd7c19b9-e035-5e70-b626-1d210cadc055"
	strings:
		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
		$s9 = "// a simple php backdoor"
	condition:
		1 of them
}
YARA Detection Rule: sig_2005Gray
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005Gray.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"

Detection condition:
all of them

Full rule:
rule sig_2005Gray {
	meta:
		description = "Webshells Auto-generated - file 2005Gray.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
		id = "978fb04e-517d-51cf-98ca-5fd6b421365e"
	strings:
		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
	condition:
		all of them
}
YARA Detection Rule: DllInjection
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file DllInjection.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "\\BDoor\\DllInjecti"

Detection condition:
all of them

Full rule:
rule DllInjection {
	meta:
		description = "Webshells Auto-generated - file DllInjection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a7b92283a5102886ab8aee2bc5c8d718"
		id = "8a57e122-fd00-57f3-94db-736c5bfd76db"
	strings:
		$s0 = "\\BDoor\\DllInjecti"
	condition:
		all of them
}
YARA Detection Rule: Mithril_v1_45_Mithril
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file Mithril.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "cress.exe"
		$s7 = "\\Debug\\Mithril."

Detection condition:
all of them

Full rule:
rule Mithril_v1_45_Mithril {
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f1484f882dc381dde6eaa0b80ef64a07"
		id = "3c[PII_REDACTED]-532a-bb7f-390a4a34dc4e"
	strings:
		$s2 = "cress.exe"
		$s7 = "\\Debug\\Mithril."
	condition:
		all of them
}
YARA Detection Rule: hkshell_hkrmv
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file hkrmv.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "/THUMBPOSITION7"
		$s6 = "\\EvilBlade\\"

Detection condition:
all of them

Full rule:
rule hkshell_hkrmv {
	meta:
		description = "Webshells Auto-generated - file hkrmv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
		id = "986fad12-9198-5e0a-88d6-a9be6963ff8c"
	strings:
		$s5 = "/THUMBPOSITION7"
		$s6 = "\\EvilBlade\\"
	condition:
		all of them
}
YARA Detection Rule: WEBSHELL_PHP_1
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phpshell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "

Detection condition:
all of them

Full rule:
rule WEBSHELL_PHP_1 {
	meta:
		description = "Webshells Auto-generated - file phpshell.php"
		old_rule_name = "phpshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1dccb1ea9f24ffbd085571c88585517b"
		id = "d0107af3-e484-54cf-a238-dd1e71efd3f6"
	strings:
		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
	condition:
		all of them
}
YARA Detection Rule: FSO_s_cmd
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file cmd.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"

Detection condition:
all of them

Full rule:
rule FSO_s_cmd {
	meta:
		description = "Webshells Auto-generated - file cmd.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
		id = "f7a74f21-aec9-5ee7-a80e-0fe34b977a71"
	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_phpft
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phpft.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "PHP Files Thief"
		$s11 = "http://www.4ngel.net"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_phpft {
	meta:
		description = "Webshells Auto-generated - file phpft.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "60ef80175fcc6a879ca57c54226646b1"
		id = "00bc690b-4977-5076-a40a-edd39c37233f"
	strings:
		$s6 = "PHP Files Thief"
		$s11 = "http://www.4ngel.net"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_indexer
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file indexer.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"

Detection condition:
all of them

Full rule:
rule FSO_s_indexer {
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "135fc50f85228691b401848caef3be9e"
		id = "fba053d7-5413-563f-8c27[PII_REDACTED]b2"
	strings:
		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
	condition:
		all of them
}