deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_RANSOMWARE_Indicator_Jul20
Repository: Neo23x0/signature-base
Detects: Detects ransomware indicator
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Pattern signatures:
$ = "Decrypt.txt" ascii wide 
      $ = "DecryptFiles.txt" ascii wide
      $ = "Decrypt-Files.txt" ascii wide
      $ = "DecryptFilesHere.txt" ascii wide
      $ = "DECRYPT.txt" ascii wide 
      $ = "DecryptFiles.txt" ascii wide
      $ = "DECRYPT-FILES.txt" ascii wide
      $ = "DecryptFilesHere.txt" ascii wide
      $ = "DECRYPT_INSTRUCTION.TXT" ascii wide 
      $ = "FILES ENCRYPTED.txt" ascii wide
      $ = "DECRYPT MY FILES" ascii wide 
      $ = "DECRYPT-MY-FILES" ascii wide 
      $ = "DECRYPT_MY_FILES" ascii wide
      $ = "DECRYPT YOUR FILES" ascii wide  
      $ = "DECRYPT-YOUR-FILES" ascii wide 
      $ = "DECRYPT_YOUR_FILES" ascii wide 
      $ = "DECRYPT FILES.txt" ascii wide

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 1400KB and
      1 of them

Full rule:
rule SUSP_RANSOMWARE_Indicator_Jul20 {
   meta:
      description = "Detects ransomware indicator"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
      date = "2020-07-28"
      score = 60
      hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
      hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
      hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf[PII_REDACTED]594f306"
      id = "6036fdfd-8474-5d79-ac75-137ac2efdc77"
   strings:
      $ = "Decrypt.txt" ascii wide 
      $ = "DecryptFiles.txt" ascii wide
      $ = "Decrypt-Files.txt" ascii wide
      $ = "DecryptFilesHere.txt" ascii wide
      $ = "DECRYPT.txt" ascii wide 
      $ = "DecryptFiles.txt" ascii wide
      $ = "DECRYPT-FILES.txt" ascii wide
      $ = "DecryptFilesHere.txt" ascii wide
      $ = "DECRYPT_INSTRUCTION.TXT" ascii wide 
      $ = "FILES ENCRYPTED.txt" ascii wide
      $ = "DECRYPT MY FILES" ascii wide 
      $ = "DECRYPT-MY-FILES" ascii wide 
      $ = "DECRYPT_MY_FILES" ascii wide
      $ = "DECRYPT YOUR FILES" ascii wide  
      $ = "DECRYPT-YOUR-FILES" ascii wide 
      $ = "DECRYPT_YOUR_FILES" ascii wide 
      $ = "DECRYPT FILES.txt" ascii wide
   condition:
      uint16(0) == 0x5a4d and
      filesize < 1400KB and
      1 of them
}
YARA Detection Rule: gen_unicorn_obfuscated_powershell
Repository: Neo23x0/signature-base
Detects: PowerShell payload obfuscated by Unicorn toolkit
Author: John Lambert @JohnLaTwC
Reference: https://github.com/trustedsec/unicorn/

Pattern signatures:
$h1 = "powershell"
        $sa1 = ".value.toString() 'JAB"
        $sa2 = ".value.toString() ('JAB"
        $sb1 = "-w 1 -C \"s"
        $sb2 = "/w 1 /C \"s"

Detection condition:
filesize < 20KB
        and uint32be(0) == 0x706f7765
        and $h1 at 0
        and (
           uint16be(filesize-2) == 0x2722 or  /* Footer 1 */
           ( uint16be(filesize-2) == 0x220a and uint8(filesize-3) == 0x27 )  or /* Footer 2 */
           ( uint16be(filesize-2) == 0x2922 and uint8(f

Full rule:
rule gen_unicorn_obfuscated_powershell {
    meta:
        description = "PowerShell payload obfuscated by Unicorn toolkit"
        author = "John Lambert @JohnLaTwC"
        date = "2018-04-03"
        hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
        hash2 = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
        reference = "https://github.com/trustedsec/unicorn/"
        id = "0235795b-6d0b-5bba-8ae6-606c3b613c86"
    strings:
        $h1 = "powershell"
        $sa1 = ".value.toString() 'JAB"
        $sa2 = ".value.toString() ('JAB"
        $sb1 = "-w 1 -C \"s"
        $sb2 = "/w 1 /C \"s"        
    condition:
        filesize < 20KB
        and uint32be(0) == 0x706f7765
        and $h1 at 0
        and (
           uint16be(filesize-2) == 0x2722 or  /* Footer 1 */
           ( uint16be(filesize-2) == 0x220a and uint8(filesize-3) == 0x27 )  or /* Footer 2 */
           ( uint16be(filesize-2) == 0x2922 and uint8(filesize-3) == 0x27 )  /* Footer 3 */
        )
        and ( 1 of ($sa*) and 1 of ($sb*) )
}
YARA Detection Rule: PoisonIvy_Generic_3
Repository: Neo23x0/signature-base
Detects: PoisonIvy RAT Generic Rule
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$k1 = "Tiger324{" fullword ascii
		
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and
			( 
				$k1 or all of ($s*) or all of ($h*)
			)

Full rule:
rule PoisonIvy_Generic_3 {
	meta:
		description = "PoisonIvy RAT Generic Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-14"
		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
		id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"
	strings:
		$k1 = "Tiger324{" fullword ascii
		
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and
			( 
				$k1 or all of ($s*) or all of ($h*)
			)
}
YARA Detection Rule: APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus VHD Ransomware
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Pattern signatures:
$s1 = "HowToDecrypt.txt" wide fullword
      $s2 = "rsa.cpp" wide fullword
      $s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword

      $op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
      $op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
      $op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 400KB and
      2 of them

Full rule:
rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 {
   meta:
      description = "Detects Lazarus VHD Ransomware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
      date = "2020-10-05"
      hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
      hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
      hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf[PII_REDACTED]594f306"
      id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
   strings:
      $s1 = "HowToDecrypt.txt" wide fullword
      $s2 = "rsa.cpp" wide fullword
      $s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword

      $op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
      $op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
      $op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and
      2 of them
}
YARA Detection Rule: APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2
Repository: Neo23x0/signature-base
Detects: Detects Lazarus VHD Ransomware
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Pattern signatures:
$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
      $op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
      $op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 9000KB and
      all of them

Full rule:
rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 {
   meta:
      description = "Detects Lazarus VHD Ransomware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
      date = "2020-10-05"
      hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
      hash2 = "73a10be31832c9f1cbbd[PII_REDACTED]09da0881592a90feb472e80025dfb0ea79"
      id = "b75668de-93e6-57e7-90f0-fa335295be7c"
   strings:
      $op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
      $op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
      $op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 9000KB and
      all of them
}
YARA Detection Rule: MAL_Winnti_BR_Report_TwinPeaks
Repository: Neo23x0/signature-base
Detects: Detects Winnti samples
Author: @br_data repo
Reference: https://github.com/br-data/2019-winnti-analyse

Pattern signatures:
$cooper = "Cooper"
      $pattern = { e9 ea eb ec ed ee ef f0}

Detection condition:
uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))

Full rule:
rule MAL_Winnti_BR_Report_TwinPeaks {
   meta:
      description = "Detects Winnti samples"
      author = "@br_data repo"
      reference = "https://github.com/br-data/2019-winnti-analyse"
      date = "2019-07-24"
      id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"
   strings:
      $cooper = "Cooper"
      $pattern = { e9 ea eb ec ed ee ef f0}
   condition:
      uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
}
YARA Detection Rule: MAL_BR_Report_TheDao
Repository: Neo23x0/signature-base
Detects: Detects indicator in malicious UPX packed samples
Author: @br_data repo
Reference: https://github.com/br-data/2019-winnti-analyse

Pattern signatures:
$b = { DA A0 }

Detection condition:
uint16(0) == 0x5a4d and $b at pe.overlay.offset and pe.overlay.size > 100

Full rule:
rule MAL_BR_Report_TheDao {
   meta:
      description = "Detects indicator in malicious UPX packed samples"
      author = "@br_data repo"
      reference = "https://github.com/br-data/2019-winnti-analyse"
      date = "2019-07-24"
      id = "5cc932d7-2ec6-5570-af4a-3f64b39e6db5"
  strings:
    $b = { DA A0 }
  condition:
    uint16(0) == 0x5a4d and $b at pe.overlay.offset and pe.overlay.size > 100
}
YARA Detection Rule: MAL_Winnti_BR_Report_MockingJay
Repository: Neo23x0/signature-base
Detects: Detects Winnti samples
Author: @br_data repo
Reference: https://github.com/br-data/2019-winnti-analyse

Pattern signatures:
$load_magic = { C7 44 ?? ?? FF D8 FF E0 }
    $iter = { E9 EA EB EC ED EE EF F0 }
    $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }

Detection condition:
uint16(0) == 0x5a4d and
      $jpeg and
      ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
      for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )

Full rule:
rule MAL_Winnti_BR_Report_MockingJay {
   meta:
      description = "Detects Winnti samples"
      author = "@br_data repo"
      reference = "https://github.com/br-data/2019-winnti-analyse"
      date = "2019-07-24"
      id = "9aff9d65-3827-59de-9dc3-38f227155d3d"
  strings:
    $load_magic = { C7 44 ?? ?? FF D8 FF E0 }
    $iter = { E9 EA EB EC ED EE EF F0 }
    $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
  condition:
    uint16(0) == 0x5a4d and
      $jpeg and
      ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
      for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )
}
YARA Detection Rule: SUSP_SFX_RunProgram_WScript
Repository: Neo23x0/signature-base
Detects: Detects suspicious SFX that runs wscript.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "RunProgram=\"wscript.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them

Full rule:
rule SUSP_SFX_RunProgram_WScript {
   meta:
      description = "Detects suspicious SFX that runs wscript.exe"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-09-27"
      score = 75
      hash1 = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
      hash2 = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
      hash3 = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
      hash4 = "b6fa4889d8a87d45706d92714d716025bf223c[PII_REDACTED]1faac1ab0db94a88"
      hash5 = "7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d"
      hash6 = "ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e"
      id = "e12cea50-a939-5f69-963c-d6d1cb133e92"
   strings:
      $x1 = "RunProgram=\"wscript.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them
}
YARA Detection Rule: brc4_shellcode
Repository: Neo23x0/signature-base
Detects: Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9
Author: @ninjaparanoid
Reference: https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara

Pattern signatures:
$shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
        $shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
        $shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
        $funcHash1 = { 5B BC 4A 6A }
        $funcHash2 = { 5D 68 FA 3C }
        $funcHash3 = { AA FC 0D 7C }
        $funcHash4 = { 8E 4E 0E EC }
        $funcHash5 = { B8 12 DA 00 }
        $funcHash6 = { 07 C4 4C E5 }
        $funcHash7 = { BD CA 3B D3 }
        $funcHash8 = { 89 4D 39 8C }
        $hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
        $hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }

Detection condition:
(pe.machine == pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64))
        or
        (pe.machine == pe.MACHINE_I386 and (all of ($funcHash*) and $hashFuncx86))

Full rule:
rule brc4_shellcode {
    meta:
        version = "last version"
        author = "@ninjaparanoid"
        description = "Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9"
        arch_context = "x64"
        reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
        date = "2022-11-19"
        id = "7e899d2f-332b-53f7-b9e6-cfde2bce6223"
    strings:
        $shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
        $shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
        $shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
        $funcHash1 = { 5B BC 4A 6A }
        $funcHash2 = { 5D 68 FA 3C }
        $funcHash3 = { AA FC 0D 7C }
        $funcHash4 = { 8E 4E 0E EC }
        $funcHash5 = { B8 12 DA 00 }
        $funcHash6 = { 07 C4 4C E5 }
        $funcHash7 = { BD CA 3B D3 }
        $funcHash8 = { 89 4D 39 8C }
        $hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
        $hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }
    condition:
        (pe.machine == pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64))
        or
        (pe.machine == pe.MACHINE_I386 and (all of ($funcHash*) and $hashFuncx86))
}
YARA Detection Rule: HKTL_Venom_LIB_Dec22
Repository: Neo23x0/signature-base
Detects: Detects Venom - a library that meant to perform evasive communication using stolen browser socket
Author: Ido Veltzman, Florian Roth
Reference: https://github.com/Idov31/Venom

Pattern signatures:
$x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
      
      $ss1 = "WS2_32.dll" fullword ascii
      $ss2 = "WSASocketW" fullword ascii
      $ss3 = "WSADuplicateSocketW" fullword ascii
      $ss5 = "\\Device\\Afd" wide fullword
      
      $sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
      $sx2 = "[ + ] Data sent!" fullword ascii
      $sx3 = "[ + ] Socket obtained!" fullword ascii
      
      $op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
      $op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
      $op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         ( 3 of ($ss*) and all of ($op*) )
         or 2 of ($sx*)
      ) or $x1 or all of ($sx*)

Full rule:
rule HKTL_Venom_LIB_Dec22 {
   meta:
      description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
      author = "Ido Veltzman, Florian Roth"
      reference = "https://github.com/Idov31/Venom"
      date = "2022-12-17"
      score = 75
      id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"
   strings:
      $x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
      
      $ss1 = "WS2_32.dll" fullword ascii
      $ss2 = "WSASocketW" fullword ascii
      $ss3 = "WSADuplicateSocketW" fullword ascii
      $ss5 = "\\Device\\Afd" wide fullword
      
      $sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
      $sx2 = "[ + ] Data sent!" fullword ascii
      $sx3 = "[ + ] Socket obtained!" fullword ascii
      
      $op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
      $op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
      $op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         ( 3 of ($ss*) and all of ($op*) )
         or 2 of ($sx*)
      ) or $x1 or all of ($sx*)
}
YARA Detection Rule: Line_Dancer
Repository: Neo23x0/signature-base
Detects: Targets code sections of Line Dancer, a shellcode loader targeting Cisco ASA devices.
Author: NCSC
Reference: https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

Pattern signatures:
$ = { 48 8D 5E 20 48 8D 3D BB FF FF FF BA 20 00 00 00 }
      $ = { 4C 89 EE 44 89 F2 48 8D 3D 9A 27 00 00 }
      $ = { 41 FF D7 41 5F 41 5E 41 5D 41 5C 5B 5D 48 C7 C0 01 00 00 00 5F }

Detection condition:
all of them

Full rule:
rule Line_Dancer {
   meta:
      author = "NCSC"
      description = "Targets code sections of Line Dancer, a shellcode loader targeting Cisco ASA devices."
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
      date = "2024-04-24"
      score = 75
      id = "3b49a861-8107-577a-bae1-ae28d424cc13"
   strings:
      $ = { 48 8D 5E 20 48 8D 3D BB FF FF FF BA 20 00 00 00 }
      $ = { 4C 89 EE 44 89 F2 48 8D 3D 9A 27 00 00 }
      $ = { 41 FF D7 41 5F 41 5E 41 5D 41 5C 5B 5D 48 C7 C0 01 00 00 00 5F }
   condition:
      all of them
}
YARA Detection Rule: GoldDragon_malware_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Gold Dragon report
Author: Florian Roth (Nextron Systems)
Reference: https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "168c2f7752511dfd263a83d5d08a90db" or
         pe.imphash() == "0606858bdeb129de33a2b095d7806e74" or
         pe.imphash() == "51d992f5b9e01533eb1356323ed1cb0f" or
         pe.imphash() == "bb801224abd8562f9ee8fb261b75e32a"
    

Full rule:
rule GoldDragon_malware_Feb18_1 {
   meta:
      description = "Detects malware from Gold Dragon report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
      date = "2018-02-03"
      score = 90
      id = "1da29f0f-4e83-56a0-b843-3b19d9b9a1b7"
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "168c2f7752511dfd263a83d5d08a90db" or
         pe.imphash() == "0606858bdeb129de33a2b095d7806e74" or
         pe.imphash() == "51d992f5b9e01533eb1356323ed1cb0f" or
         pe.imphash() == "bb801224abd8562f9ee8fb261b75e32a"
      )
}
YARA Detection Rule: GoldDragon_Aux_File
Repository: Neo23x0/signature-base
Detects: Detects export from Gold Dragon - February 2018
Author: Florian Roth (Nextron Systems)
Reference: https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/

Pattern signatures:
$x1 = "/////////////////////regkeyenum////////////" ascii

Detection condition:
filesize < 500KB and 1 of them

Full rule:
rule GoldDragon_Aux_File {
   meta:
      description = "Detects export from Gold Dragon - February 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
      date = "2018-02-03"
      score = 90
      id = "8f23dec4-e369-500f-a036-32df13e5543e"
   strings:
      $x1 = "/////////////////////regkeyenum////////////" ascii
   condition:
      filesize < 500KB and 1 of them
}
YARA Detection Rule: GoldDragon_RunnignRAT
Repository: Neo23x0/signature-base
Detects: Detects Running RAT malware from Gold Dragon report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/rW1yvZ

Pattern signatures:
$s1 = "cmd.exe /c systeminfo " fullword ascii
      $s2 = "ieproxy.dll" fullword ascii
      $s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
      $s4 = "cmd.exe /c tasklist " fullword ascii
      $s5 = "rundll32.exe \"%s\" Run" fullword ascii
      $s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
      $s7 = "%s\\%s_%03d" fullword wide
      $s8 = "\\PI_001.dat" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
         3 of them
      )

Full rule:
rule GoldDragon_RunnignRAT {
   meta:
      description = "Detects Running RAT malware from Gold Dragon report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/rW1yvZ"
      date = "2018-02-03"
      modified = "2023-01-07"
      hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
      hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
      hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
      id = "b99b89a4-a764-5d72-8360-8e53461267d9"
   strings:
      $s1 = "cmd.exe /c systeminfo " fullword ascii
      $s2 = "ieproxy.dll" fullword ascii
      $s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
      $s4 = "cmd.exe /c tasklist " fullword ascii
      $s5 = "rundll32.exe \"%s\" Run" fullword ascii
      $s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
      $s7 = "%s\\%s_%03d" fullword wide
      $s8 = "\\PI_001.dat" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
         3 of them
      )
}
YARA Detection Rule: LSASS_memory_dump_file
Repository: Neo23x0/signature-base
Detects: Detects a LSASS memory dump file
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "lsass.exe" ascii fullword
      $s2 = "wdigest.DLL" wide nocase

Detection condition:
uint32(0) == 0x504D444D and all of them

Full rule:
rule LSASS_memory_dump_file {
   meta:
      description = "Detects a LSASS memory dump file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2015/03/31"
      memory = 0
      score = 50
   strings:
      $s1 = "lsass.exe" ascii fullword
      $s2 = "wdigest.DLL" wide nocase
   condition:
        uint32(0) == 0x504D444D and all of them
}