deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_Project_Sauron_Custom_M7
Repository: Neo23x0/signature-base
Detects: Detects malware from Project Sauron APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/eFoP4A

Pattern signatures:
$sx1 = "Default user" fullword wide
		$sx2 = "Hincorrect header check" fullword ascii /* Typo */

		$sa1 = "MSAOSSPC.dll" fullword ascii
		$sa2 = "MSAOSSPC.DLL" fullword wide
		$sa3 = "MSAOSSPC" fullword wide
		$sa4 = "AOL Security Package" fullword wide
		$sa5 = "AOL Security Package" fullword wide
		$sa6 = "AOL Client for 32 bit platforms" fullword wide

		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 } /* Opcode */
		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 } /* Opcode */
		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b } /* Opcode */
		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 } /* Opcode */
		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 } /* Opcode */
		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and
		(
			( 3 of ($s*) and 3 of ($op*) ) or
			( 1 of ($sx*) and 1 of ($sa*) )
		)

Full rule:
rule APT_Project_Sauron_Custom_M7 {
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
		id = "c5e83e1a-872d-53b3-a74a-b1a9b4a89168"
	strings:
		$sx1 = "Default user" fullword wide
		$sx2 = "Hincorrect header check" fullword ascii /* Typo */

		$sa1 = "MSAOSSPC.dll" fullword ascii
		$sa2 = "MSAOSSPC.DLL" fullword wide
		$sa3 = "MSAOSSPC" fullword wide
		$sa4 = "AOL Security Package" fullword wide
		$sa5 = "AOL Security Package" fullword wide
		$sa6 = "AOL Client for 32 bit platforms" fullword wide

		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 } /* Opcode */
		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 } /* Opcode */
		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b } /* Opcode */
		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 } /* Opcode */
		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 } /* Opcode */
		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 } /* Opcode */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and
		(
			( 3 of ($s*) and 3 of ($op*) ) or
			( 1 of ($sx*) and 1 of ($sa*) )
		)
}
YARA Detection Rule: Silence_malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware sample mentioned in the Silence report on Securelist
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/the-silence/83009/

Pattern signatures:
$x1 = "adobeudp.exe" fullword wide
      $x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
      $x3 = "%s\\igfxpers_%08x.exe" fullword ascii
      $x4 = "%s\\adobeudp.exe" fullword ascii

      $s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
      $s2 = "Copyright (C)  1999 - 2017" fullword wide
      $s3 = "%sget.php?name=%x" fullword ascii
      $s4 = "VNASSRUNXYC" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e03edb9bd7cbe200dc59f361db847f8a" or
        1 of ($x*) or
        3 of them
      )

Full rule:
rule Silence_malware_1 {
   meta:
      description = "Detects malware sample mentioned in the Silence report on Securelist"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/the-silence/83009/"
      date = "2017-11-01"
      hash1 = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
      id = "f932e3fe-a2d7-55b7-b581-88c0ed45723e"
   strings:
      $x1 = "adobeudp.exe" fullword wide
      $x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
      $x3 = "%s\\igfxpers_%08x.exe" fullword ascii
      $x4 = "%s\\adobeudp.exe" fullword ascii

      $s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
      $s2 = "Copyright (C)  1999 - 2017" fullword wide
      $s3 = "%sget.php?name=%x" fullword ascii
      $s4 = "VNASSRUNXYC" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e03edb9bd7cbe200dc59f361db847f8a" or
        1 of ($x*) or
        3 of them
      )
}
YARA Detection Rule: Silence_malware_2
Repository: Neo23x0/signature-base
Detects: Detects malware sample mentioned in the Silence report on Securelist
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/the-silence/83009/

Pattern signatures:
$x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
      $x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii

      $s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
      $s2 = "\\mss.exe" ascii
      $s3 = "\\out.dat" ascii
      $s4 = "\\mss.txt" ascii
      $s5 = "Default monitor" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and (
            pe.imphash() == "69f3ec173efb6fd3ab5f79e0f8051335" or
            ( 1 of ($x*) or 3 of them )
         )
      ) or ( 5 of them )

Full rule:
rule Silence_malware_2 {
   meta:
      description = "Detects malware sample mentioned in the Silence report on Securelist"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/the-silence/83009/"
      date = "2017-11-01"
      hash1 = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
      id = "e4c7d753-fd04-5e11-9960-1ad238039c11"
   strings:
      $x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
      $x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii

      $s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
      $s2 = "\\mss.exe" ascii
      $s3 = "\\out.dat" ascii
      $s4 = "\\mss.txt" ascii
      $s5 = "Default monitor" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and (
            pe.imphash() == "69f3ec173efb6fd3ab5f79e0f8051335" or
            ( 1 of ($x*) or 3 of them )
         )
      ) or ( 5 of them )
}
YARA Detection Rule: HKTL_NFS_Fuse_NFS
Repository: Neo23x0/signature-base
Detects: Detects the nfs-security-tooling fuse_nfs by HvS Consulting
Author: Moritz Oettle
Reference: https://github.com/hvs-consulting/nfs-security-tooling

Pattern signatures:
$s1 = "NFS3ConnectionFactory" fullword ascii
      $s2 = "fuse_to_nfs_timestamp" fullword ascii
      $s3 = "--manual-fh" fullword ascii
      $s4 = "--fake-uid-allow-root" fullword ascii
      $s5 = "nfs.rpc.credential" fullword ascii
      $s6 = "nfs.readlink" fullword ascii
      $s7 = "pyfuse3.EntryAttributes" fullword ascii
      $s8 = "Make nested exports on NetApp servers work" fullword ascii
      $s9 = "add_mutually_exclusive_group" fullword ascii

Detection condition:
4 of them

Full rule:
rule HKTL_NFS_Fuse_NFS {
   meta:
      description = "Detects the nfs-security-tooling fuse_nfs by HvS Consulting"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      author = "Moritz Oettle"
      date = "2024-10-22"
      score = 75
      reference = "https://github.com/hvs-consulting/nfs-security-tooling"

      id = "287fbe7d-ee1c-58a4-aa2d-9d9bec8321b4"
   strings:
      $s1 = "NFS3ConnectionFactory" fullword ascii
      $s2 = "fuse_to_nfs_timestamp" fullword ascii
      $s3 = "--manual-fh" fullword ascii
      $s4 = "--fake-uid-allow-root" fullword ascii
      $s5 = "nfs.rpc.credential" fullword ascii
      $s6 = "nfs.readlink" fullword ascii
      $s7 = "pyfuse3.EntryAttributes" fullword ascii
      $s8 = "Make nested exports on NetApp servers work" fullword ascii
      $s9 = "add_mutually_exclusive_group" fullword ascii

   condition:
      4 of them
}
YARA Detection Rule: HKTL_NFS_NFS_Analyze
Repository: Neo23x0/signature-base
Detects: Detects the nfs-security-tooling nfy_analyze by HvS Consulting
Author: Marc Stroebel
Reference: https://github.com/hvs-consulting/nfs-security-tooling

Pattern signatures:
$s1 = "no_root_squash_exports" fullword ascii
      $s2 = "nfs lock manager" fullword ascii
      $s3 = "netapp partner" fullword ascii
      $s4 = "xdrdef.mnt3_type" fullword ascii
      $s5 = "BTRFS subvolumes" fullword ascii
      $s6 = "Unsupported fsid" fullword ascii
      $s7 = "nfs3_read_etc_shadow" fullword ascii
      $s8 = "nfs3_check_no_root_squash" fullword ascii
      $s9 = "krb5i" fullword ascii
      $s10 = "nfs4_overview" fullword ascii
      $s11 = "--btrfs-subvolumes" fullword ascii
      $s12 = "when escaping a BTRFS export" fullword ascii
      $s13 = "No NFS server detected" fullword ascii

Detection condition:
6 of them

Full rule:
rule HKTL_NFS_NFS_Analyze {
   meta:
      description = "Detects the nfs-security-tooling nfy_analyze by HvS Consulting"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      author = "Marc Stroebel"
      date = "2024-10-22"
      score = 75
      reference = "https://github.com/hvs-consulting/nfs-security-tooling"
      
      id = "3350d0ae-e638-5c8f-a578-ba0ac5521053"
   strings:
      $s1 = "no_root_squash_exports" fullword ascii
      $s2 = "nfs lock manager" fullword ascii
      $s3 = "netapp partner" fullword ascii
      $s4 = "xdrdef.mnt3_type" fullword ascii
      $s5 = "BTRFS subvolumes" fullword ascii
      $s6 = "Unsupported fsid" fullword ascii
      $s7 = "nfs3_read_etc_shadow" fullword ascii
      $s8 = "nfs3_check_no_root_squash" fullword ascii
      $s9 = "krb5i" fullword ascii
      $s10 = "nfs4_overview" fullword ascii
      $s11 = "--btrfs-subvolumes" fullword ascii
      $s12 = "when escaping a BTRFS export" fullword ascii
      $s13 = "No NFS server detected" fullword ascii

   condition:
      6 of them
}
YARA Detection Rule: MAL_crime_win32_loader_guloader_1_experimental
Repository: Neo23x0/signature-base
Detects: Detects injected GuLoader shellcode bin
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]46370050

Pattern signatures:
$djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
      $nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule MAL_crime_win32_loader_guloader_1_experimental {
   meta:
      description = "Detects injected GuLoader shellcode bin"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]46370050"
      tlp = "white"
      date = "2020-05-04"
      id = "c37882c6-15dc-54dc-8c10-7e91ea0fc6bd"
   strings:
      $djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
      $nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}
   condition:
      uint16(0) == 0x5a4d and all of them 
}
YARA Detection Rule: EXPL_Exchange_ProxyShell_Failed_Aug21_1
Repository: Neo23x0/signature-base
Detects: Detects ProxyShell exploitation attempts in log files
Author: Florian Roth (Nextron Systems)
Reference: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html

Pattern signatures:
$xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii

Detection condition:
1 of them

Full rule:
rule EXPL_Exchange_ProxyShell_Failed_Aug21_1: SCRIPT {
   meta:
      description = "Detects ProxyShell exploitation attempts in log files"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
      date = "2021-08-08"
      modified = "2021-08-09"
      id = "9b[PII_REDACTED]-5322-a35a-2165d4b541d5"
   strings:
      $xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii
   condition:
      1 of them
}
YARA Detection Rule: EXPL_Exchange_ProxyShell_Successful_Aug21_1
Repository: Neo23x0/signature-base
Detects: Detects successful ProxyShell exploitation attempts in log files
Author: Florian Roth (Nextron Systems)
Reference: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html

Pattern signatures:
$xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
      $xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/
      $xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii

Detection condition:
1 of them

Full rule:
rule EXPL_Exchange_ProxyShell_Successful_Aug21_1: SCRIPT {
   meta:
      description = "Detects successful ProxyShell exploitation attempts in log files"
      author = "Florian Roth (Nextron Systems)"
      score = 65
      reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
      date = "2021-08-08"
      modified = "2025-03-21"
      id = "8c11cd1a-6d3f-5f29-af61-17179b01ca8b"
   strings:
      $xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
      $xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/
      $xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii
   condition:
      1 of them
}
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Aug21_2
Repository: Neo23x0/signature-base
Detects: Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content
Author: Florian Roth (Nextron Systems)
Reference: https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/

Pattern signatures:
$s1 = "Page Language=" ascii nocase

Detection condition:
uint32(0) == 0x4e444221  /* PST header: !BDN */
      and filesize < 2MB
      and $s1

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Aug21_2 {
   meta:
      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
      date = "2021-08-13"
      id = "a351a466-695e-570e-8c7f-9c6c0534839c"
   strings:
      $s1 = "Page Language=" ascii nocase
   condition:
      uint32(0) == 0x4e444221  /* PST header: !BDN */
      and filesize < 2MB
      and $s1
}
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Aug21_3
Repository: Neo23x0/signature-base
Detects: Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content
Author: Max Altgelt
Reference: https://twitter.com/gossithedog/status/[PII_REDACTED]05127938?s=12

Pattern signatures:
$s1 = "Page Language=" ascii nocase

Detection condition:
uint16(0) == 0x8230  /* DER start */
      and filesize < 10KB
      and $s1

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Aug21_3 {
   meta:
      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
      author = "Max Altgelt"
      reference = "https://twitter.com/gossithedog/status/[PII_REDACTED]05127938?s=12"
      date = "2021-08-23"
      score = 75
      id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"
   strings:
      $s1 = "Page Language=" ascii nocase
   condition:
      uint16(0) == 0x8230  /* DER start */
      and filesize < 10KB
      and $s1
}
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Sep21_1
Repository: Neo23x0/signature-base
Detects: Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request
Author: Tobias Michalski
Reference: Internal Research

Pattern signatures:
$s = ".FromBase64String(Request["

Detection condition:
uint32(0) == 0x4e444221
      and any of them

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Sep21_1 {
   meta:
      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
      author = "Tobias Michalski"
      date = "2021-09-17"
      reference = "Internal Research"
      hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
      score = 75
      id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"
   strings:
      $s = ".FromBase64String(Request["
   condition:
      uint32(0) == 0x4e444221
      and any of them
}
YARA Detection Rule: APT_IIS_Config_ProxyShell_Artifacts
Repository: Neo23x0/signature-base
Detects: Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)
Author: Florian Roth (Nextron Systems)
Reference: https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit

Pattern signatures:
$a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
      $sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
      $sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
      $sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
      $sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
      $sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
      $sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii

      $sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii

Detection condition:
filesize < 500KB and all of ($a*) and 1 of ($s*)

Full rule:
rule APT_IIS_Config_ProxyShell_Artifacts {
   meta:
      description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
      date = "2021-08-25"
      score = 90
      id = "21888fc0-82c6-555a-9320-9cbb8332a843"
   strings:
      $a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
      $sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
      $sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
      $sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
      $sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
      $sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
      $sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii

      $sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
   condition:
      filesize < 500KB and all of ($a*) and 1 of ($s*)
}
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Exploitation_Aug21_1
Repository: Neo23x0/signature-base
Detects: Detects unknown malicious loaders noticed in August 2021
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/VirITeXplorer/status/[PII_REDACTED]33097473

Pattern signatures:
$x1 = ");eval/*asf" ascii

Detection condition:
filesize < 600KB and 1 of them

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Exploitation_Aug21_1 {
   meta:
      description = "Detects unknown malicious loaders noticed in August 2021"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/VirITeXplorer/status/[PII_REDACTED]33097473"
      date = "2021-08-25"
      score = 90
      id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"
   strings:
      $x1 = ");eval/*asf" ascii
   condition:
      filesize < 600KB and 1 of them
}
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Aug15
Repository: Neo23x0/signature-base
Detects: Webshells iisstart.aspx and Logout.aspx
Author: Moritz Oettle
Reference: https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell

Pattern signatures:
$g1 = "language=\"JScript\"" ascii
      $g2 = "function getErrorWord" ascii
      $g3 = "errorWord" ascii
      $g4 = "Response.Redirect" ascii
      $g5 = "function Page_Load" ascii
      $g6 = "runat=\"server\"" ascii
      $g7 = "Request[" ascii
      $g8 = "eval/*" ascii

      $s1 = "AppcacheVer" ascii  /* HTTP Request Parameter */
      //$s2 = "clientCode" ascii /* HTTP Request Parameter */
      $s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii

      $fp1 = "<input type=\"submit\" Value=\"Refresh This Page\""

Detection condition:
filesize < 1KB
      and (
         1 of ($s*)
         or 4 of ($g*)
      )
      and not 1 of ($fp*)

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Aug15 {
   meta:
      description = "Webshells iisstart.aspx and Logout.aspx"
      author = "Moritz Oettle"
      reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
      date = "2021-09-04"
      modified = "2025-11-03"
      score = 75
      id = "b1e6c0f3-787f-59b8-8[PII_REDACTED]047ca"
   strings:
      $g1 = "language=\"JScript\"" ascii
      $g2 = "function getErrorWord" ascii
      $g3 = "errorWord" ascii
      $g4 = "Response.Redirect" ascii
      $g5 = "function Page_Load" ascii
      $g6 = "runat=\"server\"" ascii
      $g7 = "Request[" ascii
      $g8 = "eval/*" ascii

      $s1 = "AppcacheVer" ascii  /* HTTP Request Parameter */
      //$s2 = "clientCode" ascii /* HTTP Request Parameter */
      $s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii

      $fp1 = "<input type=\"submit\" Value=\"Refresh This Page\""
   condition:
      filesize < 1KB
      and (
         1 of ($s*)
         or 4 of ($g*)
      )
      and not 1 of ($fp*)
}