deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: TeleBots_VBS_Backdoor_1
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - VBS Backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
      $s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
      $s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
      $s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii

Detection condition:
( uint16(0) == 0x6553 and filesize < 8KB and 1 of them ) or ( all of them )

Full rule:
rule TeleBots_VBS_Backdoor_1 {
   meta:
      description = "Detects TeleBots malware - VBS Backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
      id = "2b711f66-8ec5-5b9a-a762-7e6668c821c9"
   strings:
      $s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
      $s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
      $s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
      $s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii
   condition:
      ( uint16(0) == 0x6553 and filesize < 8KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: TeleBots_VBS_Backdoor_2
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - VBS Backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
      $s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
      $s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii

Detection condition:
( uint16(0) == 0x6944 and filesize < 30KB and 1 of them ) or ( 2 of them )

Full rule:
rule TeleBots_VBS_Backdoor_2 {
   meta:
      description = "Detects TeleBots malware - VBS Backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
      id = "151849af-f1d0-529c-94f2-287312f6515e"
   strings:
      $s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
      $s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
      $s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii
   condition:
      ( uint16(0) == 0x6944 and filesize < 30KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: TeleBots_Win64_Spy_KeyLogger_G
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - Win64 Spy KeyLogger G
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
      $s2 = "Install hooks error!" fullword wide
      $s4 = "%ls%d.~tmp" fullword wide
      $s5 = "[*]Window PID > %d: " fullword wide
      $s6 = "Install hooks ok!" fullword wide
      $s7 = "[!]Clipboard paste" fullword wide
      $s9 = "[*] IMAGE : %ls" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 3 of them )

Full rule:
rule TeleBots_Win64_Spy_KeyLogger_G {
   meta:
      description = "Detects TeleBots malware - Win64 Spy KeyLogger G"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
      id = "fd16a198-1b28-532b-a1ba-70680469ec51"
   strings:
      $s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
      $s2 = "Install hooks error!" fullword wide
      $s4 = "%ls%d.~tmp" fullword wide
      $s5 = "[*]Window PID > %d: " fullword wide
      $s6 = "Install hooks ok!" fullword wide
      $s7 = "[!]Clipboard paste" fullword wide
      $s9 = "[*] IMAGE : %ls" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 3 of them )
}
YARA Detection Rule: TA17_318A_rc4_stack_key_fallchill
Repository: Neo23x0/signature-base
Detects: HiddenCobra FallChill - rc4_stack_key
Author: US CERT
Reference: https://www.us-cert.gov/ncas/alerts/TA17-318B

Pattern signatures:
$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key

Full rule:
rule TA17_318A_rc4_stack_key_fallchill {
   meta:
      description = "HiddenCobra FallChill - rc4_stack_key"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
      date = "2017-11-15"
      id = "0a2afcab-f540-592f-aa75-64c0a13d26f3"
   strings:
      $stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key
}
YARA Detection Rule: TA17_318A_success_fail_codes_fallchill
Repository: Neo23x0/signature-base
Detects: HiddenCobra FallChill - success_fail_codes
Author: US CERT
Reference: https://www.us-cert.gov/ncas/alerts/TA17-318B

Pattern signatures:
$s0 = { 68 7a 34 12 00 }
      $s1 = { ba 7a 34 12 00 }
      $f0 = { 68 5c 34 12 00 }
      $f1 = { ba 5c 34 12 00 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))

Full rule:
rule TA17_318A_success_fail_codes_fallchill {
   meta:
      description = "HiddenCobra FallChill - success_fail_codes"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
      date = "2017-11-15"
      id = "f2390b03-238e-5ae6-af85-e5dd5790362f"
   strings:
      $s0 = { 68 7a 34 12 00 }
      $s1 = { ba 7a 34 12 00 }
      $f0 = { 68 5c 34 12 00 }
      $f1 = { ba 5c 34 12 00 }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))
}
YARA Detection Rule: HiddenCobra_FallChill_1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-318A

Pattern signatures:
$s1 = "REGSVR32.EXE.MUI" fullword wide
      $s2 = "Microsoft Corporation. All rights reserved." fullword wide
      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
      $s4 = "\" goto Loop" fullword ascii

      $e1 = "xolhvhlxpvg" fullword ascii
      $e2 = "tvgslhgybmanv" fullword ascii
      $e3 = "CivagvTllosvok32Smakhslg" fullword ascii
      $e4 = "GvgCfiivmgDrivxglibW" fullword ascii
      $e5 = "OkvmPilxvhhTlpvm" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
        pe.imphash() == "6135d9bc3591ae7bc72d070eadd31755" or
        3 of ($s*) or
        4 of them
      )

Full rule:
rule HiddenCobra_FallChill_1 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
      date = "2017-11-15"
      hash1 = "a[PII_REDACTED]35d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
      id = "5bbeb5ba-93d7-5903-9132-749afe5776ae"
   strings:
      $s1 = "REGSVR32.EXE.MUI" fullword wide
      $s2 = "Microsoft Corporation. All rights reserved." fullword wide
      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
      $s4 = "\" goto Loop" fullword ascii

      $e1 = "xolhvhlxpvg" fullword ascii
      $e2 = "tvgslhgybmanv" fullword ascii
      $e3 = "CivagvTllosvok32Smakhslg" fullword ascii
      $e4 = "GvgCfiivmgDrivxglibW" fullword ascii
      $e5 = "OkvmPilxvhhTlpvm" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
        pe.imphash() == "6135d9bc3591ae7bc72d070eadd31755" or
        3 of ($s*) or
        4 of them
      )
}
YARA Detection Rule: HiddenCobra_FallChill_2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-318A

Pattern signatures:
$s1 = "%s\\%s.dll" fullword wide
      $s2 = "yurdkr.dll" fullword ascii
      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "cb36dcb9909e29a38c387b8a87e7e4ed" or
         ( 2 of them )
      )

Full rule:
rule HiddenCobra_FallChill_2 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
      date = "2017-11-15"
      hash1 = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
      id = "c343e8e4-0785-5a47-99c1-98b189f4aaa0"
   strings:
      $s1 = "%s\\%s.dll" fullword wide
      $s2 = "yurdkr.dll" fullword ascii
      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "cb36dcb9909e29a38c387b8a87e7e4ed" or
         ( 2 of them )
      )
}
YARA Detection Rule: SUSP_Claude_Refusal_Magic_String_Jan26
Repository: Neo23x0/signature-base
Detects: Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.
Author: Marius Benthin
Reference: https://x.com/williballenthin/status/[PII_REDACTED]165135150

Pattern signatures:
$x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide nocase

Detection condition:
$x1

Full rule:
rule SUSP_Claude_Refusal_Magic_String_Jan26 {
   meta:
      description = "Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "https://x.com/williballenthin/status/[PII_REDACTED]165135150"
      hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e[PII_REDACTED]0"
      score = 75
   strings:
      $x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide nocase
   condition:
      $x1
}
YARA Detection Rule: MAL_Claude_Refusal_Magic_String_Jan26
Repository: Neo23x0/signature-base
Detects: Detects Base64 variations of refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.
Author: Marius Benthin
Reference: Internal Research

Pattern signatures:
$xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide base64 base64wide

Detection condition:
$xb1

Full rule:
rule MAL_Claude_Refusal_Magic_String_Jan26 {
   meta:
      description = "Detects Base64 variations of refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      score = 80
   strings:
      $xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide base64 base64wide
   condition:
      $xb1
}
YARA Detection Rule: SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_1
Repository: Neo23x0/signature-base
Detects: Detects redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.
Author: Marius Benthin
Reference: Internal Research

Pattern signatures:
$x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide nocase

Detection condition:
$x1

Full rule:
rule SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_1 {
   meta:
      description = "Detects redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e[PII_REDACTED]0"
      score = 65
   strings:
      $x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide nocase
   condition:
      $x1
}
YARA Detection Rule: SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_2
Repository: Neo23x0/signature-base
Detects: Detects Base64 variations of redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.
Author: Marius Benthin
Reference: Internal Research

Pattern signatures:
$xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide base64 base64wide

Detection condition:
$xb1

Full rule:
rule SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_2 {
   meta:
      description = "Detects Base64 variations of redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      score = 75
   strings:
      $xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide base64 base64wide
   condition:
      $xb1
}
YARA Detection Rule: APT_fnv1a_plus_extra_XOR_in_MSIL_experimental
Repository: Neo23x0/signature-base
Detects: This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)
Author: Arnim Rupp
Reference: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Pattern signatures:
$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }

		// use for less false positives, xor before fnv1a prime
		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A }
		// even less false positives, not sure if it misses beef
		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A 00 00 }

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule APT_fnv1a_plus_extra_XOR_in_MSIL_experimental
{
    meta:
        description = "This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        author = "Arnim Rupp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		date = "2020-12-22"
		hash1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
		hash2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
		hash3 = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
        id = "5505f7ff-eca5-5274-bdd1-dbbd648c3ccc"
    strings:
		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }

		// use for less false positives, xor before fnv1a prime
		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A }
		// even less false positives, not sure if it misses beef
		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
    condition:
		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: TEST_false_positive_plain_fnv1a_in_x64
Repository: Neo23x0/signature-base
Detects: This rule detects x64 implementations of standard fnv1a just by looking for the standard fnv64a_offset and fnv64a_prime (unless bitshifting is used instead of multiplication). This rule would have found the SUNBURST backdoor at Solarwinds but will also find any other programm which implements fnv1a. Just useful for developers, pls check if that fnv1a was put there by you ;)
Author: Arnim Rupp
Reference: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Pattern signatures:
$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
		$fnv64a_prime = { B3 01 00 00 00 01 }

Detection condition:
// MZ or ELF
		( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and all of them

Full rule:
rule TEST_false_positive_plain_fnv1a_in_x64
{
    meta:
        description = "This rule detects x64 implementations of standard fnv1a just by looking for the standard fnv64a_offset and fnv64a_prime (unless bitshifting is used instead of multiplication). This rule would have found the SUNBURST backdoor at Solarwinds but will also find any other programm which implements fnv1a. Just useful for developers, pls check if that fnv1a was put there by you ;)"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        author = "Arnim Rupp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		date = "2020-12-22"
		score = 10
    strings:
		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
		$fnv64a_prime = { B3 01 00 00 00 01 }
    condition:
		// MZ or ELF
		( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and all of them
}
YARA Detection Rule: MAL_Malware_Imphash_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects malware by known bad imphash or rich_pe_header_hash
Author: Arnim Rupp
Reference: https://yaraify.abuse.ch/statistics/

Pattern signatures:
$fp1 = "Win32 Cabinet Self-Extractor" wide
        $fp2 = "EXTRACTOPT" ascii fullword

Detection condition:
uint16(0) == 0x5A4D and (
            // no size limit as some samples are 20MB+ (ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247) and the hash is calculated only on the header
            pe.imphash() == "9ee34731129f4801db97fd66adbfeaa0" or
            pe.imphash() == "f9e8597c550

Full rule:
rule MAL_Malware_Imphash_Mar23_1 : HIGHVOL {
    meta:
        description = "Detects malware by known bad imphash or rich_pe_header_hash"
        reference = "https://yaraify.abuse.ch/statistics/"
        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
        author = "Arnim Rupp"
        date = "2023-03-20"
        modified = "2023-03-22"
        score = 75
        hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
        hash = "0a25a78c6b9df52e55455f5d52bcb[PII_REDACTED]cae3307b05e76ac70193b0636"
        hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
        hash = "5783bf969c36f13f4365f4cae3ec4ee5d95694ff181aba74a33f4959f1f19e8b"
        hash = "4ca925b0feec851d787e7ee42d263f4c08b0f73f496049bdb5d967728ff91073"
        hash = "9c2d2fa9c32fdff1828854e8cc39160dae73a4f90fb89b82ef6d853b63035663"
        hash = "2c53d58f30b2ee1a2a7746e20f136c34d25d[PII_REDACTED]fc67e119329d457c2a"
        hash = "5e83747015b0589b4f04b0db981794adf53274076c1b4acf717e3ff45eca0249"
        hash = "ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247"
        hash = "82fb1ba998dfee806a513f125bb64c316989c36c[PII_REDACTED]86a6b45da3b132"
        hash = "cb41d2520995abd9ba8ccd42e53d496a66da392007ea6aebd4cbc43f71ad461a"
        hash = "c7bd758506b72ee6db1cc2557baf745bf9e402127d8e49266cc91c90f3cf3ed5"
        hash = "e6e0d60f65a4ea6895ff97df340f6d90942bbfa402c01bf443ff5b4641ff849f"
        hash = "e8ddef9fa689e98ba2d48260aea3eb8fa41922ed718b7b9135df6426b3ddf126"
        hash = "ad57d77aba6f1bf82e0affe4c0ae95964be45fb3b7c2d6a0e08728e425ecd301"
        hash = "483df98eb489899bc89c6a0662ca8166c9b77af2f6bedebd17e61a69211843d9"
        hash = "a65ed85851d8751e6fe6a27ece7b3879b90866a10f272d8af46fb394b46b90a9"
        hash = "09081e04f3228d6ef2efc[PII_REDACTED]ed86026e4dfda[PII_REDACTED]1f4711565"
        hash = "1b2c9054f44f7d08cffe7e2d9127dbd96206ab2c15b63ebf[PII_REDACTED]336ae1"
        hash = "257887d1c84eb15abb2c3c
YARA Detection Rule: HKTL_Imphashes_Aug22_1
Repository: Neo23x0/signature-base
Detects: Detects different hacktools based on their imphash
Author: Florian Roth
Reference: Internal Research

Detection condition:
uint16(0) == 0x5a4d and (
            pe.imphash() == "bcca3c247b619dcd13c8cdff5f123932" or // PetitPotam
            pe.imphash() == "3a19059bd7688cb88e70005f18efc439" or // PetitPotam
            pe.imphash() == "bf6223a49e45d[PII_REDACTED]7eb6004ba" or // PetitPotam
            pe.imphash() == "0c106

Full rule:
rule HKTL_Imphashes_Aug22_1 {
   meta:
      description = "Detects different hacktools based on their imphash"
      author = "Florian Roth"
      reference = "Internal Research"
      score = 80
      date = "2022-08-17"
      modified = "2023-03-21"
      id = "e1d4dde6-16ad-5495-b3a7-01a86c830761"
   condition:
      uint16(0) == 0x5a4d and (
            pe.imphash() == "bcca3c247b619dcd13c8cdff5f123932" or // PetitPotam
            pe.imphash() == "3a19059bd7688cb88e70005f18efc439" or // PetitPotam
            pe.imphash() == "bf6223a49e45d[PII_REDACTED]7eb6004ba" or // PetitPotam
            pe.imphash() == "0c106686a31bfe2ba931ae1cf6e9dbc6" or // Mimikatz
            pe.imphash() == "0d1447d4b3259b3c2a1d4cfb7ece13c3" or // Mimikatz
            pe.imphash() == "1b0369a1e06271833f78ffa70ffb4eaf" or // Mimikatz
            pe.imphash() == "4c1b52a19748428e51b14c278d0f58e3" or // Mimikatz
            pe.imphash() == "4d927a711f77d62cebd4f322cb57ec6f" or // Mimikatz
            pe.imphash() == "66ee036df5fc1004d9ed5e9a94a1086a" or // Mimikatz
            pe.imphash() == "672b13f4a0b6f27d29065123fe882dfc" or // Mimikatz
            pe.imphash() == "6bbd59cea665c4afcc2814c1327ec91f" or // Mimikatz
            pe.imphash() == "725bb81dc24214f6ecacc0cfb36ad30d" or // Mimikatz
            pe.imphash() == "9528a0e91e28fbb88ad433feabca2456" or // Mimikatz
            pe.imphash() == "9da6d5d77be11712527dcab86df449a3" or // Mimikatz
            pe.imphash() == "a6e01bc1ab89f8d91d9eab72032aae88" or // Mimikatz
            pe.imphash() == "b24c5eddaea4fe50c6a96a2a133521e4" or // Mimikatz
            pe.imphash() == "d21bbc50dcc169d7b4d0f[PII_REDACTED]4" or // Mimikatz
            pe.imphash() == "fcc251cceae90d22c392215cc9a2d5d6" or // Mimikatz
            pe.imphash() == "23867a89c2b8fc733be6cf5ef902f2d1" or // JuicyPotato
            pe.imphash() == "a37ff327f8d48e8a4d2f757e1b6e70bc" or // JuicyPotato
            pe.imphash() == "f9a28c458284584a93b14216308d31bd" or // JuicyPotat