deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: sig_238_fscan
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file fscan.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
      $s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
      $s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
      $s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
      $s12 = "Failed to open the IP list file \"%s\"" fullword ascii
      $s13 = "http://www.foundstone.com" fullword ascii
      $s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
      $s18 = "Bind port number out of range. Using system default." fullword ascii
      $s19 = "fscan.exe" fullword wide

Detection condition:
4 of them

Full rule:
rule sig_238_fscan {
   meta:
      description = "Disclosed hacktool set (old stuff) - file fscan.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
      id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"
   strings:
      $s0 = "FScan v1.12 - Command line port scanner." fullword ascii
      $s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
      $s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
      $s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
      $s12 = "Failed to open the IP list file \"%s\"" fullword ascii
      $s13 = "http://www.foundstone.com" fullword ascii
      $s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
      $s18 = "Bind port number out of range. Using system default." fullword ascii
      $s19 = "fscan.exe" fullword wide
   condition:
      4 of them
}
YARA Detection Rule: _iissample_nesscan_twwwscan
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Connecting HTTP Port - Result: " fullword
      $s1 = "No space for command line argument vector" fullword
      $s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
      $s5 = "No space for copy of command line" fullword
      $s7 = "-  Windows NT,2000 Patch Method  - " fullword
      $s8 = "scanf : floating point formats not linked" fullword
      $s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
      $s13 = "!\"what?\"" fullword
      $s14 = "%s Port %d Closed" fullword
      $s16 = "printf : floating point formats not linked" fullword
      $s17 = "xxtype.cpp" fullword

Detection condition:
all of them

Full rule:
rule _iissample_nesscan_twwwscan {
   meta:
      description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      super_rule = 1
      hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
      hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
      hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
      id = "a710ca8e-54dc-5a98-b173-c87b22af745f"
   strings:
      $s0 = "Connecting HTTP Port - Result: " fullword
      $s1 = "No space for command line argument vector" fullword
      $s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
      $s5 = "No space for copy of command line" fullword
      $s7 = "-  Windows NT,2000 Patch Method  - " fullword
      $s8 = "scanf : floating point formats not linked" fullword
      $s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
      $s13 = "!\"what?\"" fullword
      $s14 = "%s Port %d Closed" fullword
      $s16 = "printf : floating point formats not linked" fullword
      $s17 = "xxtype.cpp" fullword
   condition:
      all of them
}
YARA Detection Rule: _FsHttp_FsPop_FsSniffer
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
      $s1 = "-ERR Get SMS Users ID Failed" fullword
      $s2 = "Control Time Out 90 Secs, Connection Closed" fullword
      $s3 = "-ERR Post SMS Failed" fullword
      $s4 = "Current.hlt" fullword
      $s6 = "Histroy.hlt" fullword
      $s7 = "-ERR Send SMS Failed" fullword
      $s12 = "-ERR Change Password <New Password>" fullword
      $s17 = "+OK Send SMS Succussifully" fullword
      $s18 = "+OK Set New Password: [%s]" fullword
      $s19 = "CHANGE PASSWORD" fullword

Detection condition:
all of them

Full rule:
rule _FsHttp_FsPop_FsSniffer {
   meta:
      description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      super_rule = 1
      hash0 = "9d4e7611a328eb430a8bb6dc[PII_REDACTED]926f5f"
      hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
      hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
      id = "5ca543af-2589-52b0-83f9-ad25ba76b633"
   strings:
      $s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
      $s1 = "-ERR Get SMS Users ID Failed" fullword
      $s2 = "Control Time Out 90 Secs, Connection Closed" fullword
      $s3 = "-ERR Post SMS Failed" fullword
      $s4 = "Current.hlt" fullword
      $s6 = "Histroy.hlt" fullword
      $s7 = "-ERR Send SMS Failed" fullword
      $s12 = "-ERR Change Password <New Password>" fullword
      $s17 = "+OK Send SMS Succussifully" fullword
      $s18 = "+OK Set New Password: [%s]" fullword
      $s19 = "CHANGE PASSWORD" fullword
   condition:
      all of them
}
YARA Detection Rule: Ammyy_Admin_AA_v3
Repository: Neo23x0/signature-base
Detects: Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/gkAg2E

Pattern signatures:
$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
      $x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
      $x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
      $x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
      $x5 = "Please enter password for accessing remote computer" fullword ascii

      $s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
      $s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
      $s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
      $s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii

Detection condition:
2 of ($x*) or all of ($s*)

Full rule:
rule Ammyy_Admin_AA_v3 {
   meta:
      description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/gkAg2E"
      date = "2014/12/22"
      score = 55
      hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
      hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
      id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"
   strings:
      $x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
      $x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
      $x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
      $x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
      $x5 = "Please enter password for accessing remote computer" fullword ascii

      $s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
      $s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
      $s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
      $s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
   condition:
      2 of ($x*) or all of ($s*)
}
YARA Detection Rule: LinuxHacktool_eyes_scanssh
Repository: Neo23x0/signature-base
Detects: Linux hack tools - file scanssh
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "Connection closed by remote host" fullword ascii
      $s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
      $s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
      $s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
      $s5 = "Server closed connection" fullword ascii
      $s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
      $s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
      $s9 = "Remote host closed connection" fullword ascii
      $s10 = "%s: line %d: bad command `%s'" fullword ascii
      $s13 = "verifying that server is a known host : file %s not found" fullword ascii
      $s14 = "%s: line %d: expected service, found `%s'" fullword ascii
      $s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
      $s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii

Detection condition:
all of them

Full rule:
rule LinuxHacktool_eyes_scanssh {
   meta:
      description = "Linux hack tools - file scanssh"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2015/01/19"
      hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
      id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"
   strings:
      $s0 = "Connection closed by remote host" fullword ascii
      $s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
      $s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
      $s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
      $s5 = "Server closed connection" fullword ascii
      $s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
      $s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
      $s9 = "Remote host closed connection" fullword ascii
      $s10 = "%s: line %d: bad command `%s'" fullword ascii
      $s13 = "verifying that server is a known host : file %s not found" fullword ascii
      $s14 = "%s: line %d: expected service, found `%s'" fullword ascii
      $s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
      $s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: LinuxHacktool_eyes_pscan2
Repository: Neo23x0/signature-base
Detects: Linux hack tools - file pscan2
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
      $s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
      $s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
      $s8 = "Invalid IP." fullword ascii
      $s9 = "# scanning: " fullword ascii
      $s10 = "Unable to allocate socket." fullword ascii

Detection condition:
2 of them

Full rule:
rule LinuxHacktool_eyes_pscan2 {
   meta:
      description = "Linux hack tools - file pscan2"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2015/01/19"
      hash = "56b476cba702a4423a2d805a412cae8ef4330905"
      id = "02d96766-6696-5410-ad48-bd8cb642ac51"
   strings:
      $s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
      $s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
      $s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
      $s8 = "Invalid IP." fullword ascii
      $s9 = "# scanning: " fullword ascii
      $s10 = "Unable to allocate socket." fullword ascii
   condition:
      2 of them
}
YARA Detection Rule: LinuxHacktool_eyes_a
Repository: Neo23x0/signature-base
Detects: Linux hack tools - file a
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
      $s1 = "mv scan.log bios.txt" fullword ascii
      $s2 = "rm -rf bios.txt" fullword ascii
      $s3 = "echo -e \"# by Eyes.\"" fullword ascii
      $s4 = "././pscan2 $1 22" fullword ascii
      $s10 = "echo \"#cautam...\"" fullword ascii

Detection condition:
2 of them

Full rule:
rule LinuxHacktool_eyes_a {
   meta:
      description = "Linux hack tools - file a"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2015/01/19"
      hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
      id = "2b4f52d4-b438-5040-89c5-aab1df15200e"
   strings:
      $s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
      $s1 = "mv scan.log bios.txt" fullword ascii
      $s2 = "rm -rf bios.txt" fullword ascii
      $s3 = "echo -e \"# by Eyes.\"" fullword ascii
      $s4 = "././pscan2 $1 22" fullword ascii
      $s10 = "echo \"#cautam...\"" fullword ascii
   condition:
      2 of them
}
YARA Detection Rule: LinuxHacktool_eyes_mass
Repository: Neo23x0/signature-base
Detects: Linux hack tools - file mass
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
      $s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
      $s3 = "killall -9 pscan2" fullword ascii
      $s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
      $s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii

Detection condition:
1 of them

Full rule:
rule LinuxHacktool_eyes_mass {
   meta:
      description = "Linux hack tools - file mass"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2015/01/19"
      hash = "2054cb427daaca9e267b252307dad03830475f15"
      id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"
   strings:
      $s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
      $s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
      $s3 = "killall -9 pscan2" fullword ascii
      $s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
      $s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: LinuxHacktool_eyes_pscan2_2
Repository: Neo23x0/signature-base
Detects: Linux hack tools - file pscan2.c
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
      $s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
      $s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
      $s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
      $s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii

Detection condition:
2 of them

Full rule:
rule LinuxHacktool_eyes_pscan2_2 {
   meta:
      description = "Linux hack tools - file pscan2.c"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "not set"
      date = "2015/01/19"
      hash = "eb024dfb441471af[PII_REDACTED]c34d105efa5fd8"
      id = "3950b235-70bc-5afd-add5-38c50055b28b"
   strings:
      $s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
      $s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
      $s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
      $s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
      $s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
   condition:
      2 of them
}
YARA Detection Rule: CN_Portscan
Repository: Neo23x0/signature-base
Detects: CN Port Scanner
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "TCP 12.12.12.12"

Detection condition:
uint16(0) == 0x5A4D and $s2

Full rule:
rule CN_Portscan: APT {
   meta:
      description = "CN Port Scanner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2013-11-29"
      confidential = false
      score = 70
      id = "fb52a89a-2270-5170-9874-9278a0177454"
   strings:
      $s2 = "TCP 12.12.12.12"
   condition:
      uint16(0) == 0x5A4D and $s2
}
YARA Detection Rule: WMI_vbs
Repository: Neo23x0/signature-base
Detects: WMI Tool - APT
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"

Detection condition:
all of them

Full rule:
rule WMI_vbs: APT {
   meta:
      description = "WMI Tool - APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2013-11-29"
      confidential = false
      score = 70
      id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"
   strings:
      $s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
   condition:
      all of them
}
YARA Detection Rule: CN_Toolset__XScanLib_XScanLib_XScanLib
Repository: Neo23x0/signature-base
Detects: Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll
Author: Florian Roth (Nextron Systems)
Reference: http://qiannao.com/ls/905300366/33834c0c/

Pattern signatures:
$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
      $s2 = "PlugGetUdpPort" fullword
      $s3 = "XScanLib.dll" fullword
      $s4 = "PlugGetTcpPort" fullword
      $s11 = "PlugGetVulnNum" fullword

Detection condition:
all of them

Full rule:
rule CN_Toolset__XScanLib_XScanLib_XScanLib {
   meta:
      description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://qiannao.com/ls/905300366/33834c0c/"
      date = "2015/03/30"
      score = 70
      super_rule = 1
      hash0 = "af419603ac28257134e[PII_REDACTED]6ab3d600ed2"
      hash1 = "c5cb4f75cf241f5a9aea[PII_REDACTED]33a42a13b0"
      hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
      id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"
   strings:
      $s1 = "Plug-in thread causes an exception, failed to alert user." fullword
      $s2 = "PlugGetUdpPort" fullword
      $s3 = "XScanLib.dll" fullword
      $s4 = "PlugGetTcpPort" fullword
      $s11 = "PlugGetVulnNum" fullword
   condition:
      all of them
}
YARA Detection Rule: CN_Toolset_NTscan_PipeCmd
Repository: Neo23x0/signature-base
Detects: Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe
Author: Florian Roth (Nextron Systems)
Reference: http://qiannao.com/ls/905300366/33834c0c/

Pattern signatures:
$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
      $s3 = "PipeCmd.exe" fullword wide
      $s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
      $s5 = "%s\\pipe\\%s%s%d" fullword ascii
      $s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
      $s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
      $s9 = "PipeCmdSrv.exe" fullword ascii
      $s10 = "This is a service executable! Couldn't start directly." fullword ascii
      $s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
      $s14 = "PIPECMDSRV" fullword wide
      $s15 = "PipeCmd Service" fullword ascii

Detection condition:
4 of them

Full rule:
rule CN_Toolset_NTscan_PipeCmd {
   meta:
      description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://qiannao.com/ls/905300366/33834c0c/"
      date = "2015/03/30"
      score = 70
      hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
      id = "056ee42d-23f4-5b03-b240-392bc92b90b0"
   strings:
      $s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
      $s3 = "PipeCmd.exe" fullword wide
      $s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
      $s5 = "%s\\pipe\\%s%s%d" fullword ascii
      $s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
      $s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
      $s9 = "PipeCmdSrv.exe" fullword ascii
      $s10 = "This is a service executable! Couldn't start directly." fullword ascii
      $s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
      $s14 = "PIPECMDSRV" fullword wide
      $s15 = "PipeCmd Service" fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: CN_Toolset_LScanPortss_2
Repository: Neo23x0/signature-base
Detects: Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe
Author: Florian Roth (Nextron Systems)
Reference: http://qiannao.com/ls/905300366/33834c0c/

Pattern signatures:
$s1 = "LScanPort.EXE" fullword wide
      $s3 = "www.honker8.com" fullword wide
      $s4 = "DefaultPort.lst" fullword ascii
      $s5 = "Scan over.Used %dms!" fullword ascii
      $s6 = "www.hf110.com" fullword wide
      $s15 = "LScanPort Microsoft " fullword wide
      $s18 = "L-ScanPort2.0 CooFly" fullword wide

Detection condition:
4 of them

Full rule:
rule CN_Toolset_LScanPortss_2 {
   meta:
      description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://qiannao.com/ls/905300366/33834c0c/"
      date = "2015/03/30"
      score = 70
      hash = "4631ec[PII_REDACTED]2d83d49fbc14105e230631a0"
      id = "0a796585-5fc8-5b55-acfc-3fe87308b681"
   strings:
      $s1 = "LScanPort.EXE" fullword wide
      $s3 = "www.honker8.com" fullword wide
      $s4 = "DefaultPort.lst" fullword ascii
      $s5 = "Scan over.Used %dms!" fullword ascii
      $s6 = "www.hf110.com" fullword wide
      $s15 = "LScanPort Microsoft " fullword wide
      $s18 = "L-ScanPort2.0 CooFly" fullword wide
   condition:
      4 of them
}