deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Cobaltbaltstrike_strike_Payload_XORed
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
$h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }

Detection condition:
//x86 payload
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFCE88900 or
    //x64 payload
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFC4883E4 or
    //x86 beacon
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5AE800 or
    //x64 beacon
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5A4152 or
  

Full rule:
rule Cobaltbaltstrike_strike_Payload_XORed
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"
  strings:
    $h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
  condition:
    //x86 payload
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFCE88900 or
    //x64 payload
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFC4883E4 or
    //x86 beacon
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5AE800 or
    //x64 beacon
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5A4152 or
    //NOP slide
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x90909090
}
YARA Detection Rule: Cobaltbaltstrike_Beacon_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default MZ header
    $h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
    // decoded config blob
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    // xored config blob v3
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    // xored config blob v4
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }

Detection condition:
$h01 and
    any of ($h1*)

Full rule:
rule Cobaltbaltstrike_Beacon_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"
  strings:
    // x86 default MZ header
    $h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
    // decoded config blob
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    // xored config blob v3
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    // xored config blob v4
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
  condition:
    $h01 and
    any of ($h1*)
}
YARA Detection Rule: Cobaltbaltstrike_Beacon_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default MZ header
    $h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
    // decoded config blob
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    // xored config blob v3
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    // xored config blob v4
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }

Detection condition:
$h01 and
    any of ($h1*)

Full rule:
rule Cobaltbaltstrike_Beacon_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
  strings:
    // x64 default MZ header
    $h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
    // decoded config blob
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    // xored config blob v3
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    // xored config blob v4
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
  condition:
    $h01 and
    any of ($h1*)
}
YARA Detection Rule: Cobaltbaltstrike_Beacon_XORed_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 xor decrypt loop
        // 52 bytes variant
        $h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
        // 56 bytes variant
        $h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
    // end of xor decrypt loop
        $h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }

Detection condition:
any of ($h0*) and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5AE800 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5AE8 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            

Full rule:
rule Cobaltbaltstrike_Beacon_XORed_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "d93c20e6-3e01-5132-88a0-63ace507cae9"
  strings:
    // x86 xor decrypt loop
        // 52 bytes variant
        $h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
        // 56 bytes variant
        $h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
    // end of xor decrypt loop
        $h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
  condition:
        any of ($h0*) and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5AE800 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5AE8 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
        )
}
YARA Detection Rule: Cobaltbaltstrike_Beacon_XORed_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 xor decrypt loop
    $h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
    // end of xor decrypt loop
        $h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }

Detection condition:
$h01 and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5A4152 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5A41 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            uint32be(

Full rule:
rule Cobaltbaltstrike_Beacon_XORed_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "15be610a-7552-5473-8da2[PII_REDACTED]83"
  strings:
        // x64 xor decrypt loop
    $h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
    // end of xor decrypt loop
        $h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
  condition:
        $h01 and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5A4152 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5A41 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
        )
}
YARA Detection Rule: APT_Lazarus_Aug18_Downloader_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group Malware Downloadery
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/operation-applejeus/87553/

Pattern signatures:
$x1 = "H:\\DEV\\TManager\\" ascii
      $x2 = "\\Release\\dloader.pdb" ascii
      $x3 = "Z:\\jeus\\"
      $x4 = "\\Debug\\dloader.pdb" ascii
      $x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii

      $s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
      $s2 = "Error protecting memory page" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         ( 1 of ($x*) or 2 of them )
      )

Full rule:
rule APT_Lazarus_Aug18_Downloader_1 {
   meta:
      description = "Detects Lazarus Group Malware Downloadery"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/operation-applejeus/87553/"
      date = "2018-08-24"
      hash1 = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
      hash2 = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
      hash3 = "e2199fc4e4b31f7e4c61f6d[PII_REDACTED]ed6ad787718ed7c39b36f316f38befd"
      id = "f536db7b-b645-522f-b[PII_REDACTED]d2e31"
   strings:
      $x1 = "H:\\DEV\\TManager\\" ascii
      $x2 = "\\Release\\dloader.pdb" ascii
      $x3 = "Z:\\jeus\\"
      $x4 = "\\Debug\\dloader.pdb" ascii
      $x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii

      $s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
      $s2 = "Error protecting memory page" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         ( 1 of ($x*) or 2 of them )
      )
}
YARA Detection Rule: APT_Lazarus_Aug18_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group Malware
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/operation-applejeus/87553/

Pattern signatures:
$s1 = "mws2_32.dll" fullword wide
      $s2 = "%s.bat" fullword wide
      $s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
      $s4 = "Microsoft Corporation. All rights reserved." fullword wide
      $s5 = "ping 127.0.0.1 -n 3" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "3af996e4f960108533e69b9033503f40" or
         4 of them
      )

Full rule:
rule APT_Lazarus_Aug18_1 {
   meta:
      description = "Detects Lazarus Group Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/operation-applejeus/87553/"
      date = "2018-08-24"
      hash1 = "ef400d73c6920ac811af401259e376458b498eb[PII_REDACTED]136747dfc3dcfa8"
      hash2 = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
      id = "fda4970a-2787-5e9c-9944-a6222145f4a7"
   strings:
      $s1 = "mws2_32.dll" fullword wide
      $s2 = "%s.bat" fullword wide
      $s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
      $s4 = "Microsoft Corporation. All rights reserved." fullword wide
      $s5 = "ping 127.0.0.1 -n 3" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "3af996e4f960108533e69b9033503f40" or
         4 of them
      )
}
YARA Detection Rule: APT_Lazarus_Aug18_2
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group Malware
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/operation-applejeus/87553/

Pattern signatures:
$s1 = "vAdvapi32.dll" fullword wide
      $s2 = "lws2_32.dll" fullword wide
      $s3 = "%s %s > \"%s\" 2>&1" fullword wide
      $s4 = "Not Service" fullword wide
      $s5 = "ping 127.0.0.1 -n 3" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
         4 of them
      )

Full rule:
rule APT_Lazarus_Aug18_2 {
   meta:
      description = "Detects Lazarus Group Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/operation-applejeus/87553/"
      date = "2018-08-24"
      hash1 = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
      hash2 = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
      id = "3c77d603-6443-5e78-8a8a-a89112619aa6"
   strings:
      $s1 = "vAdvapi32.dll" fullword wide
      $s2 = "lws2_32.dll" fullword wide
      $s3 = "%s %s > \"%s\" 2>&1" fullword wide
      $s4 = "Not Service" fullword wide
      $s5 = "ping 127.0.0.1 -n 3" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
         4 of them
      )
}
YARA Detection Rule: APT_FallChill_RC4_Keys
Repository: Neo23x0/signature-base
Detects: Detects FallChill RC4 keys
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/operation-applejeus/87553/

Pattern signatures:
/* MOV POS 4BYTE-OF-KEY */
      $cod0 = { c7 ?? ?? da e1 61 ff
                c7 ?? ?? 0c 27 95 87
                c7 ?? ?? 17 57 a4 d6
                c7 ?? ?? ea e3 82 2b }

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule APT_FallChill_RC4_Keys {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "Detects FallChill RC4 keys"
      reference = "https://securelist.com/operation-applejeus/87553/"
      date = "2018-08-21"
      id = "ead7d84c-91aa-58b0-af3b-1211b0bde864"
   strings:
      /* MOV POS 4BYTE-OF-KEY */
      $cod0 = { c7 ?? ?? da e1 61 ff
                c7 ?? ?? 0c 27 95 87
                c7 ?? ?? 17 57 a4 d6
                c7 ?? ?? ea e3 82 2b }
   condition:
      uint16(0) == 0x5a4d and 1 of them
}
YARA Detection Rule: LOG_EXPL_Ivanti_EPMM_MobileIron_Core_CVE_2023_35078_Jul23_1
Repository: Neo23x0/signature-base
Detects: Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078
Author: Florian Roth
Reference: Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance

Pattern signatures:
$xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /

Detection condition:
$xr1

Full rule:
rule LOG_EXPL_Ivanti_EPMM_MobileIron_Core_CVE_2023_35078_Jul23_1 {
   meta:
      description = "Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078"
      author = "Florian Roth"
      reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
      date = "2023-07-25"
      score = 75
      id = "44cca0b5-3851-5786-82fd-ce3ccb566453"
   strings:
      $xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /
   condition:
      $xr1
}
YARA Detection Rule: MAL_WAR_Ivanti_EPMM_MobileIron_Mi_War_Aug23
Repository: Neo23x0/signature-base
Detects: Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078
Author: Florian Roth
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

Pattern signatures:
$s1 = "logsPaths.txt" ascii fullword
      $s2 = "keywords.txtFirefox" ascii

Detection condition:
uint16(0) == 0x4b50 and
      filesize < 20KB and
      all of them

Full rule:
rule MAL_WAR_Ivanti_EPMM_MobileIron_Mi_War_Aug23 {
   meta:
      description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
      author = "Florian Roth"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
      date = "2023-08-01"
      score = 85
      hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c[PII_REDACTED]2dcc05819251a127"
      id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"
   strings:
      $s1 = "logsPaths.txt" ascii fullword
      $s2 = "keywords.txtFirefox" ascii
   condition:
      uint16(0) == 0x4b50 and
      filesize < 20KB and
      all of them
}
YARA Detection Rule: MAL_WAR_Ivanti_EPMM_MobileIron_LogClear_JAVA_Aug23
Repository: Neo23x0/signature-base
Detects: Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078
Author: Florian Roth
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

Pattern signatures:
$s1 = "logsPaths.txt" ascii fullword
      $s2 = "log file: %s, not read" ascii fullword
      $s3 = "/tmp/.time.tmp" ascii fullword
      $s4 = "readKeywords" ascii fullword
      $s5 = "\"----------------  ----------------" ascii fullword

Detection condition:
uint16(0) == 0xfeca and
      filesize < 20KB and
      4 of them or all of them

Full rule:
rule MAL_WAR_Ivanti_EPMM_MobileIron_LogClear_JAVA_Aug23 {
   meta:
      description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
      author = "Florian Roth"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
      date = "2023-08-01"
      score = 80
      hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
      id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"
   strings:
      $s1 = "logsPaths.txt" ascii fullword
      $s2 = "log file: %s, not read" ascii fullword
      $s3 = "/tmp/.time.tmp" ascii fullword
      $s4 = "readKeywords" ascii fullword
      $s5 = "\"----------------  ----------------" ascii fullword
   condition:
      uint16(0) == 0xfeca and
      filesize < 20KB and
      4 of them or all of them
}
YARA Detection Rule: Invoke_SMBExec
Repository: Neo23x0/signature-base
Detects: Detects Invoke-WmiExec or Invoke-SmbExec
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Kevin-Robertson/Invoke-TheHash

Pattern signatures:
$x1 = "Invoke-SMBExec -Target" fullword ascii
      $x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii

      $s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
      $s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
      $s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii

Detection condition:
( filesize < 400KB and 1 of them )

Full rule:
rule Invoke_SMBExec {
   meta:
      description = "Detects Invoke-WmiExec or Invoke-SmbExec"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
      date = "2017-06-14"
      hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
      id = "07c742f4-3039-5c84-81d4-73ad25b98681"
   strings:
      $x1 = "Invoke-SMBExec -Target" fullword ascii
      $x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii

      $s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
      $s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
      $s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii
   condition:
      ( filesize < 400KB and 1 of them )
}
YARA Detection Rule: Invoke_WMIExec_Gen_1
Repository: Neo23x0/signature-base
Detects: Detects Invoke-WmiExec or Invoke-SmbExec
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Kevin-Robertson/Invoke-TheHash

Pattern signatures:
$x1 = "Invoke-WMIExec " ascii
      $x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
      $s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
      $s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
      $s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
      $x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii

Detection condition:
1 of them

Full rule:
rule Invoke_WMIExec_Gen_1 {
   meta:
      description = "Detects Invoke-WmiExec or Invoke-SmbExec"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
      date = "2017-06-14"
      hash1 = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
      hash2 = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
      id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
   strings:
      $x1 = "Invoke-WMIExec " ascii
      $x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
      $s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
      $s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
      $s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
      $x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii
   condition:
      1 of them
}
YARA Detection Rule: Invoke_SMBExec_Invoke_WMIExec_1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Kevin-Robertson/Invoke-TheHash

Pattern signatures:
$s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
      $s2 = "Write-Output \"$Target did not respond\"" fullword ascii
      $s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii

Detection condition:
all of them

Full rule:
rule Invoke_SMBExec_Invoke_WMIExec_1 {
   meta:
      description = "Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
      date = "2017-06-14"
      super_rule = 1
      hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
      hash2 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
      id = "fd1c6599-028d-5535-beb8-5b2658481b97"
   strings:
      $s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
      $s2 = "Write-Output \"$Target did not respond\"" fullword ascii
      $s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii
   condition:
      all of them
}