deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Methodology_Suspicious_Shortcut_SMB_URL
Repository: Neo23x0/signature-base
Detects: Detects remote SMB path for .URL persistence
Author: @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$file = /URL=file:\/\/[a-z0-9]/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$file and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_SMB_URL
{
  meta:
    author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
    description = "Detects remote SMB path for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    sample = "e0bef7497fcb284edb0c65b59d511830"
    score = 50
    date = "27.09.2019"
    id = "e23609a1-9b18-5a56-92ee-c7f84c966865"
  strings:
    $file = /URL=file:\/\/[a-z0-9]/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $file and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_IconRemote_HTTP
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$icon = /IconFile\s*=\s*http/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_IconRemote_HTTP
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 40
    date = "27.09.2019"
  strings:
    $icon = /IconFile\s*=\s*http/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_IconRemote_SMBorLocal
Repository: Neo23x0/signature-base
Detects: This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]48588032

Pattern signatures:
$icon = "IconFile=file://" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_IconRemote_SMBorLocal
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html"
    reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]48588032"
    score = 50
    date = "27.09.2019"
    id = "9362ce46-265c-5215-bee1-3d784d0cb928"
  strings:
    $icon = "IconFile=file://" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Shortcut_HotKey
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$hotkey and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Shortcut_HotKey
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "0ce377c4-db9b-59fa-987b-a77eaf408765"
  strings:
    $hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $hotkey and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_BaseURLSyntax
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$baseurl1 = "BASEURL=file://" nocase
    $baseurl2 = "[DEFAULT]" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
all of ($baseurl*) and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_BaseURLSyntax
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "cab7b573-d197-5afc-95a9-ef05a07c2b7a"
  strings:
    $baseurl1 = "BASEURL=file://" nocase
    $baseurl2 = "[DEFAULT]" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    all of ($baseurl*) and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Contains_Shortcut_OtherURIhandlers
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$file = "URL="
    $filenegate = /[\x0a\x0d](Base|)URL\s*=\s*(https?|file):\/\// nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$file and any of ($url*) and not $filenegate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Contains_Shortcut_OtherURIhandlers
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Noisy rule for .URL shortcuts containing unique URI handlers"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 35
    date = "27.09.2019"
    id = "1c0750d2-2177-5e2c-908b-4226ae099981"
  strings:
    $file = "URL="
    $filenegate = /[\x0a\x0d](Base|)URL\s*=\s*(https?|file):\/\// nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $file and any of ($url*) and not $filenegate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_IconShenanigans_dotDL
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$icon = /[\x0a\x0d]IconFile=[^\x0d]*\.dl\x0d/ nocase ascii wide
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($url*) and $icon
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_IconShenanigans_dotDL
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]96696577"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
  strings:
    $icon = /[\x0a\x0d]IconFile=[^\x0d]*\.dl\x0d/ nocase ascii wide
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($url*) and $icon
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]96696577

Pattern signatures:
$icon = "IconFile="
    $icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($url*) and $icon and not $icon_negate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]96696577"
    description = "Detects possible shortcut usage for .URL persistence"
    score = 50
    date = "27.09.2019"
    id = "82d0483f-48ee-5d0c-ba7d-73d9e9455423"
  strings:
    $icon = "IconFile="
    $icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($url*) and $icon and not $icon_negate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_Evasion
Repository: Neo23x0/signature-base
Detects: Non-standard .URLs and evasion
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/DissectMalware/status/[PII_REDACTED]56634368

Pattern signatures:
$URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
    $filetype_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $filetype_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($filetype*) and $URI //and $URInegate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_Evasion
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Non-standard .URLs and evasion"
    reference = "https://twitter.com/DissectMalware/status/[PII_REDACTED]56634368"
    score = 50
    date = "27.09.2019"
    id = "36df4252-2575-5efa-88ce-17e68a349306"
  strings:
    $URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
    $filetype_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $filetype_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($filetype*) and $URI //and $URInegate
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_LOLcommand
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]69576704

Pattern signatures:
$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_LOLcommand
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]69576704"
    description = "Detects possible shortcut usage for .URL persistence"
    score = 50
    date = "27.09.2019"
    modified = "2021-02-14"
    id = "061e7919-17f1-5774-ad7d-fc964dc9a947"
  strings:
    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_WebDAV
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]54282497

Pattern signatures:
$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_WebDAV
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]54282497"
    description = "Detects possible shortcut usage for .URL persistence"
    score = 50
    date = "27.09.2019"
    id = "cd660b84-d7c6-52fc-9e1d-76450e5262b1"
  strings:
    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_ScriptURL
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
//    $file2 = /IconFile=script:/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_ScriptURL
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "2f55f8a9-4e4b-5480-9042-da6bb66b2e06"
  strings:
    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
//    $file2 = /IconFile=script:/ nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    any of ($url*) and any of ($file*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_WorkingDirRemote_HTTP
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$icon = "WorkingDirectory=http" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_WorkingDirRemote_HTTP
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "68e54f8a-11e4-59e4-8498-59d88e70e438"
  strings:
    $icon = "WorkingDirectory=http" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: Methodology_Suspicious_Shortcut_WorkingDirRemote_SMB
Repository: Neo23x0/signature-base
Detects: Detects possible shortcut usage for .URL persistence
Author: @itsreallynick (Nick Carr)
Reference: https://twitter.com/cglyer/status/[PII_REDACTED]48919044

Pattern signatures:
$icon = "WorkingDirectory=file://" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase

Detection condition:
$icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB

Full rule:
rule Methodology_Suspicious_Shortcut_WorkingDirRemote_SMB
{
  meta:
    author = "@itsreallynick (Nick Carr)"
    description = "Detects possible shortcut usage for .URL persistence"
    reference = "https://twitter.com/cglyer/status/[PII_REDACTED]48919044"
    score = 50
    date = "27.09.2019"
    id = "26e19fe3-c25c-53b0-9b41-c04803134bc2"
  strings:
    $icon = "WorkingDirectory=file://" nocase
    $url_clsid = "[{000214A0-0000-0000-C[PII_REDACTED]00046}]"
    $url_explicit = "[InternetShortcut]" nocase
  condition:
    $icon and any of ($url*)
    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
    and filesize < 30KB
}
YARA Detection Rule: CoreImpact_sysdll_exe
Repository: Neo23x0/signature-base
Detects: Detects a malware sysdll.exe from the Rocket Kitten APT
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii

      $s1 = "Mozilla/5.0" fullword ascii
      $s3 = "index.php?c=%s&r=%lx" fullword ascii
      $s4 = "index.php?c=%s&r=%x" fullword ascii
      $s5 = "127.0.0.1" fullword ascii
      $s6 = "/info.dat" ascii
      $s7 = "needroot" fullword ascii
      $s8 = "./plugins/" ascii

Detection condition:
$s0 or 6 of them

Full rule:
rule CoreImpact_sysdll_exe {
   meta:
      description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      date = "27.12.2014"
      modified = "2023-01-06"
      hash = "f89a4d4ae5cca6d69a5256c96111e707"
      id = "bac55c00-5d14-59ca-8597-f52b4577be0c"
   strings:
      $s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii

      $s1 = "Mozilla/5.0" fullword ascii
      $s3 = "index.php?c=%s&r=%lx" fullword ascii
      $s4 = "index.php?c=%s&r=%x" fullword ascii
      $s5 = "127.0.0.1" fullword ascii
      $s6 = "/info.dat" ascii
      $s7 = "needroot" fullword ascii
      $s8 = "./plugins/" ascii
   condition:
      $s0 or 6 of them
}
YARA Detection Rule: Saudi_Phish_Trojan
Repository: Neo23x0/signature-base
Detects: Detects a trojan used in Saudi Aramco Phishing
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Z3JUAA

Pattern signatures:
$s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
               65 00 78 00 65 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )

Full rule:
rule Saudi_Phish_Trojan {
   meta:
      description = "Detects a trojan used in Saudi Aramco Phishing"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Z3JUAA"
      date = "2017-10-12"
      hash1 = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
      id = "d805391d-1256-5dac-8585-ccf3391d4e91"
   strings:
      $s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
               65 00 78 00 65 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )
}