deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_ASPX_ProxyShell_Aug21_1
Repository: Neo23x0/signature-base
Detects: Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and extension
Author: Florian Roth (Nextron Systems)
Reference: https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/

Detection condition:
uint32(0) == 0x4e444221  /* PST header: !BDN */
      and extension == ".aspx"

Full rule:
rule WEBSHELL_ASPX_ProxyShell_Aug21_1 {
   meta:
      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and extension"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
      date = "2021-08-13"
      id = "8f01cbda-b1cf-5556-9f6a-e709df6dadb2"
   condition:
      uint32(0) == 0x4e444221  /* PST header: !BDN */
      and extension == ".aspx"
}
YARA Detection Rule: Dubnium_Sample_1
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule Dubnium_Sample_1 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		id = "377ecbaa-9324-562e-a973-0276d44f3feb"
	strings:
		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_2
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$x1 = ":*:::D:\\:c:~:" fullword ascii
		$s2 = "SPMUVR" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Dubnium_Sample_2 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		id = "894dc893-25fc-5fdc-9f69-8085b94e1af1"
	strings:
		$x1 = ":*:::D:\\:c:~:" fullword ascii
		$s2 = "SPMUVR" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: Dubnium_Sample_3
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
		$x2 = "del /f \"%s\" " fullword ascii
		$s1 = "del /f /ah \"%s\" " fullword ascii
		$s2 = "if exist \"%s\" goto Rept " fullword ascii
		$s3 = "\\*.*.lnk" ascii
		$s4 = "Dropped" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them

Full rule:
rule Dubnium_Sample_3 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
		id = "66f66139-88df-5ba9-a3fc-ba4fc98ce3f9"
	strings:
		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
		$x2 = "del /f \"%s\" " fullword ascii
		$s1 = "del /f /ah \"%s\" " fullword ascii
		$s2 = "if exist \"%s\" goto Rept " fullword ascii
		$s3 = "\\*.*.lnk" ascii
		$s4 = "Dropped" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
}
YARA Detection Rule: Dubnium_Sample_5
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_5 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		hash7 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "09c1aeee-9437-54e9-967f-3c2fcc0736ed"
	strings:
		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_6
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 4000KB and all of them

Full rule:
rule Dubnium_Sample_6 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		id = "43366f1a-784d-515e-a8e9-3e924f2abfd8"
	strings:
		$s1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_7
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_7 {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash6 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "6712bd5f-6bbc-5ca0-9fc7-b2013b8f8147"
	strings:
		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_SSHOpenSSL
Repository: Neo23x0/signature-base
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "sshkeypairgen.exe" fullword wide
		$s2 = "OpenSSL: FATAL" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_SSHOpenSSL {
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash5 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "d4f2b494-47b6-5b8e-b358-30159dfb977b"
	strings:
		$s1 = "sshkeypairgen.exe" fullword wide
		$s2 = "OpenSSL: FATAL" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Neuron_common_strings
Repository: Neo23x0/signature-base
Detects: Rule for detection of Neuron based on commonly used strings
Author: NCSC UK
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$strServiceName = "MSExchangeService" ascii
        $strReqParameter_1 = "cadataKey" wide
        /* $strReqParameter_2 = "cid" wide */ /* disabled due to performance reasons */
        $strReqParameter_3 = "cadata" wide
        $strReqParameter_4 = "cadataSig" wide
        $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
        $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
        $strIdentifier = "MSXEWS" wide
        $strListenEndpoint = "443/ews/exchange/" wide
        $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
        $strName = "neuron_service" ascii
        $dotnetMagic = "BSJB" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)

Full rule:
rule Neuron_common_strings {
    meta:
        description = "Rule for detection of Neuron based on commonly used strings"
        author = "NCSC UK"
        hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
        date = "2017/11/23"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "168214d4-7436-531e-9c1f-48ca22215a1b"
    strings:
        $strServiceName = "MSExchangeService" ascii
        $strReqParameter_1 = "cadataKey" wide
        /* $strReqParameter_2 = "cid" wide */ /* disabled due to performance reasons */
        $strReqParameter_3 = "cadata" wide
        $strReqParameter_4 = "cadataSig" wide
        $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
        $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
        $strIdentifier = "MSXEWS" wide
        $strListenEndpoint = "443/ews/exchange/" wide
        $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
        $strName = "neuron_service" ascii
        $dotnetMagic = "BSJB" ascii
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)
}
YARA Detection Rule: Neuron_standalone_signature
Repository: Neo23x0/signature-base
Detects: Rule for detection of Neuron based on a standalone signature from .NET metadata
Author: NCSC UK
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$a = { eb073d[PII_REDACTED]4080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281 }
        $dotnetMagic = "BSJB" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them

Full rule:
rule Neuron_standalone_signature {
    meta:
        description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
        author = "NCSC UK"
        hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
        date = "2017/11/23"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"
    strings:
        $a = { eb073d[PII_REDACTED]4080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281 }
        $dotnetMagic = "BSJB" ascii
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}
YARA Detection Rule: Nautilus_modified_rc4_loop
Repository: Neo23x0/signature-base
Detects: Rule for detection of Nautilus based on assembly code for a modified RC4 loop
Author: NCSC UK
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a

Full rule:
rule Nautilus_modified_rc4_loop {
    meta:
        description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
        author = "NCSC UK"
        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
        date = "2017/11/23"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"
    strings:
        $a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a
}
YARA Detection Rule: Nautilus_rc4_key
Repository: Neo23x0/signature-base
Detects: Rule for detection of Nautilus based on a hardcoded RC4 key
Author: NCSC UK
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key

Full rule:
rule Nautilus_rc4_key {
    meta:
        description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
        author = "NCSC UK"
        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
        date = "2017/11/23"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"
    strings:
        $key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key
}
YARA Detection Rule: Nautilus_common_strings
Repository: Neo23x0/signature-base
Detects: Rule for detection of Nautilus based on common plaintext strings
Author: NCSC UK
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$ = "nautilus-service.dll" ascii
        $ = "oxygen.dll" ascii
        $ = "config_listen.system" ascii
        $ = "ctx.system" ascii
        $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
        $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x[PII_REDACTED]000001.db" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them

Full rule:
rule Nautilus_common_strings {
    meta:
        description = "Rule for detection of Nautilus based on common plaintext strings"
        author = "NCSC UK"
        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
        date = "2017/11/23"
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"
    strings:
        $ = "nautilus-service.dll" ascii
        $ = "oxygen.dll" ascii
        $ = "config_listen.system" ascii
        $ = "ctx.system" ascii
        $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
        $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x[PII_REDACTED]000001.db" ascii
    condition:
        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
}
YARA Detection Rule: Nautilus_forensic_artificats
Repository: Neo23x0/signature-base
Detects: Rule for detection of Nautilus related strings
Author: NCSC UK / Florian Roth
Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware

Pattern signatures:
$ = "App_Web_juvjerf3.dll" fullword ascii
        $ = "App_Web_vcplrg8q.dll" fullword ascii
        $ = "ar_all2.txt" fullword ascii
        $ = "ar_sa.txt" fullword ascii
        $ = "Convert.FromBase64String(temp[1])" fullword ascii
        $ = "D68gq#5p0(3Ndsk!" fullword ascii
        $ = "dcomnetsrv" fullword ascii
        $ = "ERRORF~1.ASP" fullword ascii
        $ = "intelliAdminRpc" fullword ascii
        $ = "J8fs4F4rnP7nFl#f" fullword ascii
        $ = "Msnb.exe" fullword ascii
        $ = "nautilus-service.dll"
        $ = "Neuron_service" fullword ascii
        $ = "owa_ar2.bat" fullword ascii
        $ = "payload.x64.dll.system" fullword ascii
        $ = "service.x64.dll.system" fullword ascii

Detection condition:
1 of them

Full rule:
rule Nautilus_forensic_artificats {
    meta:
        description = "Rule for detection of Nautilus related strings"
        author = "NCSC UK / Florian Roth"
        date = "2017/11/23"
        score = 60
        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
        id = "0c0a24da-4dbc-543a-9ec0-a5b1ec75c889"
    strings:
        $ = "App_Web_juvjerf3.dll" fullword ascii
        $ = "App_Web_vcplrg8q.dll" fullword ascii
        $ = "ar_all2.txt" fullword ascii
        $ = "ar_sa.txt" fullword ascii
        $ = "Convert.FromBase64String(temp[1])" fullword ascii
        $ = "D68gq#5p0(3Ndsk!" fullword ascii
        $ = "dcomnetsrv" fullword ascii
        $ = "ERRORF~1.ASP" fullword ascii
        $ = "intelliAdminRpc" fullword ascii
        $ = "J8fs4F4rnP7nFl#f" fullword ascii
        $ = "Msnb.exe" fullword ascii
        $ = "nautilus-service.dll"
        $ = "Neuron_service" fullword ascii
        $ = "owa_ar2.bat" fullword ascii
        $ = "payload.x64.dll.system" fullword ascii
        $ = "service.x64.dll.system" fullword ascii
    condition:
        1 of them
}
YARA Detection Rule: APT_Neuron2_Loader_Strings
Repository: Neo23x0/signature-base
Detects: Rule for detection of Neuron2 based on strings within the loader
Author: NCSC

Pattern signatures:
$ = "dcom_api" ascii
      $ = "http://*:80/OWA/OAB/" ascii
      $ = "https://*:443/OWA/OAB/" ascii
      $ = "dcomnetsrv.cpp" wide
      $ = "dcomnet.dll" ascii
      $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them

Full rule:
rule APT_Neuron2_Loader_Strings {
   meta:
      description = "Rule for detection of Neuron2 based on strings within the loader"
      author = "NCSC"
      referer = "https://otx.alienvault.com/pulse/5dad718fa5ec6c21e85c1c66"
      hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
      id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
   strings:
      $ = "dcom_api" ascii
      $ = "http://*:80/OWA/OAB/" ascii
      $ = "https://*:443/OWA/OAB/" ascii
      $ = "dcomnetsrv.cpp" wide
      $ = "dcomnet.dll" ascii
      $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}
YARA Detection Rule: SUSP_Two_Byte_XOR_PE_And_MZ
Repository: Neo23x0/signature-base
Detects: Look for 2 byte xor of a PE starting at offset 0
Author: Wesley Shields <wxs@atarininja.org>
Reference: https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83

Detection condition:
uint16(0) != 0x5a4d and
      uint32((uint16(0x3c) ^ (uint16(0) ^ 0x5a4d)) | ((uint16(0x3e) ^ (uint16(0) ^ 0x5a4d)) << 16)) ^ ((uint16(0) ^ 0x5a4d) | ((uint16(0) ^ 0x5a4d) << 16)) == 0x00004550

Full rule:
rule SUSP_Two_Byte_XOR_PE_And_MZ {
   meta:
      author = "Wesley Shields <wxs@atarininja.org>"
      description = "Look for 2 byte xor of a PE starting at offset 0"
      reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
      score = 60
      date = "2021-10-11"
      id = "ddb87194-bafb-597d-9184-fe4fe3c5ce8d"
   condition:
      uint16(0) != 0x5a4d and
      uint32((uint16(0x3c) ^ (uint16(0) ^ 0x5a4d)) | ((uint16(0x3e) ^ (uint16(0) ^ 0x5a4d)) << 16)) ^ ((uint16(0) ^ 0x5a4d) | ((uint16(0) ^ 0x5a4d) << 16)) == 0x00004550
}