deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cryptonar_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect CryptoNar Ransomware
Author: Marc Rivero | @seifreed
Reference: https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/

Pattern signatures:
$s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
      $s2 = "CryptoNarDecryptor.exe" fullword wide
      $s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
      $s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
      $s5 = "key you received, and wait until the decryption process is done." fullword ascii
      $s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
      $s7 = "Decryption process failed" fullword wide
      $s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
      $s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
      $s10 = "johnsmith987654@tutanota.com" fullword wide
      $s11 = "Decryption process will start soon" fullwo

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB) and all of them

Full rule:
rule cryptonar_ransomware {

   meta:
   
      description = "Rule to detect CryptoNar Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
      
   strings:
   
      $s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
      $s2 = "CryptoNarDecryptor.exe" fullword wide
      $s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
      $s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
      $s5 = "key you received, and wait until the decryption process is done." fullword ascii
      $s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
      $s7 = "Decryption process failed" fullword wide
      $s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
      $s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
      $s10 = "johnsmith987654@tutanota.com" fullword wide
      $s11 = "Decryption process will start soon" fullword wide
      $s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii
      $s13 = "DecryptionProcessProgressBar" fullword wide
      $s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
      
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB) and all of them 
}
YARA Detection Rule: is__osx
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Detection condition:
uint32(0) == 0xfeedface     or uint32(0) == 0xcafebabe
    or uint32(0) == 0xbebafeca  or uint32(0) == 0xcefaedfe
    or uint32(0) == 0xfeedfacf  or uint32(0) == 0xcffaedfe

Full rule:
private rule is__osx
{
 meta:
    date = "2018-02-12"
    author = "@unixfreaxjp"
 condition:
    uint32(0) == 0xfeedface     or uint32(0) == 0xcafebabe
    or uint32(0) == 0xbebafeca  or uint32(0) == 0xcefaedfe
    or uint32(0) == 0xfeedfacf  or uint32(0) == 0xcffaedfe
}
YARA Detection Rule: priv01
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Pattern signatures:
$vara01 = { 73 3A 70 3A 00 }
    $vara02 = "Usage: %s" fullword nocase wide ascii
    $vara03 = "[ -s secret ]" fullword nocase wide ascii
    $vara04 = "[ -p port ]" fullword nocase wide ascii

Detection condition:
all of them

Full rule:
private rule priv01 {
 meta:
    date = "2018-02-11"
    author = "@unixfreaxjp"
 strings:
    $vara01 = { 73 3A 70 3A 00 }
    $vara02 = "Usage: %s" fullword nocase wide ascii
    $vara03 = "[ -s secret ]" fullword nocase wide ascii
    $vara04 = "[ -p port ]" fullword nocase wide ascii
 condition:
    all of them
}
YARA Detection Rule: priv03
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Pattern signatures:
$varb01 = { 41 57 41 56 41 55 41 54 55 53 0F B6 06 }
    $varb02 = { 48 C7 07 00 00 00 00 48 C7 47 08 00 00 }
    $vard01 = { 55 48 89 E5 41 57 41 56 41 55 41 54 53 }
    $vard02 = { 55 48 89 E5 48 C7 47 08 00 00 00 00 48 }
    // can be added

Detection condition:
(2 of ($varb*)) or (2 of ($vard*))

Full rule:
private rule priv03 {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 strings:
    $varb01 = { 41 57 41 56 41 55 41 54 55 53 0F B6 06 }
    $varb02 = { 48 C7 07 00 00 00 00 48 C7 47 08 00 00 }
    $vard01 = { 55 48 89 E5 41 57 41 56 41 55 41 54 53 }
    $vard02 = { 55 48 89 E5 48 C7 47 08 00 00 00 00 48 }
    // can be added
 condition:
    (2 of ($varb*)) or (2 of ($vard*))
}
YARA Detection Rule: priv04
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Pattern signatures:
$varb03 = { 89 DF E8 FB A4 FF FF 83 C3 01 81 FB 00 04 }
    $vard03 = { 66 89 05 7D 5E 00 00 }
    // can be added

Detection condition:
1 of them

Full rule:
private rule priv04 {
 meta:
    date = "2018-02-11"
    author = "@unixfreaxjp"
 strings:
    $varb03 = { 89 DF E8 FB A4 FF FF 83 C3 01 81 FB 00 04 }
    $vard03 = { 66 89 05 7D 5E 00 00 }
    // can be added
 condition:
    1 of them
}
YARA Detection Rule: priv02
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Pattern signatures:
$vare01 = "socket" fullword nocase wide ascii
    $vare02 = "connect" fullword nocase wide ascii
    $vare03 = "alarm" fullword nocase wide ascii
    $vare04 = "dup2" fullword nocase wide ascii
    $vare05 = "execl" fullword nocase wide ascii
    $vare06 = "openpty" fullword nocase wide ascii
    $vare07 = "putenv" fullword nocase wide ascii
    $vare08 = "setsid" fullword nocase wide ascii
    $vare09 = "ttyname" fullword nocase wide ascii
    $vare00 = "waitpid" fullword nocase wide ascii
    $varc01 = "HISTFIL" fullword nocase wide ascii
    $varc02 = "TERML" fullword nocase wide ascii
    $varc03 = "/bin/sh" fullword nocase wide ascii

Detection condition:
(5 of ($vare*)
    or (2 of ($varc*)))

Full rule:
private rule priv02 {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 strings:
    $vare01 = "socket" fullword nocase wide ascii
    $vare02 = "connect" fullword nocase wide ascii
    $vare03 = "alarm" fullword nocase wide ascii
    $vare04 = "dup2" fullword nocase wide ascii
    $vare05 = "execl" fullword nocase wide ascii
    $vare06 = "openpty" fullword nocase wide ascii
    $vare07 = "putenv" fullword nocase wide ascii
    $vare08 = "setsid" fullword nocase wide ascii
    $vare09 = "ttyname" fullword nocase wide ascii
    $vare00 = "waitpid" fullword nocase wide ascii
    $varc01 = "HISTFIL" fullword nocase wide ascii
    $varc02 = "TERML" fullword nocase wide ascii
    $varc03 = "/bin/sh" fullword nocase wide ascii
 condition:
    (5 of ($vare*)
    or (2 of ($varc*)))
}
YARA Detection Rule: MALW_TinyShell_backconnect_OSX
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Detection condition:
is__osx
    and priv01
    and priv02
    and priv03
    and priv04
    and filesize < 100KB

Full rule:
rule MALW_TinyShell_backconnect_OSX {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 condition:
    is__osx
    and priv01
    and priv02
    and priv03
    and priv04
    and filesize < 100KB
}
YARA Detection Rule: MALW_TinyShell_backconnect_ELF
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Detection condition:
is__elf
    and priv01
    and ((priv02)
      or ((priv03)
        or (priv04)))
    and filesize < 100KB

Full rule:
rule MALW_TinyShell_backconnect_ELF {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 condition:
    is__elf
    and priv01
    and ((priv02)
      or ((priv03)
        or (priv04)))
    and filesize < 100KB
}
YARA Detection Rule: MALW_TinyShell_backconnect_Gen
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Detection condition:
((is__elf) or  (is__osx))
    and priv01
    and priv02
    and filesize < 100KB

Full rule:
rule MALW_TinyShell_backconnect_Gen {
 meta:
    date = "2018-02-11"
    author = "@unixfreaxjp"
 condition:
    ((is__elf) or  (is__osx))
    and priv01
    and priv02
    and filesize < 100KB
}
YARA Detection Rule: MALW_TinyShell_backdoor_Gen
Repository: Yara-Rules/rules
Author: @unixfreaxjp

Detection condition:
((is__elf) or  (is__osx))
    and priv01
    and filesize > 20KB

Full rule:
rule MALW_TinyShell_backdoor_Gen {
 meta:
    date = "2018-02-11"
    author = "@unixfreaxjp"
 condition:
    ((is__elf) or  (is__osx))
    and priv01
    and filesize > 20KB
}
YARA Detection Rule: WarpCode
Repository: Yara-Rules/rules
Detects: Warp code features
Author: Seth Hardy

Pattern signatures:
// character replacement
        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }

Detection condition:
any of them

Full rule:
rule WarpCode : Warp Family 
{
    meta:
        description = "Warp code features"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
    
    strings:
        // character replacement
        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
    
    condition:
        any of them
}
YARA Detection Rule: WarpStrings
Repository: Yara-Rules/rules
Detects: Warp Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "/2011/n325423.shtml?"
        $ = "wyle"
        $ = "\\~ISUN32.EXE"

Detection condition:
any of them

Full rule:
rule WarpStrings : Warp Family
{
    meta:
        description = "Warp Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    strings:
        $ = "/2011/n325423.shtml?"
        $ = "wyle"
        $ = "\\~ISUN32.EXE"

    condition:
       any of them
}
YARA Detection Rule: Warp
Repository: Yara-Rules/rules
Detects: Warp
Author: Seth Hardy

Detection condition:
WarpCode or WarpStrings

Full rule:
rule Warp : Family
{
    meta:
        description = "Warp"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    condition:
        WarpCode or WarpStrings
}
YARA Detection Rule: Backdoor_Jolob
Repository: Yara-Rules/rules
Detects: the backdoor registers an auto start service with the display name \
Reference: http://www.symantec.com/connect/blogs/new-flash-zero-day-linked-yet-more-watering-hole-attacks

Pattern signatures:
$type = "Microsoft-Windows-Security-Auditing"
		$eventid = "4673"
		$data1 = "Security"
		$data2 = "SeCreateGlobalPrivilege"
		$data3 = "Windows\\System32\\sysprep\\sysprep.exe" nocase
        
		$type1 = "Microsoft-Windows-Security-Auditing"
		$eventid1 = "4688"
		$data4 = "Windows\\System32\\sysprep\\sysprep.exe" nocase
        
		$type2 = "Service Control Manager"
		$eventid2 = "7036"
		$data5 = "Network Access Management Agent"
		$data6 = "running"
        
		$type3 = "Service Control Manager"
		$eventid3 = "7045"
		$data7 = "Network Access Management Agent"
		$data8 = "user mode service"
		$data9 = "auto start"

Detection condition:
all of them

Full rule:
rule Backdoor_Jolob
{
	meta:
		maltype = "Backdoor.Jolob"
    ref = "https://github.com/reed1713"
		reference = "http://www.symantec.com/connect/blogs/new-flash-zero-day-linked-yet-more-watering-hole-attacks"
		description = "the backdoor registers an auto start service with the display name \"Network Access Management Agent\" pointing to the dll netfilter.dll. This is accomplished without notifying the user via the sysprep UAC bypass method."
	strings:   
		$type = "Microsoft-Windows-Security-Auditing"
		$eventid = "4673"
		$data1 = "Security"
		$data2 = "SeCreateGlobalPrivilege"
		$data3 = "Windows\\System32\\sysprep\\sysprep.exe" nocase
        
		$type1 = "Microsoft-Windows-Security-Auditing"
		$eventid1 = "4688"
		$data4 = "Windows\\System32\\sysprep\\sysprep.exe" nocase
        
		$type2 = "Service Control Manager"
		$eventid2 = "7036"
		$data5 = "Network Access Management Agent"
		$data6 = "running"
        
		$type3 = "Service Control Manager"
		$eventid3 = "7045"
		$data7 = "Network Access Management Agent"
		$data8 = "user mode service"
		$data9 = "auto start"      
    condition:
    	all of them
}
YARA Detection Rule: is_elf
Repository: Yara-Rules/rules

Pattern signatures:
$header = { 7F 45 4C 46 }

Detection condition:
$header at 0

Full rule:
private rule is_elf
{
    strings:
        $header = { 7F 45 4C 46 }

    condition:
        $header at 0
}
YARA Detection Rule: moose
Repository: Yara-Rules/rules
Detects: Linux/Moose malware
Author: Thomas Dupuy
Reference: http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf

Pattern signatures:
$s0 = "Status: OK"
        $s1 = "--scrypt"
        $s2 = "stratum+tcp://"
        $s3 = "cmd.so"
        $s4 = "/Challenge"
        $s7 = "processor"
        $s9 = "cpu model"
        $s21 = "password is wrong"
        $s22 = "password:"
        $s23 = "uthentication failed"
        $s24 = "sh"
        $s25 = "ps"
        $s26 = "echo -n -e "
        $s27 = "chmod"
        $s28 = "elan2"
        $s29 = "elan3"
        $s30 = "chmod: not found"
        $s31 = "cat /proc/cpuinfo"
        $s32 = "/proc/%s/cmdline"
        $s33 = "kill %s"

Detection condition:
is_elf and all of them

Full rule:
rule moose
{
    meta:
        Author      = "Thomas Dupuy"
        Date        = "2015/04/21"
        Description = "Linux/Moose malware"
        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "github@eset.com"
        License = "BSD 2-Clause"

    strings:
        $s0 = "Status: OK"
        $s1 = "--scrypt"
        $s2 = "stratum+tcp://"
        $s3 = "cmd.so"
        $s4 = "/Challenge"
        $s7 = "processor"
        $s9 = "cpu model"
        $s21 = "password is wrong"
        $s22 = "password:"
        $s23 = "uthentication failed"
        $s24 = "sh"
        $s25 = "ps"
        $s26 = "echo -n -e "
        $s27 = "chmod"
        $s28 = "elan2"
        $s29 = "elan3"
        $s30 = "chmod: not found"
        $s31 = "cat /proc/cpuinfo"
        $s32 = "/proc/%s/cmdline"
        $s33 = "kill %s"

    condition:
        is_elf and all of them
}
YARA Detection Rule: Molerats_certs
Repository: Yara-Rules/rules
Detects: this rule detections code signed with certificates used by the Molerats actor
Author: FireEye Labs
Reference: https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html

Pattern signatures:
$cert1 = { 06 50 11 A5 BC BF 83 C0 93 28 16 5E 7E 85 27 75 }
        $cert2 = { 03 e1 e1 aa a5 bc a1 9f ba 8c 42 05 8b 4a bf 28 }
        $cert3 = { 0c c0 35 9c 9c 3c da 00 d7 e9 da 2d c6 ba 7b 6d }

Detection condition:
1 of ($cert*)

Full rule:
rule Molerats_certs
{
    
    meta:
        Author      = "FireEye Labs"
        Date        = "2013/08/23"
        Description = "this rule detections code signed with certificates used by the Molerats actor"
        Reference   = "https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"

    strings:
        $cert1 = { 06 50 11 A5 BC BF 83 C0 93 28 16 5E 7E 85 27 75 }
        $cert2 = { 03 e1 e1 aa a5 bc a1 9f ba 8c 42 05 8b 4a bf 28 }
        $cert3 = { 0c c0 35 9c 9c 3c da 00 d7 e9 da 2d c6 ba 7b 6d }

    condition:
        1 of ($cert*)
}
YARA Detection Rule: Win32Toxic
Repository: Yara-Rules/rules
Detects: https://blogs.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us
Author: @GelosSnake

Pattern signatures:
$string0 = "n:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t:;;t;<<t;<<t;<<t;<<t;<<t;<<t;<<t;<<t<<<t;<<t;<<t;<<"
	$string1 = "t;<<t;<<t<<<t<<"
	$string2 = ">>><<<"

Detection condition:
2 of them

Full rule:
rule Win32Toxic : tox ransomware
{
meta:
	author = "@GelosSnake"
	date = "2015-06-02"
	description = "https://blogs.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us"
	hash0 = "70624c13be4d8a4c1361be38b49cb3eb"
	hash1 = "4f20d25cd3ae2e5c63d451d095d97046"
	hash2 = "e0473434cc83b57c4b579d585d4c4c57"
	hash3 = "c52090d184b63e5cc71b524153bb079e"
	hash4 = "7ac0b49baba9914b234cde62058c96a5"
	hash5 = "048c007de4902b6f4731fde45fa8e6a9"
	hash6 = "238ef3e35b14e304c87b9c62f18953a9"
	hash7 = "8908ccd681f66429c578a889e6e708e1"
	hash8 = "de9fe2b7d9463982cc77c78ee51e4d51"
	hash9 = "37add8d26a35a3dc9700b92b67625fa4"
	hash10 = "a0f30e89a3431fca1d389f90dba1d56e"
	hash11 = "d4d0658302c731003bf[PII_REDACTED]bd9"
	hash12 = "d1d89e1c7066f41c1d30985ac7b569db"
	hash13 = "97d52d7281dfae8ff9e704bf30ce2484"
	hash14 = "2cc85be01e86e0505697cf61219e66da"
	hash15 = "02ecfb44b9b11b846ea8233d524ecda3"
	hash16 = "703a6ebe71131671df6bc92086c9a641"
	hash17 = "df23629b4a4aed05d6a453280256c05a"
	hash18 = "07466ff2572f16c63e1fee206b081d11"
	hash19 = "792a1c0971775d32bad374b288792468"
	hash20 = "fb7fd5623fa6b7791a221fad463223cd"
	hash21 = "83a562aab1d66e5d170f091b2ae6a213"
	hash22 = "99214c8c9ff4653b533dc1b19a21d389"
	hash23 = "a92aec198eee23a3a9a145e64d0250ee"
	hash24 = "e0f7e6b96ca72b9755965b9dac3ce77e"
	hash25 = "f520fc947a6d5edb87aa01510bee9c8d"
	hash26 = "6d7babbe5e438539a9fa2c5d6128d3b4"
	hash27 = "3133c2231fcee5d6b0b4c988a5201da1"
	hash28 = "e5b1d198edc413376e0c[PII_REDACTED]e4"
	hash29 = "50515b5a6e[PII_REDACTED]95465d5dc684"
	hash30 = "510389e8c7f22f2076fc7c5388e01220"
	hash31 = "60573c945aa3b8cfaca0bdb6dd7d2019"
	hash32 = "[PII_REDACTED]97463eba97382018dfe151"
	hash33 = "045a5d3c95e28629927c72cf3313f4cd"
	hash34 = "70951624eb06f7db0dcab5fc33f49127"
	hash35 = "5def9e3f7b15b2a75c80596b5e24e0f4"
	hash36 = "35a42fb1c65ebd7d763db4abb26d33b0"
	hash37 = "b0030f[PII_REDACTED]f8e6ba9b295615fc"
	hash38 = "62706f48689f1ba3d1d79780010b8739"
	hash39 = "be86183fa029629ee9c07310cd630871"
	hash40 = "9755c3920d3a38eb1b5b
YARA Detection Rule: SafeNetCode
Repository: Yara-Rules/rules
Detects: SafeNet code features
Author: Seth Hardy

Pattern signatures:
// add edi, 14h; cmp edi, 50D0F8h
        $ = { 83 C7 14 81 FF F8 D0 40 00 }

Detection condition:
any of them

Full rule:
rule SafeNetCode : SafeNet Family 
{
    meta:
        description = "SafeNet code features"
        author = "Seth Hardy"
        last_modified = "2014-07-16"
        
    strings:
        // add edi, 14h; cmp edi, 50D0F8h
        $ = { 83 C7 14 81 FF F8 D0 40 00 }
    condition:
        any of them
}
YARA Detection Rule: SafeNetStrings
Repository: Yara-Rules/rules
Detects: Strings used by SafeNet
Author: Seth Hardy

Pattern signatures:
$ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
        $ = "/safe/record.php"
        $ = "_Rm.bat" wide ascii
        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
        $ = "Ext.org" wide ascii

Detection condition:
any of them

Full rule:
rule SafeNetStrings : SafeNet Family
{
    meta:
        description = "Strings used by SafeNet"
        author = "Seth Hardy"
        last_modified = "2014-07-16"
        
    strings:
        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
        $ = "/safe/record.php"
        $ = "_Rm.bat" wide ascii
        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
        $ = "Ext.org" wide ascii
        
    condition:
        any of them

}
YARA Detection Rule: SafeNet
Repository: Yara-Rules/rules
Detects: SafeNet family

Detection condition:
SafeNetCode or SafeNetStrings

Full rule:
rule SafeNet : Family
{
    meta:
        description = "SafeNet family"
        
    condition:
        SafeNetCode or SafeNetStrings
        
}
YARA Detection Rule: dump_sales_quote_payment
Repository: Yara-Rules/rules

Pattern signatures:
$ = "include '../../../../../../../../../../app/Mage.php'; Mage::app(); $q = Mage::getModel('sales/quote_payment')->getCollection();"

Detection condition:
any of them

Full rule:
rule dump_sales_quote_payment {
    strings: $ = "include '../../../../../../../../../../app/Mage.php'; Mage::app(); $q = Mage::getModel('sales/quote_payment')->getCollection();"
    condition: any of them
}
YARA Detection Rule: dump_sales_order
Repository: Yara-Rules/rules

Pattern signatures:
$ = "../../../../../../app/Mage.php'; Mage::app(); var_dump(Mage::getModel('sales/order')"

Detection condition:
any of them

Full rule:
rule dump_sales_order {
    strings: $ = "../../../../../../app/Mage.php'; Mage::app(); var_dump(Mage::getModel('sales/order')"
    condition: any of them
}
YARA Detection Rule: md5_64651cede2467fdeb1b3b7e6ff3f81cb
Repository: Yara-Rules/rules

Pattern signatures:
$ = "rUl6QttVEP5eqf9usxfJjgoOvdNWFSGoHDgluk+4ONwXQNbGniQLttfyrgkB8d9"

Detection condition:
any of them

Full rule:
rule md5_64651cede2467fdeb1b3b7e6ff3f81cb {
    strings: $ = "rUl6QttVEP5eqf9usxfJjgoOvdNWFSGoHDgluk+4ONwXQNbGniQLttfyrgkB8d9"
    condition: any of them
}
YARA Detection Rule: md5_6bf4910b01aa4f296e590b75a3d25642
Repository: Yara-Rules/rules

Pattern signatures:
$ = "base64_decode('b25lcGFnZXxnY19hZG1pbg==')"

Detection condition:
any of them

Full rule:
rule md5_6bf4910b01aa4f296e590b75a3d25642 {
    strings: $ = "base64_decode('b25lcGFnZXxnY19hZG1pbg==')"
    condition: any of them
}
YARA Detection Rule: fopo_webshell
Repository: Yara-Rules/rules

Pattern signatures:
$ = "DNEcHdQbWtXU3dSMDA1VmZ1c29WUVFXdUhPT0xYb0k3ZDJyWmFVZlF5Y0ZEeHV4K2FnVmY0OUtjbzhnc0"
        $ = "U3hkTVVibSt2MTgyRjY0VmZlQWo3d1VlaFJVNVNnSGZUVUhKZXdEbGxJUTlXWWlqWSt0cEtacUZOSXF4c"
        $ = "rb2JHaTJVdURMNlhQZ1ZlTGVjVnFobVdnMk5nbDlvbEdBQVZKRzJ1WmZUSjdVOWNwWURZYlZ0L1BtNCt"

Detection condition:
any of them

Full rule:
rule fopo_webshell {
    strings: 
        $ = "DNEcHdQbWtXU3dSMDA1VmZ1c29WUVFXdUhPT0xYb0k3ZDJyWmFVZlF5Y0ZEeHV4K2FnVmY0OUtjbzhnc0"
        $ = "U3hkTVVibSt2MTgyRjY0VmZlQWo3d1VlaFJVNVNnSGZUVUhKZXdEbGxJUTlXWWlqWSt0cEtacUZOSXF4c"
        $ = "rb2JHaTJVdURMNlhQZ1ZlTGVjVnFobVdnMk5nbDlvbEdBQVZKRzJ1WmZUSjdVOWNwWURZYlZ0L1BtNCt"
    condition: any of them
}
YARA Detection Rule: eval_post
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval(base64_decode($_POST"
        $ = "eval($undecode($tongji))"
        $ = "eval($_POST"

Detection condition:
any of them

Full rule:
rule eval_post {
    strings:
        $ = "eval(base64_decode($_POST"
        $ = "eval($undecode($tongji))"
        $ = "eval($_POST"
    condition: any of them
}
YARA Detection Rule: spam_mailer
Repository: Yara-Rules/rules

Pattern signatures:
$ = "<strong>WwW.Zone-Org</strong>"
        $ = "echo eval(urldecode("

Detection condition:
any of them

Full rule:
rule spam_mailer {
    strings:
        $ = "<strong>WwW.Zone-Org</strong>"
        $ = "echo eval(urldecode("
    condition: any of them
}
YARA Detection Rule: md5_0105d[PII_REDACTED]4bdb0ecd3fd3a473b
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\)\s*\)\s*\{\s*eval\s*\(\s*\$\{/

Detection condition:
any of them

Full rule:
rule md5_0105d[PII_REDACTED]4bdb0ecd3fd3a473b {
    /*
		)){eval (${ $njap58}['q9e5e25' ])
		) ) { eval ( ${$yed7 }['
    */
    strings: $ = /\)\s*\)\s*\{\s*eval\s*\(\s*\$\{/
    condition: any of them
}
YARA Detection Rule: md5_0b1bfb0bdc7e017baccd05c6af6943ea
Repository: Yara-Rules/rules

Pattern signatures:
$ = /eval\([\w\d]+\(\$[\w\d]+, \$[\w\d]+\)\);/

Detection condition:
any of them

Full rule:
rule md5_0b1bfb0bdc7e017baccd05c6af6943ea {
	/*
		eval(hnsqqh($llmkuhieq, $dbnlftqgr));?>
		eval(vW91692($v7U7N9K, $v5N9NGE));?>
    */
    strings: $ = /eval\([\w\d]+\(\$[\w\d]+, \$[\w\d]+\)\);/
    condition: any of them
}
YARA Detection Rule: md5_2495b460f28f45b40d92da406be15627
Repository: Yara-Rules/rules

Pattern signatures:
$ = "$dez = $pwddir.\"/\".$real;copy($uploaded, $dez);"

Detection condition:
any of them

Full rule:
rule md5_2495b460f28f45b40d92da406be15627 {
    strings: $ = "$dez = $pwddir.\"/\".$real;copy($uploaded, $dez);"
    condition: any of them
}
YARA Detection Rule: md5_2c37d90dd2c9c743c273cb955dd83ef6
Repository: Yara-Rules/rules

Pattern signatures:
$ = "@$_($_REQUEST['"

Detection condition:
any of them

Full rule:
rule md5_2c37d90dd2c9c743c273cb955dd83ef6 {
    strings: $ = "@$_($_REQUEST['"
    condition: any of them
}