deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: DMALocker
Repository: Yara-Rules/rules
Detects: Deteccion del ransomware DMA Locker desde la version 1.0 a la 4.0
Author: SadFud

Pattern signatures:
$uno = { 41 42 43 58 59 5a 31 31 }
	  $dos = { 21 44 4d 41 4c 4f 43 4b }
	  $tres = { 21 44 4d 41 4c 4f 43 4b 33 2e 30 }
	  $cuatro = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }

Detection condition:
any of them

Full rule:
rule DMALocker : ransom
{
    meta:
    Description = "Deteccion del ransomware DMA Locker desde la version 1.0 a la 4.0"
    ref = "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/"
    Author = "SadFud"
    Date = "30/05/2016"
    
    strings:
    $uno = { 41 42 43 58 59 5a 31 31 }
	  $dos = { 21 44 4d 41 4c 4f 43 4b }
	  $tres = { 21 44 4d 41 4c 4f 43 4b 33 2e 30 }
	  $cuatro = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
    
    condition:
    any of them
    
}
YARA Detection Rule: DMALocker4
Repository: Yara-Rules/rules
Detects: Deteccion del ransomware DMA Locker version 4.0
Author: SadFud

Pattern signatures:
$clave = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }

Detection condition:
$clave

Full rule:
rule DMALocker4 : ransom {

    meta:
    Description = "Deteccion del ransomware DMA Locker version 4.0"
    ref = "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/"
    Author = "SadFud"
    Date = "30/05/2016"
	Hash = "e3106005a0c026fc969b46c83ce9aeaee720df1bb17794768c6c9615f083d5d1"
    
    strings:
    $clave = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
    
    condition:
    $clave 
    
}
YARA Detection Rule: Winnti_signing_cert
Repository: Yara-Rules/rules
Detects: Detects a signing certificate used by the Winnti APT group
Author: Florian Roth
Reference: https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/

Pattern signatures:
$s1 = "Guangzhou YuanLuo Technology Co." ascii
        $s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
        $s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and 1 of them

Full rule:
rule Winnti_signing_cert 
{

    meta:
        description = "Detects a signing certificate used by the Winnti APT group"
        author = "Florian Roth"
        reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
        date = "2015-10-10"
        score = 75
        hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
        hash2 = "[PII_REDACTED]d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"

    strings:
        $s1 = "Guangzhou YuanLuo Technology Co." ascii
        $s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
        $s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
}
YARA Detection Rule: Winnti_malware_Nsiproxy
Repository: Yara-Rules/rules
Detects: Detects a Winnti rootkit
Author: Florian Roth

Pattern signatures:
$x1 = "\\Driver\\nsiproxy" fullword wide
        $a1 = "\\Device\\StreamPortal" fullword wide
        $a2 = "\\Device\\PNTFILTER" fullword wide
        $s1 = "Cookie: SN=" fullword ascii
        $s2 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
        $s3 = "Winqual.sys" fullword wide
        $s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
        $s5 = "http://www.wasabii.com.tw 0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)

Full rule:
rule Winnti_malware_Nsiproxy 
{

    meta:
        description = "Detects a Winnti rootkit"
        author = "Florian Roth"
        date = "2015-10-10"
        score = 75
        hash1 = "[PII_REDACTED]d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
        hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
        hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
        hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
        hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
   
    strings:
        $x1 = "\\Driver\\nsiproxy" fullword wide
        $a1 = "\\Device\\StreamPortal" fullword wide
        $a2 = "\\Device\\PNTFILTER" fullword wide
        $s1 = "Cookie: SN=" fullword ascii
        $s2 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
        $s3 = "Winqual.sys" fullword wide
        $s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
        $s5 = "http://www.wasabii.com.tw 0" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
}
YARA Detection Rule: Winnti_malware_UpdateDLL
Repository: Yara-Rules/rules
Detects: Detects a Winnti malware - Update.dll
Author: Florian Roth
Reference: VTI research

Pattern signatures:
$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
        $c2 = "AHDNEAFE1.sys" fullword ascii
        $c3 = "SOTEFEHJ3.sys" fullword ascii
        $c4 = "MainSYS64.sys" fullword ascii
        $s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
        $s2 = "Update.dll" fullword ascii
        $s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
        $s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
        $s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
        $s6 = "\\??\\pipe\\usbpcg%d" fullword wide
        $s7 = "\\??\\pipe\\usbpcex%d" fullword wide
        $s8 = "HOST: %s" fullword ascii
        $s9 = "$$$--Hello" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( ( 1 of ($c*) and 3 of ($s*) ) or all of ($s*) )

Full rule:
rule Winnti_malware_UpdateDLL 
{

    meta:
        description = "Detects a Winnti malware - Update.dll"
        author = "Florian Roth"
        reference = "VTI research"
        date = "2015-10-10"
        score = 75
        hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
        hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
        hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
        hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
   
    strings:
        $c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
        $c2 = "AHDNEAFE1.sys" fullword ascii
        $c3 = "SOTEFEHJ3.sys" fullword ascii
        $c4 = "MainSYS64.sys" fullword ascii
        $s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
        $s2 = "Update.dll" fullword ascii
        $s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
        $s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
        $s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
        $s6 = "\\??\\pipe\\usbpcg%d" fullword wide
        $s7 = "\\??\\pipe\\usbpcex%d" fullword wide
        $s8 = "HOST: %s" fullword ascii
        $s9 = "$$$--Hello" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and ( ( 1 of ($c*) and 3 of ($s*) ) or all of ($s*) )
}
YARA Detection Rule: Winnti_malware_FWPK
Repository: Yara-Rules/rules
Detects: Detects a Winnti malware - FWPKCLNT.SYS
Author: Florian Roth
Reference: VTI research

Pattern signatures:
$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" fullword wide
        $s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
        $s2 = "FWPKCLNT.SYS" fullword ascii
        $s3 = "Port Layer" fullword wide
        $s4 = "%x->%x, icmp type %d, code %d" fullword ascii
        $s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" fullword wide
        $s6 = "\\Ndi\\Interfaces" fullword wide
        $s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" fullword wide
        $s8 = "Bad packet" fullword ascii
        $s9 = "\\BaseNamedObjects\\EKV[PII_REDACTED]" fullword wide
        $s10 = "%x->%x" fullword ascii
        $s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 642KB and all of them

Full rule:
rule Winnti_malware_FWPK 
{

    meta:
        description = "Detects a Winnti malware - FWPKCLNT.SYS"
        author = "Florian Roth"
        reference = "VTI research"
        date = "2015-10-10"
        score = 75
        hash1 = "[PII_REDACTED]c84b0d31f[PII_REDACTED]82bdcd1666653ebc25d50a142b4f5dabf2c"
        hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
        hash3 = "a[PII_REDACTED]71c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
  
    strings:
        $s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" fullword wide
        $s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
        $s2 = "FWPKCLNT.SYS" fullword ascii
        $s3 = "Port Layer" fullword wide
        $s4 = "%x->%x, icmp type %d, code %d" fullword ascii
        $s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" fullword wide
        $s6 = "\\Ndi\\Interfaces" fullword wide
        $s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" fullword wide
        $s8 = "Bad packet" fullword ascii
        $s9 = "\\BaseNamedObjects\\EKV[PII_REDACTED]" fullword wide
        $s10 = "%x->%x" fullword ascii
        $s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */
 
    condition:
        uint16(0) == 0x5a4d and filesize < 642KB and all of them
}
YARA Detection Rule: Winnti_malware_StreamPortal_Gen
Repository: Yara-Rules/rules
Detects: Detects a Winnti malware - Streamportal
Author: Florian Roth
Reference: VTI research

Pattern signatures:
$s0 = "Proxies destination address/port for TCP" fullword wide
        $s3 = "\\Device\\StreamPortal" fullword wide
        $s4 = "Transport-Data Proxy Sub-Layer" fullword wide
        $s5 = "Cookie: SN=" fullword ascii
        $s6 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
        $s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
        $s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 275KB and all of them

Full rule:
rule Winnti_malware_StreamPortal_Gen 
{

    meta:
        description = "Detects a Winnti malware - Streamportal"
        author = "Florian Roth"
        reference = "VTI research"
        date = "2015-10-10"
        score = 75
        hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
        hash2 = "[PII_REDACTED]d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
        hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
  
    strings:
        $s0 = "Proxies destination address/port for TCP" fullword wide
        $s3 = "\\Device\\StreamPortal" fullword wide
        $s4 = "Transport-Data Proxy Sub-Layer" fullword wide
        $s5 = "Cookie: SN=" fullword ascii
        $s6 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
        $s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
        $s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */
  
    condition:
        uint16(0) == 0x5a4d and filesize < 275KB and all of them
}
YARA Detection Rule: WinntiPharma
Repository: Yara-Rules/rules
Detects: Backdoor Win64 Winnti Pharma
Author: Jose Ramon Palanco

Pattern signatures:
$s0 = "Cookie: SN="
    $s1 = "{3ec05b4a-ea88-1378-3389-66706ba27600}"
    $s2 = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
    $s3 = "master secret"
    $s4 = "MyEngineNetEvent"

Detection condition:
all of ($s*)

Full rule:
rule WinntiPharma 
{

meta:
    author = "Jose Ramon Palanco"
    copyright = "Drainware, Inc."
    date = "2015-06-23"
    description = "Backdoor Win64 Winnti Pharma"
    ref = "https://securelist.com/blog/research/70991/games-are-over/"

strings:
    $s0 = "Cookie: SN="
    $s1 = "{3ec05b4a-ea88-1378-3389-66706ba27600}"
    $s2 = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
    $s3 = "master secret"
    $s4 = "MyEngineNetEvent"

condition:
    all of ($s*)
}
YARA Detection Rule: LinuxAESDDoS
Repository: Yara-Rules/rules
Detects: Strings inside
Author: @benkow_
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483

Pattern signatures:
$a = "3AES"
        $b = "Hacker"
        $c = "VERSONEX"

Detection condition:
2 of them

Full rule:
rule LinuxAESDDoS
{
    meta:
	Author = "@benkow_"
	Date = "2014/09/12"
	Description = "Strings inside"
        Reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483"

    strings:
        $a = "3AES"
        $b = "Hacker"
        $c = "VERSONEX"

    condition:
        2 of them
}
YARA Detection Rule: LinuxBillGates
Repository: Yara-Rules/rules
Detects: Strings inside
Author: @benkow_
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3429

Pattern signatures:
$a= "12CUpdateGates"
        $b= "11CUpdateBill"

Detection condition:
$a and $b

Full rule:
rule LinuxBillGates 
{
    meta:
       Author      = "@benkow_"
       Date        = "2014/08/11" 
       Description = "Strings inside"
       Reference   = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3429" 

    strings:
        $a= "12CUpdateGates"
        $b= "11CUpdateBill"

    condition:
        $a and $b
}
YARA Detection Rule: LinuxElknot
Repository: Yara-Rules/rules
Detects: Strings inside
Author: @benkow_
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3099

Pattern signatures:
$a = "ZN8CUtility7DeCryptEPciPKci"
	$b = "ZN13CThreadAttack5StartEP11CCmdMessage"

Detection condition:
all of them

Full rule:
rule LinuxElknot
{
    meta:
	Author      = "@benkow_"
        Date        = "2013/12/24" 
        Description = "Strings inside"
        Reference   = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3099"

    strings:
        $a = "ZN8CUtility7DeCryptEPciPKci"
	$b = "ZN13CThreadAttack5StartEP11CCmdMessage"

    condition:
	all of them
}
YARA Detection Rule: LinuxMrBlack
Repository: Yara-Rules/rules
Detects: Strings inside
Author: @benkow_
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483

Pattern signatures:
$a = "Mr.Black"
	$b = "VERS0NEX:%s|%d|%d|%s"

Detection condition:
$a and $b

Full rule:
rule LinuxMrBlack
{
    meta:
	Author      = "@benkow_"
        Date        = "2014/09/12" 
        Description = "Strings inside"
        Reference   = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483"

    strings:
        $a = "Mr.Black"
	$b = "VERS0NEX:%s|%d|%d|%s"
    condition:
        $a and $b
}
YARA Detection Rule: LinuxTsunami
Repository: Yara-Rules/rules
Detects: Strings inside
Author: @benkow_
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483

Pattern signatures:
$a = "PRIVMSG %s :[STD]Hitting %s"
        $b = "NOTICE %s :TSUNAMI <target> <secs>"
        $c = "NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually."

Detection condition:
$a or $b or $c

Full rule:
rule LinuxTsunami
{
    meta:
	
		Author      = "@benkow_"
		Date        = "2014/09/12" 
		Description = "Strings inside"
		Reference   = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483"

    strings:
        $a = "PRIVMSG %s :[STD]Hitting %s"
        $b = "NOTICE %s :TSUNAMI <target> <secs>"
        $c = "NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually."
    condition:
        $a or $b or $c
}
YARA Detection Rule: rootkit
Repository: Yara-Rules/rules
Author: xorseed
Reference: https://stuff.rop.io/

Pattern signatures:
$sys1 = "sys_write" nocase ascii wide	
		$sys2 = "sys_getdents" nocase ascii wide
		$sys3 = "sys_getdents64" nocase ascii wide
		$sys4 = "sys_getpgid" nocase ascii wide
		$sys5 = "sys_getsid" nocase ascii wide
		$sys6 = "sys_setpgid" nocase ascii wide
		$sys7 = "sys_kill" nocase ascii wide
		$sys8 = "sys_tgkill" nocase ascii wide
		$sys9 = "sys_tkill" nocase ascii wide
		$sys10 = "sys_sched_setscheduler" nocase ascii wide
		$sys11 = "sys_sched_setparam" nocase ascii wide
		$sys12 = "sys_sched_getscheduler" nocase ascii wide
		$sys13 = "sys_sched_getparam" nocase ascii wide
		$sys14 = "sys_sched_setaffinity" nocase ascii wide
		$sys15 = "sys_sched_getaffinity" nocase ascii wide
		$sys16 = "sys_sched_rr_get_interval" nocase ascii wide
		$sys17 = "sys_wait4" nocase ascii wide
		$sys18 = "sys_waitid" nocase ascii wide
		$sys19 = "sys_rt_tgsigqueueinfo" nocase ascii wide
		$sys20 = "sys_rt_sigqueueinfo" nocase ascii wide
		$sys21 = "sys_prlimit64" nocase ascii wide
		$sys22 = "sys_ptrace" n

Detection condition:
9 of them

Full rule:
rule rootkit
{
	meta:
                author="xorseed"
                reference= "https://stuff.rop.io/"
	strings:
		$sys1 = "sys_write" nocase ascii wide	
		$sys2 = "sys_getdents" nocase ascii wide
		$sys3 = "sys_getdents64" nocase ascii wide
		$sys4 = "sys_getpgid" nocase ascii wide
		$sys5 = "sys_getsid" nocase ascii wide
		$sys6 = "sys_setpgid" nocase ascii wide
		$sys7 = "sys_kill" nocase ascii wide
		$sys8 = "sys_tgkill" nocase ascii wide
		$sys9 = "sys_tkill" nocase ascii wide
		$sys10 = "sys_sched_setscheduler" nocase ascii wide
		$sys11 = "sys_sched_setparam" nocase ascii wide
		$sys12 = "sys_sched_getscheduler" nocase ascii wide
		$sys13 = "sys_sched_getparam" nocase ascii wide
		$sys14 = "sys_sched_setaffinity" nocase ascii wide
		$sys15 = "sys_sched_getaffinity" nocase ascii wide
		$sys16 = "sys_sched_rr_get_interval" nocase ascii wide
		$sys17 = "sys_wait4" nocase ascii wide
		$sys18 = "sys_waitid" nocase ascii wide
		$sys19 = "sys_rt_tgsigqueueinfo" nocase ascii wide
		$sys20 = "sys_rt_sigqueueinfo" nocase ascii wide
		$sys21 = "sys_prlimit64" nocase ascii wide
		$sys22 = "sys_ptrace" nocase ascii wide
		$sys23 = "sys_migrate_pages" nocase ascii wide
		$sys24 = "sys_move_pages" nocase ascii wide
		$sys25 = "sys_get_robust_list" nocase ascii wide
		$sys26 = "sys_perf_event_open" nocase ascii wide
		$sys27 = "sys_uname" nocase ascii wide
		$sys28 = "sys_unlink" nocase ascii wide
		$sys29 = "sys_unlikat" nocase ascii wide
		$sys30 = "sys_rename" nocase ascii wide
		$sys31 = "sys_read" nocase ascii wide
		$sys32 = "kobject_del" nocase ascii wide
		$sys33 = "list_del_init" nocase ascii wide
		$sys34 = "inet_ioctl" nocase ascii wide
	condition:
		9 of them
}
YARA Detection Rule: exploit
Repository: Yara-Rules/rules
Author: xorseed
Reference: https://stuff.rop.io/

Pattern signatures:
$xpl1 = "set_fs_root" nocase ascii wide
		$xpl2 = "set_fs_pwd" nocase ascii wide
		$xpl3 = "__virt_addr_valid" nocase ascii wide
		$xpl4 = "init_task" nocase ascii wide
		$xpl5 = "init_fs" nocase ascii wide
		$xpl6 = "bad_file_ops" nocase ascii wide
		$xpl7 = "bad_file_aio_read" nocase ascii wide
		$xpl8 = "security_ops" nocase ascii wide
		$xpl9 = "default_security_ops" nocase ascii wide
		$xpl10 = "audit_enabled" nocase ascii wide
		$xpl11 = "commit_creds" nocase ascii wide
		$xpl12 = "prepare_kernel_cred" nocase ascii wide
		$xpl13 = "ptmx_fops" nocase ascii wide
		$xpl14 = "node_states" nocase ascii wide

Detection condition:
7 of them

Full rule:
rule exploit
{
        meta:
                author="xorseed"
                reference= "https://stuff.rop.io/"
	strings:
		$xpl1 = "set_fs_root" nocase ascii wide
		$xpl2 = "set_fs_pwd" nocase ascii wide
		$xpl3 = "__virt_addr_valid" nocase ascii wide
		$xpl4 = "init_task" nocase ascii wide
		$xpl5 = "init_fs" nocase ascii wide
		$xpl6 = "bad_file_ops" nocase ascii wide
		$xpl7 = "bad_file_aio_read" nocase ascii wide
		$xpl8 = "security_ops" nocase ascii wide
		$xpl9 = "default_security_ops" nocase ascii wide
		$xpl10 = "audit_enabled" nocase ascii wide
		$xpl11 = "commit_creds" nocase ascii wide
		$xpl12 = "prepare_kernel_cred" nocase ascii wide
		$xpl13 = "ptmx_fops" nocase ascii wide
		$xpl14 = "node_states" nocase ascii wide
	condition:
		7 of them
}
YARA Detection Rule: XMRIG_Miner
Repository: Yara-Rules/rules

Pattern signatures:
$a1 = "stratum+tcp"

Detection condition:
$a1

Full rule:
rule XMRIG_Miner
{
	meta:
  ref = "https://gist.github.com/GelosSnake/c2d4d6ef6f93ccb7d3afb5b1e26c7b4e"
  strings:
    $a1 = "stratum+tcp"
    condition:
    $a1  
}
YARA Detection Rule: Powerstager
Repository: Yara-Rules/rules
Detects: Detects PowerStager Windows executable, both x86 and x64
Author: Jeff White - jwhite@paloaltonetworks.com @noottrak
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-powerstager-analysis/

Pattern signatures:
$filename = /%s\\[a-zA-Z0-9]{12}/
      $pathname = "TEMP" wide ascii
//    $errormsg = "The version of this file is not compatible with the version of Windows you're running." wide ascii
      $filedesc = "Lorem ipsum dolor sit amet, consecteteur adipiscing elit" wide ascii
      $apicall_01 = "memset"
      $apicall_02 = "getenv"
      $apicall_03 = "fopen"
      $apicall_04 = "memcpy"
      $apicall_05 = "fwrite"
      $apicall_06 = "fclose"
      $apicall_07 = "CreateProcessA"
      $decoder_x86_01 = { 8D 95 [4] 8B 45 ?? 01 D0 0F B6 18 8B 4D ?? }
      $decoder_x86_02 = { 89 C8 0F B6 84 05 [4] 31 C3 89 D9 8D 95 [4] 8B 45 ?? 01 D0 88 08 83 45 [2] 8B 45 ?? 3D }
      $decoder_x64_01 = { 8B 85 [4] 48 98 44 0F [7] 8B 85 [4] 48 63 C8 48 }
      $decoder_x64_02 = { 48 89 ?? 0F B6 [3-6] 44 89 C2 31 C2 8B 85 [4] 48 98 }

Detection condition:
uint16be(0) == 0x4D5A
        and
      all of ($apicall_*)
        and
      $filename
        and
      $pathname
        and
      $filedesc
        and
      (2 of ($decoder_x86*) or 2 of ($decoder_x64*))

Full rule:
rule Powerstager
{
    meta:
      author = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
      date = "02JAN2018"
      hash1 = "758097319d61e2744fb6b297f0bff957c6aab299278c1f56a90fba197795a0fa" //x86
      hash2 = "83e714e72d9f3c500cad610c4772eae6152a232965191f0125c1c6f97004b7b5" //x64
      description = "Detects PowerStager Windows executable, both x86 and x64"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-powerstager-analysis/"
      reference2 = "https://github.com/z0noxz/powerstager"
    
    strings:
      $filename = /%s\\[a-zA-Z0-9]{12}/
      $pathname = "TEMP" wide ascii
//    $errormsg = "The version of this file is not compatible with the version of Windows you're running." wide ascii
      $filedesc = "Lorem ipsum dolor sit amet, consecteteur adipiscing elit" wide ascii
      $apicall_01 = "memset"
      $apicall_02 = "getenv"
      $apicall_03 = "fopen"
      $apicall_04 = "memcpy"
      $apicall_05 = "fwrite"
      $apicall_06 = "fclose"
      $apicall_07 = "CreateProcessA"
      $decoder_x86_01 = { 8D 95 [4] 8B 45 ?? 01 D0 0F B6 18 8B 4D ?? }
      $decoder_x86_02 = { 89 C8 0F B6 84 05 [4] 31 C3 89 D9 8D 95 [4] 8B 45 ?? 01 D0 88 08 83 45 [2] 8B 45 ?? 3D }
      $decoder_x64_01 = { 8B 85 [4] 48 98 44 0F [7] 8B 85 [4] 48 63 C8 48 }
      $decoder_x64_02 = { 48 89 ?? 0F B6 [3-6] 44 89 C2 31 C2 8B 85 [4] 48 98 }

    condition:
      uint16be(0) == 0x4D5A
        and
      all of ($apicall_*)
        and
      $filename
        and
      $pathname
        and
      $filedesc
        and
      (2 of ($decoder_x86*) or 2 of ($decoder_x64*))
}