deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Office_OLE_DDEAUTO
Repository: Neo23x0/signature-base
Detects: Detects DDE in MS Office documents
Author: NVISO Labs
Reference: https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/

Pattern signatures:
$a = /\x13\s*DDEAUTO\b[^\x14]+/ nocase

Detection condition:
uint32be(0) == 0xD0CF11E0 and $a

Full rule:
rule Office_OLE_DDEAUTO {
   meta:
      description = "Detects DDE in MS Office documents"
      author = "NVISO Labs"
      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
      date = "2017-10-12"
      score = 30
      id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
   strings:
      $a = /\x13\s*DDEAUTO\b[^\x14]+/ nocase
   condition:
      uint32be(0) == 0xD0CF11E0 and $a
}
YARA Detection Rule: Office_OLE_DDE
Repository: Neo23x0/signature-base
Detects: Detects DDE in MS Office documents
Author: NVISO Labs
Reference: https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/

Pattern signatures:
$a = /\x13\s*DDE\b[^\x14]+/ nocase

      $r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
      $r2 = "Adobe ARM Installer"

Detection condition:
uint32be(0) == 0xD0CF11E0 and $a and not 1 of ($r*)

Full rule:
rule Office_OLE_DDE {
   meta:
      description = "Detects DDE in MS Office documents"
      author = "NVISO Labs"
      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
      date = "2017-10-12"
      score = 50
      id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
   strings:
      $a = /\x13\s*DDE\b[^\x14]+/ nocase

      $r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
      $r2 = "Adobe ARM Installer"
   condition:
      uint32be(0) == 0xD0CF11E0 and $a and not 1 of ($r*)
}
YARA Detection Rule: HKTL_BlueHammer_Apr26
Repository: Neo23x0/signature-base
Detects: Detects Nightmare-Eclipse/BlueHammer (FunnyApp), a Windows local privilege escalation PoC that abuses a Defender signature-update RPC and a junction/symlink race to leak the SAM hive and derive NTLM hashes - giving an unprivileged user full SYSTEM-level credential access.
Author: AzizFarghly (Nextron-Systems)
Reference: https://github.com/Nightmare-Eclipse/BlueHammer

Pattern signatures:
$x1 = "Junction created %ws => %ws"
      $x2 = "connect to windows defender RPC port !!!"

      $s1 = "\\System32\\Config\\SAM" wide
      $s2 = "IMpService77BDAF73-B396-481F-9042-AD358843EC24" wide
      $s3 = "ServerMpUpdateEngineSignature"

      $op1 = { 8D 47 02 66 89 43 0C 66 C7 43 0E 02 00 48 8B C7 48 D1 E8 66 44 89 7C 43 12 }

Detection condition:
uint16(0) == 0x5A4D
      and filesize < 7MB
      and (
         1 of ($x*)
         or all of ($s*)
         or $op1
      )
      or 3 of them

Full rule:
rule HKTL_BlueHammer_Apr26 {
   meta:
      author = "AzizFarghly (Nextron-Systems)"
      description = "Detects Nightmare-Eclipse/BlueHammer (FunnyApp), a Windows local privilege escalation PoC that abuses a Defender signature-update RPC and a junction/symlink race to leak the SAM hive and derive NTLM hashes - giving an unprivileged user full SYSTEM-level credential access."
      date = "2026-04-07"
      reference = "https://github.com/Nightmare-Eclipse/BlueHammer"
      hash = "6514f56223999eb86a19ea9f2abbfb0f407934a1a0694ffb94a8ea37113073f4"
      hash = "93008c42764b74b759678fd376abd90696f74af408600727b6649286d8424270"
      hash = "b25e903988e530df00658ff3ad6d180e43d6660b705ad6d0def4a29ee1167e52"
      hash = "82eb727e2a2b3334a70fa2d357ba4f44dc989a650a6a18222dd5d1bb1444b496"
      hash = "b33f3f31c83fc655952fab73d72b673b92ed4f205daee[PII_REDACTED]1316cfc4a"
      hash = "c6baa5ec9ea2c2802a90acad5a53453d176a02e04a31ac8e9b7b34b5e3329b84"
      hash = "552dba31a446e96416738d84d4366503c397ba508a732719531c89a41abf3704"
      hash = "c9bec499db6a0a2165bcd2a211c8887e5fadf954eb9a2e5d3c6ca833e4a5ef64"
      score = 90
   strings:
      $x1 = "Junction created %ws => %ws"
      $x2 = "connect to windows defender RPC port !!!"

      $s1 = "\\System32\\Config\\SAM" wide
      $s2 = "IMpService77BDAF73-B396-481F-9042-AD358843EC24" wide
      $s3 = "ServerMpUpdateEngineSignature"

      $op1 = { 8D 47 02 66 89 43 0C 66 C7 43 0E 02 00 48 8B C7 48 D1 E8 66 44 89 7C 43 12 }
   condition:
      uint16(0) == 0x5A4D
      and filesize < 7MB
      and (
         1 of ($x*)
         or all of ($s*)
         or $op1
      )
      or 3 of them
}
YARA Detection Rule: MAL_G_APT_Backdoor_BRICKSTORM_3
Repository: Neo23x0/signature-base
Detects: Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
$str1 = { 48 8B 05 ?? ?? ?? ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 04 24 [0-5] E8 ?? ?? ?? ?? EB ?? }
      $str4 = "decompress" ascii  // wide nocase
      $str5 = "MIMEHeader" ascii  // wide nocase
      $str6 = "ResolveReference" ascii  // wide nocase
      $str7 = "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]53951" ascii  // wide nocase

Detection condition:
uint16(0) == 0x457F and all of them

Full rule:
rule MAL_G_APT_Backdoor_BRICKSTORM_3 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      md5 = "931eacd7e5250d29903924c31f41b7e5"
   strings:
      $str1 = { 48 8B 05 ?? ?? ?? ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 04 24 [0-5] E8 ?? ?? ?? ?? EB ?? }
      $str4 = "decompress" ascii  // wide nocase
      $str5 = "MIMEHeader" ascii  // wide nocase
      $str6 = "ResolveReference" ascii  // wide nocase
      $str7 = "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]53951" ascii  // wide nocase
   condition:
      uint16(0) == 0x457F and all of them
}
YARA Detection Rule: MAL_G_Backdoor_BRICKSTORM_2
Repository: Neo23x0/signature-base
Detects: Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
// $obf_func = /[a-z]{20}\/[a-z]{20}\/[a-z]{20}\/[a-z]{20}.go/
      $decr1 = { 0F B6 4C 04 ?? 0F B6 54 04 ?? 31 D1 88 4C 04 ?? 48 FF C0 [0-4] 48 83 F8 ?? 7C }
      $decr2 = { 40 88 7C 34 34 48 FF C3 48 FF C6 48 39 D6 7D 18 0F B6 3B 48 39 CE 73 63 44 0F B6 04 30 44 31 C7 48 83 FE 04 72 DA }
      $decr3 = { 0F B6 54 0C ?? 0F B6 5C 0C ?? 31 DA 88 14 08 48 FF C1 48 83 F9 ?? 7C E8 }

      $str1 = "main.selfWatcher"
      $str2 = "main.copyFile"
      $str3 = "main.startNew"

      $str4 = "WRITE_LOG=true"
      $str5 = "WRITE_LOGWednesday"
      $str6 = "vami-httpdvideo/webm"
      $str7 = "/opt/vmware/sbin/"
      $str8 = "/home/vsphere-ui/"
      $str9 = "/opt/vmware/sbin/vami-http"
      $str10 = "main.getVFromEnv"

Detection condition:
uint32(0) == 0x464c457f
      and filesize < 10MB
      and (
         1 of ($decr*)
         and 1 of ($str*)
         or 5 of ($str*)
      )

Full rule:
rule MAL_G_Backdoor_BRICKSTORM_2 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      // $obf_func = /[a-z]{20}\/[a-z]{20}\/[a-z]{20}\/[a-z]{20}.go/
      $decr1 = { 0F B6 4C 04 ?? 0F B6 54 04 ?? 31 D1 88 4C 04 ?? 48 FF C0 [0-4] 48 83 F8 ?? 7C }
      $decr2 = { 40 88 7C 34 34 48 FF C3 48 FF C6 48 39 D6 7D 18 0F B6 3B 48 39 CE 73 63 44 0F B6 04 30 44 31 C7 48 83 FE 04 72 DA }
      $decr3 = { 0F B6 54 0C ?? 0F B6 5C 0C ?? 31 DA 88 14 08 48 FF C1 48 83 F9 ?? 7C E8 }

      $str1 = "main.selfWatcher"
      $str2 = "main.copyFile"
      $str3 = "main.startNew"

      $str4 = "WRITE_LOG=true"
      $str5 = "WRITE_LOGWednesday"
      $str6 = "vami-httpdvideo/webm"
      $str7 = "/opt/vmware/sbin/"
      $str8 = "/home/vsphere-ui/"
      $str9 = "/opt/vmware/sbin/vami-http"
      $str10 = "main.getVFromEnv"
   condition:
      uint32(0) == 0x464c457f
      and filesize < 10MB
      and (
         1 of ($decr*)
         and 1 of ($str*)
         or 5 of ($str*)
      )
}
YARA Detection Rule: MAL_G_APT_Backdoor_BRICKSTORM_1
Repository: Neo23x0/signature-base
Detects: Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
$ = "WRITE_LOGWednesday"
      $ = "/home/vsphere-ui/"
      $ = "WRITE_LOG=true"
      $ = "dns rcode: %v"
      $ = "/libs/doh.createDnsMessage"
      $ = "/libs/func1.(*Client).BackgroundRun"
      $ = "/libs/func1.CreateClient"
      $ = "/core/extends/command.CommandNoContext"
      $ = "/core/extends/command.ExecuteCmd"
      $ = "/core/extends/command.RunShell"
      $ = "/libs/fs.(*RemoteDriver).DeleteFile"
      $ = "/libs/fs.(*RemoteDriver).GetFile"
      $ = "/libs/fs.(*RemoteDriver).PutFile"
      $ = "/libs/doh/doh.go"

Detection condition:
uint32(0) == 0x464c457f and 5 of them

Full rule:
rule MAL_G_APT_Backdoor_BRICKSTORM_1 {
   meta:
      description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
      md5 = "4645f2f6800bc654d5fa812237896b00"
   strings:
      $ = "WRITE_LOGWednesday"
      $ = "/home/vsphere-ui/"
      $ = "WRITE_LOG=true"
      $ = "dns rcode: %v"
      $ = "/libs/doh.createDnsMessage"
      $ = "/libs/func1.(*Client).BackgroundRun"
      $ = "/libs/func1.CreateClient"
      $ = "/core/extends/command.CommandNoContext"
      $ = "/core/extends/command.ExecuteCmd"
      $ = "/core/extends/command.RunShell"
      $ = "/libs/fs.(*RemoteDriver).DeleteFile"
      $ = "/libs/fs.(*RemoteDriver).GetFile"
      $ = "/libs/fs.(*RemoteDriver).PutFile"
      $ = "/libs/doh/doh.go"
   condition:
      uint32(0) == 0x464c457f and 5 of them
}
YARA Detection Rule: WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1
Repository: Neo23x0/signature-base
Detects: Detects webshell used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
//$str1 = /String \w{1,10}=request\.getParameter\(\"\w{1,15}\"\);/ ascii wide nocase
      $str1_alt = "=request.getParameter(\""
      $str2 = "=new String(java.util.Base64.getDecoder().decode(" ascii wide nocase
      //$str21 = /String\[\]\s\w{1,10}=\{\"\/bin\/sh\",\"-c\",\w{1,10}\+\"\s2>&1\"\};/ ascii wide nocase
      $str21_alt = "={\"/bin/sh\",\"-c\"," ascii
      $str3 = "= Runtime.getRuntime().exec(" ascii
      $str4 = "java.io.InputStream" ascii
      $str5 = "java.util.Base64.getEncoder().encodeToString(org.apache.commons.io.IOUtils.toByteArray(" ascii

Detection condition:
filesize < 5MB and all of them

Full rule:
rule WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1 {
   meta:
      description = "Detects webshell used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      //$str1 = /String \w{1,10}=request\.getParameter\(\"\w{1,15}\"\);/ ascii wide nocase
      $str1_alt = "=request.getParameter(\""
      $str2 = "=new String(java.util.Base64.getDecoder().decode(" ascii wide nocase
      //$str21 = /String\[\]\s\w{1,10}=\{\"\/bin\/sh\",\"-c\",\w{1,10}\+\"\s2>&1\"\};/ ascii wide nocase
      $str21_alt = "={\"/bin/sh\",\"-c\"," ascii
      $str3 = "= Runtime.getRuntime().exec(" ascii
      $str4 = "java.io.InputStream" ascii
      $str5 = "java.util.Base64.getEncoder().encodeToString(org.apache.commons.io.IOUtils.toByteArray(" ascii
   condition:
      filesize < 5MB and all of them
}
YARA Detection Rule: WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_2
Repository: Neo23x0/signature-base
Detects: Detects webshell used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
$str1 = "request.getParameter"
      $str2 = "/bin/sh"
      $str3 = "java.io.InputStream"
      $str4 = "Runtime.getRuntime().exec("
      $str5 = "2>&1"

Detection condition:
(uint16(0) != 0x5A4D and uint32(0) != 0x464C457F) and filesize < 7KB and all of them and @str4 > @str2

Full rule:
rule WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_2 {
   meta:
      description = "Detects webshell used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      $str1 = "request.getParameter"
      $str2 = "/bin/sh"
      $str3 = "java.io.InputStream"
      $str4 = "Runtime.getRuntime().exec("
      $str5 = "2>&1"
   condition:
      (uint16(0) != 0x5A4D and uint32(0) != 0x464C457F) and filesize < 7KB and all of them and @str4 > @str2
}
YARA Detection Rule: MAL_G_Backdoor_BRICKSTEAL_1
Repository: Neo23x0/signature-base
Detects: Detects backdoor BRICKSTEAL used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
$str1 = "comvmware"
      $str2 = "abcdABCD1234!@#$"
      $str3 = "ads.png"
      $str4 = "User-Agent"
      $str5 = "com/vmware/"

Detection condition:
all of them and filesize < 10KB

Full rule:
rule MAL_G_Backdoor_BRICKSTEAL_1 {
   meta:
      description = "Detects backdoor BRICKSTEAL used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      $str1 = "comvmware"
      $str2 = "abcdABCD1234!@#$"
      $str3 = "ads.png"
      $str4 = "User-Agent"
      $str5 = "com/vmware/"
   condition:
      all of them and filesize < 10KB
}
YARA Detection Rule: MAL_G_Dropper_BRICKSTEAL_1
Repository: Neo23x0/signature-base
Detects: Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
$str1 = "Base64.getDecoder().decode"
      $str2 = "Thread.currentThread().getContextClassLoader()"
      $str3 = ".class.getDeclaredMethod"
      $str4 = "byte[].class"
      $str5 = "method.invoke"
      $str6 = "filterClass.newInstance()"
      $str7 = "/websso/SAML2/SSO/*"

Detection condition:
all of them

Full rule:
rule MAL_G_Dropper_BRICKSTEAL_1 {
   meta:
      description = "Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      $str1 = "Base64.getDecoder().decode"
      $str2 = "Thread.currentThread().getContextClassLoader()"
      $str3 = ".class.getDeclaredMethod"
      $str4 = "byte[].class"
      $str5 = "method.invoke"
      $str6 = "filterClass.newInstance()"
      $str7 = "/websso/SAML2/SSO/*"
   condition:
      all of them
}
YARA Detection Rule: MAL_G_Dropper_BRICKSTEAL_2
Repository: Neo23x0/signature-base
Detects: Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)
Author: Google Threat Intelligence Group (GTIG) (modified by Florian Roth)
Reference: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

Pattern signatures:
// $str1 = /\(Class<\?>\)\smethod\.invoke\(\w{1,20},\s\w{1,20},\s0,\s\w{1,20}\.length\);/i ascii wide
      $str1_alt = "(Class<?>) method.invoke(" ascii wide
      $str2 = "(\"yv66vg" ascii wide
      $str3 = "request.getSession().getServletContext" ascii wide
      $str4 = ".getClass().getDeclaredField(" ascii wide
      $str5 = "new FilterDef();" ascii wide
      $str6 = "new FilterMap();" ascii wide

Detection condition:
all of them

Full rule:
rule MAL_G_Dropper_BRICKSTEAL_2 {
   meta:
      description = "Detects backdoor BRICKSTEAL dropper used by APT group UNC5221 (China Nexus)"
      author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
      date = "2025-09-25"
      score = 75
      reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
   strings:
      // $str1 = /\(Class<\?>\)\smethod\.invoke\(\w{1,20},\s\w{1,20},\s0,\s\w{1,20}\.length\);/i ascii wide
      $str1_alt = "(Class<?>) method.invoke(" ascii wide
      $str2 = "(\"yv66vg" ascii wide
      $str3 = "request.getSession().getServletContext" ascii wide
      $str4 = ".getClass().getDeclaredField(" ascii wide
      $str5 = "new FilterDef();" ascii wide
      $str6 = "new FilterMap();" ascii wide
   condition:
      all of them
}
YARA Detection Rule: gen_excel_xor_obfuscation_velvetsweatshop
Repository: Neo23x0/signature-base
Detects: Detects XOR encryption (c. 2003) in Excel file formats
Author: @BouncyHat
Reference: https://twitter.com/JohnLaTwC/status/[PII_REDACTED]77452544

Pattern signatures:
$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
        $FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }

Detection condition:
uint32(0) == 0xe011cfd0 and 
        filesize < 400KB and 
        $olemarker at 0 and
        $FilePass_XOR_Obfuscation_VelvetSweatshop

Full rule:
rule gen_excel_xor_obfuscation_velvetsweatshop {
    meta:
        description = "Detects XOR encryption (c. 2003) in Excel file formats"
        license = "https://creativecommons.org/licenses/by-nc/4.0/"
        author = "@BouncyHat"
        contributed_by = "@JohnLaTwc"
        date = "2020-10-09"
        reference = "https://twitter.com/JohnLaTwC/status/[PII_REDACTED]77452544"
        reference0 = "https://twitter.com/BouncyHat/status/[PII_REDACTED]82042113"
        hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
        hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
        hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
        hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
        id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
    strings:
        $olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
        $FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
    condition:
        uint32(0) == 0xe011cfd0 and 
        filesize < 400KB and 
        $olemarker at 0 and
        $FilePass_XOR_Obfuscation_VelvetSweatshop
}
YARA Detection Rule: apt_ProjectSauron_pipe_backdoor
Repository: Neo23x0/signature-base
Detects: Rule to detect ProjectSauron pipe backdoors
Reference: https://securelist.com/blog/

Pattern signatures:
$a1 = "CreateNamedPipeW" fullword ascii
		$a2 = "SetSecurityDescriptorDacl" fullword ascii
		$a3 = "GetOverlappedResult" fullword ascii
		$a4 = "TerminateThread" fullword ascii
		$a5 = "%s%s%X" fullword wide

Detection condition:
uint16(0) == 0x5A4D
		and (all of ($a*))
		and filesize < 100000

Full rule:
rule apt_ProjectSauron_pipe_backdoor  {
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron pipe backdoors"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"
	strings:
		$a1 = "CreateNamedPipeW" fullword ascii
		$a2 = "SetSecurityDescriptorDacl" fullword ascii
		$a3 = "GetOverlappedResult" fullword ascii
		$a4 = "TerminateThread" fullword ascii
		$a5 = "%s%s%X" fullword wide
	condition:
		uint16(0) == 0x5A4D
		and (all of ($a*))
		and filesize < 100000
}
YARA Detection Rule: apt_ProjectSauron_encrypted_LSA
Repository: Neo23x0/signature-base
Detects: Rule to detect ProjectSauron encrypted LSA samples
Reference: https://securelist.com/blog/

Pattern signatures:
$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
	$a2 = "\\Device\\NdisRaw_" ascii
	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
	$a5 = "Missing function %S::#%d" fullword wide
	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C[PII_REDACTED]975C48955DCFF55FC8BF88D8F0000003A83F[PII_REDACTED]3DB53FF15}
	$a7 = {488D4C[PII_REDACTED]2450488D[PII_REDACTED][PII_REDACTED]2460488D4520C[PII_REDACTED]000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}

Detection condition:
uint16(0) == 0x5A4D
	and (any of ($a*) or
	(
		pe.exports("InitializeChangeNotify") and
		pe.exports("PasswordChangeNotify") and
		math.entropy(0x400, filesize) >= 7.5
	))
	and filesize < 1000000

Full rule:
rule apt_ProjectSauron_encrypted_LSA  {
meta:
	copyright = "Kaspersky Lab"
	description = "Rule to detect ProjectSauron encrypted LSA samples"
	version = "1.0"
	reference = "https://securelist.com/blog/"
	id = "f6fd8619-60f0-5c0d-aa66-cd0e154de63c"
strings:
	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
	$a2 = "\\Device\\NdisRaw_" ascii
	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
	$a5 = "Missing function %S::#%d" fullword wide
	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C[PII_REDACTED]975C48955DCFF55FC8BF88D8F0000003A83F[PII_REDACTED]3DB53FF15}
	$a7 = {488D4C[PII_REDACTED]2450488D[PII_REDACTED][PII_REDACTED]2460488D4520C[PII_REDACTED]000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
condition:
	uint16(0) == 0x5A4D
	and (any of ($a*) or
	(
		pe.exports("InitializeChangeNotify") and
		pe.exports("PasswordChangeNotify") and
		math.entropy(0x400, filesize) >= 7.5
	))
	and filesize < 1000000
}
YARA Detection Rule: apt_ProjectSauron_encrypted_SSPI
Repository: Neo23x0/signature-base
Detects: Rule to detect encrypted ProjectSauron SSPI samples
Reference: https://securelist.com/blog/

Detection condition:
uint16(0) == 0x5A4D and
	filesize < 1000000 and
	pe.exports("InitSecurityInterfaceA") and
	pe.characteristics & pe.DLL and
	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
	math.entropy(0x400, filesize) >= 7.5

Full rule:
rule apt_ProjectSauron_encrypted_SSPI  {
meta:
	copyright = "Kaspersky Lab"
	description = "Rule to detect encrypted ProjectSauron SSPI samples"
	version = "1.0"
	reference = "https://securelist.com/blog/"
	id = "43c0e772-46d2-510e-bea1-6f505199f38c"
condition:
	uint16(0) == 0x5A4D and
	filesize < 1000000 and
	pe.exports("InitSecurityInterfaceA") and
	pe.characteristics & pe.DLL and
	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
	math.entropy(0x400, filesize) >= 7.5
}