deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PUA_VULN_Driver_Lowleveldriver_F941
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription LowLevelDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* ProductName LowLevelDriver */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]29002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightcAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule PUA_VULN_Driver_Lowleveldriver_F941 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
		date = "2024-08-07"
		score = 40
		id = "a65168c0-5f0e-5871-867b-bab6f42b3c21"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription LowLevelDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* ProductName LowLevelDriver */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]29002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightcAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_5439
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e00360033 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_5439 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
		date = "2024-08-07"
		score = 40
		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e00360033 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_DE8F
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_DE8F {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
		date = "2024-08-07"
		score = 40
		id = "245da08c-d629-53cb-83fb-476f4fdd1512"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: NotPetya_Ransomware_Jun17
Repository: Neo23x0/signature-base
Detects: Detects new NotPetya Ransomware variant from June 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/h6iaGj

Pattern signatures:
$x1 = "Ooops, your important files are encrypted." fullword wide ascii
      $x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
      $x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
      $x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
      $x5 = "fsutil usn deletejournal /D %c:" fullword wide
      $x6 = "wevtutil cl Setup & wevtutil cl System" ascii
      /* ,#1 ..... rundll32.exe */
      $x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }

      $s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
      $s4 = "\\\\.\\pipe\\%ws" fullword wide
      $s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
      $s6 = "u%s \\\\%s -accepteula -s " fullword wide
      $s7 = "dllhost.dat" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule NotPetya_Ransomware_Jun17 {
   meta:
      description = "Detects new NotPetya Ransomware variant from June 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/h6iaGj"
      date = "2017-06-27"
      hash1 = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
      hash2 = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
      hash3 = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
      id = "8805f971-0680-534d-9955-65dc4ecc934a"
   strings:
      $x1 = "Ooops, your important files are encrypted." fullword wide ascii
      $x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
      $x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
      $x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
      $x5 = "fsutil usn deletejournal /D %c:" fullword wide
      $x6 = "wevtutil cl Setup & wevtutil cl System" ascii
      /* ,#1 ..... rundll32.exe */
      $x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }

      $s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
      $s4 = "\\\\.\\pipe\\%ws" fullword wide
      $s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
      $s6 = "u%s \\\\%s -accepteula -s " fullword wide
      $s7 = "dllhost.dat" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: APTGroupX_PlugXTrojanLoader_StringDecode
Repository: Neo23x0/signature-base
Detects: Rule to detect PlugX Malware
Author: Jay DiMartino
Reference: https://t.co/4xQ8G2mNap

Pattern signatures:
$byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
      $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }

Detection condition:
any of them

Full rule:
rule APTGroupX_PlugXTrojanLoader_StringDecode {
   meta:
      author = "Jay DiMartino"
   	description = "Rule to detect PlugX Malware"
		score = 80
   	reference = "https://t.co/4xQ8G2mNap"
      hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
      hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
      hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
      hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
      hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
      hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
      hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
      hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
      hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
      hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
      hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
      hash12 = "aa[PII_REDACTED]af2e1b127608040aa3ef6e118a13"
      hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
      hash14 = "c9b3d2cef3b34c7ee18fc2f60ff[PII_REDACTED]13d"
      hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
      hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
      hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
      hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
      hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
      hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
      hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
      hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
      id = "c6017327-b44d-5b1d-95aa-6e1f9fbf5583"
   strings:
      $byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
      $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
   condition:
      any of them
}
YARA Detection Rule: RottenPotato_Potato
Repository: Neo23x0/signature-base
Detects: Detects a component of privilege escalation tool Rotten Potato - file Potato.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/foxglovesec/RottenPotato

Pattern signatures:
$x1 = "Potato.exe -ip <ip>" fullword wide
      $x2 = "-enable_httpserver true -enable_spoof true" fullword wide
      $x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
      $x4 = "-enable_token true -enable_dce true" fullword wide
      $x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
      $x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
      $x7 = "\\obj\\Release\\Potato.pdb" ascii
      $x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide

      $s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 2 of them )

Full rule:
rule RottenPotato_Potato {
   meta:
      description = "Detects a component of privilege escalation tool Rotten Potato - file Potato.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/foxglovesec/RottenPotato"
      date = "2017-02-07"
      modified = "2022-12-21"
      score = 90
      hash1 = "59cdbb21d9e487ca[PII_REDACTED]2f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
      id = "4a12783c-f58a-518b-a80a-f09f146304cc"
   strings:
      $x1 = "Potato.exe -ip <ip>" fullword wide
      $x2 = "-enable_httpserver true -enable_spoof true" fullword wide
      $x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
      $x4 = "-enable_token true -enable_dce true" fullword wide
      $x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
      $x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
      $x7 = "\\obj\\Release\\Potato.pdb" ascii
      $x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide

      $s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 2 of them )
}
YARA Detection Rule: Shellcode_APIHashing_FIN8
Repository: Neo23x0/signature-base
Detects: Detects FIN8 Shellcode APIHashing
Author: Frank Boldewin (@r3c0nst)
Reference: https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf

Pattern signatures:
$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB} 
		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E} 
		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4} 
		
		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21} 
		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}

Detection condition:
all of ($APIHashing32bit*) or all of ($APIHashing64bit*)

Full rule:
rule Shellcode_APIHashing_FIN8 {
	meta:
		description = "Detects FIN8 Shellcode APIHashing"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2021-03-16"
		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"

		id = "bca5601c-2998-545b-8dd0-ec3c861e6291"
	strings:
		$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB} 
		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E} 
		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4} 
		
		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21} 
		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}
		
	condition:
		all of ($APIHashing32bit*) or all of ($APIHashing64bit*)
}
YARA Detection Rule: MAL_RANSOM_Lorenz_May21_1
Repository: Neo23x0/signature-base
Detects: Detects Lorenz Ransomware samples
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - DACH TE

Pattern signatures:
$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
      $x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
      
      $s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
      $s2 = "twr.ini" ascii fullword
      $s3 = "/c wmic /node:'" ascii fullword

      $op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
      $op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 4000KB and (
         1 of ($x*) or 
         all of ($op*) 
         or 3 of them
      )

Full rule:
rule MAL_RANSOM_Lorenz_May21_1 {
   meta:
      description = "Detects Lorenz Ransomware samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - DACH TE"
      date = "2021-05-04"
      hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
      hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b[PII_REDACTED]40d1"
      hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
      id = "0b18a4a3-82da-574b-8d10-daf2176448b9"
   strings:
      $x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
      $x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
      
      $s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
      $s2 = "twr.ini" ascii fullword
      $s3 = "/c wmic /node:'" ascii fullword

      $op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
      $op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 4000KB and (
         1 of ($x*) or 
         all of ($op*) 
         or 3 of them
      ) 
}
YARA Detection Rule: LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup
Author: Florian Roth (Nextron Systems)
Reference: https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/

Pattern signatures:
$x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
      $x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii

Detection condition:
1 of them

Full rule:
rule LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG {
   meta:
      description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
      date = "2021-03-20"
      score = 80
      id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"
   strings:
      $x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
      $x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii
   condition:
      1 of them
}
YARA Detection Rule: SUSP_Email_Suspicious_OneNote_Attachment_Jan23_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
/* OneNote FileDataStoreObject GUID https://blog.didierstevens.com/ */
      $ge1 = "5xbjvWUmEUWkxI1NC3qer"
      $ge2 = "cW471lJhFFpMSNTQt6nq"
      $ge3 = "nFuO9ZSYRRaTEjU0Lep6s"

      /* PE file DOS header */
      $sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
      $sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
      $sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
      $sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
      $sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
      $sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
      /* @echo off */
      $se1 = "QGVjaG8gb2Zm"
      $se2 = "BlY2hvIG9mZ"
      $se3 = "AZWNobyBvZm"
      /* <HTA:APPLICATION */
      $se4 = "PEhUQTpBUFBMSUNBVElPTi"
      $se5 = "xIVEE6QVBQTElDQVRJT04g"
      $se6 = "8SFRBOkFQUExJQ0FUSU9OI"
      /* LNK file magic header */
      $se7 = "TAAAAAEUAg"
      $se8 = "wAAAABFAIA"
      $se9 = "MAAAAARQCA"

Detection condition:
filesize < 5MB
      and 1 of ($ge*)
      and 1 of ($s*)

Full rule:
rule SUSP_Email_Suspicious_OneNote_Attachment_Jan23_1 {
   meta:
      description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2023-01-27"
      score = 65
      id = "492b74c2-3b81-5dff-9[PII_REDACTED]338c6"
   strings:
      /* OneNote FileDataStoreObject GUID https://blog.didierstevens.com/ */
      $ge1 = "5xbjvWUmEUWkxI1NC3qer"
      $ge2 = "cW471lJhFFpMSNTQt6nq"
      $ge3 = "nFuO9ZSYRRaTEjU0Lep6s"

      /* PE file DOS header */
      $sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
      $sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
      $sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
      $sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
      $sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
      $sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
      /* @echo off */
      $se1 = "QGVjaG8gb2Zm"
      $se2 = "BlY2hvIG9mZ"
      $se3 = "AZWNobyBvZm"
      /* <HTA:APPLICATION */
      $se4 = "PEhUQTpBUFBMSUNBVElPTi"
      $se5 = "xIVEE6QVBQTElDQVRJT04g"
      $se6 = "8SFRBOkFQUExJQ0FUSU9OI"
      /* LNK file magic header */
      $se7 = "TAAAAAEUAg"
      $se8 = "wAAAABFAIA"
      $se9 = "MAAAAARQCA"
   condition:
      filesize < 5MB
      and 1 of ($ge*)
      and 1 of ($s*)
}