deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Toolset_sig_1433_135_sqlr
Repository: Neo23x0/signature-base
Detects: Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe
Author: Florian Roth (Nextron Systems)
Reference: http://qiannao.com/ls/905300366/33834c0c/

Pattern signatures:
$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
      $s11 = ";DATABASE=master" fullword ascii
      $s12 = "xp_cmdshell '" fullword ascii
      $s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii

Detection condition:
all of them

Full rule:
rule CN_Toolset_sig_1433_135_sqlr {
   meta:
      description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://qiannao.com/ls/905300366/33834c0c/"
      date = "2015/03/30"
      score = 70
      hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
      id = "74038975-ef06-53d6-bdcc-02706408b596"
   strings:
      $s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
      $s11 = ";DATABASE=master" fullword ascii
      $s12 = "xp_cmdshell '" fullword ascii
      $s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
   condition:
      all of them
}
YARA Detection Rule: DarkComet_Keylogger_File
Repository: Neo23x0/signature-base
Detects: Looks like a keylogger file created by DarkComet Malware
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$entry = /\n:: [A-Z]/
      $timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/

Detection condition:
uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10

Full rule:
rule DarkComet_Keylogger_File {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      description = "Looks like a keylogger file created by DarkComet Malware"
      date = "25.07.14"
      score = 50
      id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
   strings:
      $entry = /\n:: [A-Z]/
      $timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
   condition:
      uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10
}
YARA Detection Rule: VSSown_VBS
Repository: Neo23x0/signature-base
Detects: Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
      $s1 = "Select * From Win32_ShadowCopy" ascii
      $s2 = "cmd /C mklink /D " ascii
      $s3 = "ClientAccessible" ascii
      $s4 = "WScript.Shell" ascii
      $s5 = "Win32_Process" ascii

Detection condition:
all of them

Full rule:
rule VSSown_VBS {
   meta:
      description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2015-10-01"
      score = 75
      id = "ffbb5faf-3522-50dc-a568-503074ac0636"
   strings:
      $s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
      $s1 = "Select * From Win32_ShadowCopy" ascii
      $s2 = "cmd /C mklink /D " ascii
      $s3 = "ClientAccessible" ascii
      $s4 = "WScript.Shell" ascii
      $s5 = "Win32_Process" ascii
   condition:
      all of them
}
YARA Detection Rule: Netview_Hacktool
Repository: Neo23x0/signature-base
Detects: Network domain enumeration tool - often used by attackers - file Nv.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/mubix/netview

Pattern signatures:
$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
      $s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
      $s3 = "[*] -i used without interval specified - ignoring" fullword ascii
      $s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
      $s5 = "[+] %ws - Backup Domain Controller" fullword wide
      $s6 = "[-] %ls - Share - Error: %ld" fullword wide
      $s7 = "[-] %ls - Session - Error: %ld" fullword wide
      $s8 = "[+] %s - OS Version - %d.%d" fullword ascii
      $s9 = "Enumerating Logged-on Users" fullword ascii
      $s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 500KB and 2 of them) or 3 of them

Full rule:
rule Netview_Hacktool {
   meta:
      description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/mubix/netview"
      date = "2016-03-07"
      score = 60
      hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
      id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"
   strings:
      $s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
      $s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
      $s3 = "[*] -i used without interval specified - ignoring" fullword ascii
      $s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
      $s5 = "[+] %ws - Backup Domain Controller" fullword wide
      $s6 = "[-] %ls - Share - Error: %ld" fullword wide
      $s7 = "[-] %ls - Session - Error: %ld" fullword wide
      $s8 = "[+] %s - OS Version - %d.%d" fullword ascii
      $s9 = "Enumerating Logged-on Users" fullword ascii
      $s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 500KB and 2 of them) or 3 of them
}
YARA Detection Rule: Netview_Hacktool_Output
Repository: Neo23x0/signature-base
Detects: Network domain enumeration tool output - often used by attackers - file filename.txt
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/mubix/netview

Pattern signatures:
$s1 = "[*] Using interval:" fullword
      $s2 = "[*] Using jitter:" fullword
      $s3 = "[+] Number of hosts:" fullword

Detection condition:
2 of them

Full rule:
rule Netview_Hacktool_Output {
   meta:
      description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/mubix/netview"
      date = "2016-03-07"
      score = 60
      id = "259db870-6293-5a55-b56a-f981c060c18f"
   strings:
      $s1 = "[*] Using interval:" fullword
      $s2 = "[*] Using jitter:" fullword
      $s3 = "[+] Number of hosts:" fullword
   condition:
      2 of them
}
YARA Detection Rule: PSAttack_EXE
Repository: Neo23x0/signature-base
Detects: PSAttack - Powershell attack tool - file PSAttack.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/gdssecurity/PSAttack/releases/

Pattern signatures:
$x1 = "\\Release\\PSAttack.pdb"

      $s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
      $s2 = "PSAttack.Modules." ascii
      $s3 = "PSAttack.PSAttackProcessing" fullword ascii
      $s4 = "PSAttack.Modules.key.txt" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and ($x1 or 2 of ($s*))) or 3 of them

Full rule:
rule PSAttack_EXE {
   meta:
      description = "PSAttack - Powershell attack tool - file PSAttack.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/gdssecurity/PSAttack/releases/"
      date = "2016-03-09"
      modified = "2023-01-06"
      score = 100
      hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
      id = "87f7956a-f607-5e14-a[PII_REDACTED]cf682"
   strings:
      $x1 = "\\Release\\PSAttack.pdb"

      $s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
      $s2 = "PSAttack.Modules." ascii
      $s3 = "PSAttack.PSAttackProcessing" fullword ascii
      $s4 = "PSAttack.Modules.key.txt" fullword wide
   condition:
      (uint16(0) == 0x5a4d and ($x1 or 2 of ($s*))) or 3 of them
}
YARA Detection Rule: Powershell_Attack_Scripts
Repository: Neo23x0/signature-base
Detects: Powershell Attack Scripts
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
      $s2 = "Nishang\\Do-Exfiltration.ps1" ascii
      $s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
      $s4 = "Inveigh\\Inveigh.ps1" ascii

Detection condition:
1 of them

Full rule:
rule Powershell_Attack_Scripts {
   meta:
      description = "Powershell Attack Scripts"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2016-03-09"
      score = 70
      id = "e8c4a672-229b-56c8-811b-071ae9ff341e"
   strings:
      $s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
      $s2 = "Nishang\\Do-Exfiltration.ps1" ascii
      $s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
      $s4 = "Inveigh\\Inveigh.ps1" ascii
   condition:
      1 of them
}
YARA Detection Rule: PSAttack_ZIP
Repository: Neo23x0/signature-base
Detects: PSAttack - Powershell attack tool - file PSAttack.zip
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/gdssecurity/PSAttack/releases/

Pattern signatures:
$s0 = "PSAttack.exe" fullword ascii

Detection condition:
uint16(0) == 0x4b50 and all of them

Full rule:
rule PSAttack_ZIP {
   meta:
      description = "PSAttack - Powershell attack tool - file PSAttack.zip"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/gdssecurity/PSAttack/releases/"
      date = "2016-03-09"
      score = 100
      hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
      id = "4e064eb4-0b87-590c-9ee4-6764b982c006"
   strings:
      $s0 = "PSAttack.exe" fullword ascii
   condition:
      uint16(0) == 0x4b50 and all of them
}
YARA Detection Rule: Linux_Portscan_Shark_1
Repository: Neo23x0/signature-base
Detects: Detects Linux Port Scanner Shark
Author: Florian Roth (Nextron Systems)
Reference: Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35

Pattern signatures:
$s0 = "rm -rf scan.log session.txt" fullword ascii
      $s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
      $s18 = "*** stack smashing detected ***: %s terminated" fullword ascii

Detection condition:
(uint16(0) == 0x7362 and all of them)

Full rule:
rule Linux_Portscan_Shark_1 {
   meta:
      description = "Detects Linux Port Scanner Shark"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
      date = "2016-04-01"
      super_rule = 1
      hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
      hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
      id = "0b[PII_REDACTED]-56f4-9e8c-68f3756af07d"
   strings:
      $s0 = "rm -rf scan.log session.txt" fullword ascii
      $s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
      $s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
   condition:
      (uint16(0) == 0x7362 and all of them)
}
YARA Detection Rule: Linux_Portscan_Shark_2
Repository: Neo23x0/signature-base
Detects: Detects Linux Port Scanner Shark
Author: Florian Roth (Nextron Systems)
Reference: Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35

Pattern signatures:
$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
      $s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
      $s3 = "rm -rf scan.log" fullword ascii

Detection condition:
all of them

Full rule:
rule Linux_Portscan_Shark_2 {
   meta:
      description = "Detects Linux Port Scanner Shark"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
      date = "2016-04-01"
      super_rule = 1
      hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c[PII_REDACTED]def986"
      hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a[PII_REDACTED]8a64d8d8558"
      id = "eea378d5-0399-5035-8573-139878fa1abc"
   strings:
      $s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
      $s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
      $s3 = "rm -rf scan.log" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: dnscat2_Hacktool
Repository: Neo23x0/signature-base
Detects: Detects dnscat2 - from files dnscat, dnscat2.exe
Author: Florian Roth (Nextron Systems)
Reference: https://downloads.skullsecurity.org/dnscat2/

Pattern signatures:
$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
      $s2 = "Sawlog" fullword ascii
      $s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
      $s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
      $s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii

Detection condition:
((uint16(0) == 0x457f or uint16(0) == 0x5a4d) and filesize < 400KB and (2 of ($s*))) or (all of them)

Full rule:
rule dnscat2_Hacktool {
   meta:
      description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://downloads.skullsecurity.org/dnscat2/"
      date = "2016-05-15"
      super_rule = 1
      hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
      hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
      id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"
   strings:
      $s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
      $s2 = "Sawlog" fullword ascii
      $s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
      $s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
      $s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
   condition:
      ((uint16(0) == 0x457f or uint16(0) == 0x5a4d) and filesize < 400KB and (2 of ($s*))) or (all of them)
}
YARA Detection Rule: WCE_in_memory
Repository: Neo23x0/signature-base
Detects: Detects Windows Credential Editor (WCE) in memory (and also on disk)
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
      $s2 = "wceaux.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule WCE_in_memory {
   meta:
      description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      score = 80
      date = "2016-08-28"
      id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"
   strings:
      $s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
      $s2 = "wceaux.dll" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: pstgdump
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - file pstgdump.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "\\Release\\pstgdump.pdb" ascii
      $x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
      $x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
      $x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
      $x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
      $x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*)) or (3 of them)

Full rule:
rule pstgdump {
   meta:
      description = "Detects a tool used by APT groups - file pstgdump.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      hash1 = "65d48a2f868ff5757c10ed796e[PII_REDACTED]4c523c71eac1c5e044862893a106"
      id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"
   strings:
      $x1 = "\\Release\\pstgdump.pdb" ascii
      $x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
      $x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
      $x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
      $x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
      $x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*)) or (3 of them)
}
YARA Detection Rule: lsremora
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "Target: Failed to load primary SAM functions." fullword ascii
      $x2 = "lsremora64.dll" fullword ascii
      $x3 = "PwDumpError:999999" fullword wide
      $x4 = "PwDumpError" fullword wide
      $x5 = "lsremora.dll" fullword ascii

      $s1 = ":\\\\.\\pipe\\%s" fullword ascii
      $s2 = "x%s_history_%d:%d" fullword wide
      $s3 = "Using pipe %s" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*)) or (3 of them)

Full rule:
rule lsremora {
   meta:
      description = "Detects a tool used by APT groups"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
      hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
      id = "c15c583f-70cd-5a80-bdea-a14582097e50"
   strings:
      $x1 = "Target: Failed to load primary SAM functions." fullword ascii
      $x2 = "lsremora64.dll" fullword ascii
      $x3 = "PwDumpError:999999" fullword wide
      $x4 = "PwDumpError" fullword wide
      $x5 = "lsremora.dll" fullword ascii

      $s1 = ":\\\\.\\pipe\\%s" fullword ascii
      $s2 = "x%s_history_%d:%d" fullword wide
      $s3 = "Using pipe %s" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*)) or (3 of them)
}
YARA Detection Rule: servpw
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - file servpw.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$s1 = "Unable to open target process: %d, pid %d" fullword ascii
      $s2 = "LSASS.EXE" fullword wide
      $s3 = "WriteProcessMemory failed: %d" fullword ascii
      $s4 = "lsremora64.dll" fullword ascii
      $s5 = "CreateRemoteThread failed: %d" fullword ascii
      $s6 = "Thread code: %d, path: %s" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 3 of them) or (all of them)

Full rule:
rule servpw {
   meta:
      description = "Detects a tool used by APT groups - file servpw.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
      hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
      id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"
   strings:
      $s1 = "Unable to open target process: %d, pid %d" fullword ascii
      $s2 = "LSASS.EXE" fullword wide
      $s3 = "WriteProcessMemory failed: %d" fullword ascii
      $s4 = "lsremora64.dll" fullword ascii
      $s5 = "CreateRemoteThread failed: %d" fullword ascii
      $s6 = "Thread code: %d, path: %s" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 3 of them) or (all of them)
}
YARA Detection Rule: fgexec
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - file fgexec.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "\\Release\\fgexec.pdb" ascii
      $x2 = "fgexec Remote Process Execution Tool" fullword ascii
      $x3 = "fgexec CallNamedPipe failed" fullword ascii
      $x4 = "fizzgig and the mighty foofus.net team" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*)) or (3 of them)

Full rule:
rule fgexec {
   meta:
      description = "Detects a tool used by APT groups - file fgexec.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
      id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"
   strings:
      $x1 = "\\Release\\fgexec.pdb" ascii
      $x2 = "fgexec Remote Process Execution Tool" fullword ascii
      $x3 = "fgexec CallNamedPipe failed" fullword ascii
      $x4 = "fizzgig and the mighty foofus.net team" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*)) or (3 of them)
}