deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: pos_malwre_dexter_stardust
Repository: Yara-Rules/rules
Detects: Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf
Author: @patrickrolsen
Reference: 16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658

Pattern signatures:
$s1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
	$s2 = "Yatoed3fe3rex23030am39497403"
	$s3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
	$s4 = "CommonFile.exe"

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule pos_malwre_dexter_stardust
{
meta:
	author = "@patrickrolsen"
	maltype = "Dexter Malware - StarDust Variant"
	version = "0.1"
	description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
	reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
	date = "12/30/2013"
strings:
	$s1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
	$s2 = "Yatoed3fe3rex23030am39497403"
	$s3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
	$s4 = "CommonFile.exe"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: pos_malware_project_hook
Repository: Yara-Rules/rules
Detects: Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf
Author: @patrickrolsen
Reference: 759154d20849a25315c4970fe37eac59

Pattern signatures:
$s1 = "CallImage.exe"
	$s2 = "BurpSwim"
	$s3 = "Work\\Project\\Load"
	$s4 = "WortHisnal"

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule pos_malware_project_hook
{
meta:
	author = "@patrickrolsen"
	maltype = "Project Hook"
	version = "0.1"
	description = "Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
	reference = "759154d20849a25315c4970fe37eac59"
	date = "12/30/2013"
strings:
	$s1 = "CallImage.exe"
	$s2 = "BurpSwim"
	$s3 = "Work\\Project\\Load"
	$s4 = "WortHisnal"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: pdb_strings_Rescator
Repository: Yara-Rules/rules
Detects: Rescator PDB strings within binaries
Author: @patrickrolsen

Pattern signatures:
$pdb1 = "\\Projects\\Rescator" nocase

Detection condition:
uint16(0) == 0x5A4D and $pdb1

Full rule:
rule pdb_strings_Rescator
{
meta:
	author = "@patrickrolsen"
	maltype = "Target Attack"
	version = "0.3"
	description = "Rescator PDB strings within binaries"
	date = "01/30/2014"
strings:
	$pdb1 = "\\Projects\\Rescator" nocase
condition:
	uint16(0) == 0x5A4D and $pdb1
}
YARA Detection Rule: pos_uploader
Repository: Yara-Rules/rules
Detects: Testing the base64 encoded file in sys32
Author: @patrickrolsen
Reference: http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware

Pattern signatures:
$s1 = "cmd /c net start %s"
	$s2 = "ftp -s:%s"
	$s3 = "data_%d_%d_%d_%d_%d.txt"
	$s4 = "\\uploader\\"

Detection condition:
uint16(0) == 0x5A4D and all of ($s*)

Full rule:
rule pos_uploader
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware"
    reference = "http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware"
	version = "0.1"
	description = "Testing the base64 encoded file in sys32"
	date = "01/30/2014"
strings:
	$s1 = "cmd /c net start %s"
	$s2 = "ftp -s:%s"
	$s3 = "data_%d_%d_%d_%d_%d.txt"
	$s4 = "\\uploader\\"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}
YARA Detection Rule: winxml_dll
Repository: Yara-Rules/rules
Detects: Testing the base64 encoded file in sys32
Author: @patrickrolsen
Reference: ce0296e2d77ec3bb112e270fc260f274

Pattern signatures:
$s1 = "\\system32\\winxml.dll"
	//$s2 = "cmd /c net start %s"
	//$s3 = "=== pid:"
	//$s4 = "GOTIT"
	//$s5 = ".memdump"
	//$s6 = "POSWDS"

Detection condition:
uint16(0) == 0x5A4D and (all of ($s*))

Full rule:
rule winxml_dll
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware"
    reference = "ce0296e2d77ec3bb112e270fc260f274"
	version = "0.1"
	description = "Testing the base64 encoded file in sys32"
	date = "01/30/2014"
strings:
	$s1 = "\\system32\\winxml.dll"
	//$s2 = "cmd /c net start %s"
	//$s3 = "=== pid:"
	//$s4 = "GOTIT"
	//$s5 = ".memdump"
	//$s6 = "POSWDS"
condition:
	uint16(0) == 0x5A4D and (all of ($s*))
}
YARA Detection Rule: pos_chewbacca
Repository: Yara-Rules/rules
Detects: Testing the base64 encoded file in sys32
Author: @patrickrolsen
Reference: https://www.securelist.com/en/blog/208214185/ChewBacca_a_new_episode_of_Tor_based_Malware

Pattern signatures:
$s1 = "tor -f <torrc>"
	$s2 = "tor_"
	$s3 = "umemscan"
	$s4 = "CHEWBAC"

Detection condition:
uint16(0) == 0x5A4D and (all of ($s*))

Full rule:
rule pos_chewbacca
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware"
    reference = "https://www.securelist.com/en/blog/208214185/ChewBacca_a_new_episode_of_Tor_based_Malware"
    hashes = "21f8b9d9a6fa3a0cd3a3f0644636bf09, 28bc48ac4a92bde15945afc0cee0bd54"
	version = "0.2"
	description = "Testing the base64 encoded file in sys32"
	date = "01/30/2014"
strings:
	$s1 = "tor -f <torrc>"
	$s2 = "tor_"
	$s3 = "umemscan"
	$s4 = "CHEWBAC"
condition:
	uint16(0) == 0x5A4D and (all of ($s*))
}
YARA Detection Rule: Backdoored_ssh
Repository: Yara-Rules/rules
Threat actor: Energetic Bear/Crouching Yeti
Author: Kaspersky
Reference: https://securelist.com/energetic-bear-crouching-yeti/85345/

Pattern signatures:
$a1 = "OpenSSH"
$a2 = "usage: ssh"
$a3 = "HISTFILE"

Detection condition:
uint32(0) == 0x464c457f and filesize<1000000 and all of ($a*)

Full rule:
rule Backdoored_ssh {
meta:
author = "Kaspersky"
reference = "https://securelist.com/energetic-bear-crouching-yeti/85345/"
actor = "Energetic Bear/Crouching Yeti"
strings:
$a1 = "OpenSSH"
$a2 = "usage: ssh"
$a3 = "HISTFILE"
condition:
uint32(0) == 0x464c457f and filesize<1000000 and all of ($a*)
}
YARA Detection Rule: bin_ndisk
Repository: Yara-Rules/rules
Detects: Hacking Team Disclosure Sample - file ndisk.sys
Author: Florian Roth
Reference: https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/[PII_REDACTED]/

Pattern signatures:
$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
        $s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
        $s3 = "\\Driver\\DeepFrz" fullword wide
        $s4 = "Microsoft Kernel Disk Manager" fullword wide
        $s5 = "ndisk.sys" fullword wide
        $s6 = "\\Device\\MSH4DEV1" fullword wide
        $s7 = "\\DosDevices\\MSH4DEV1" fullword wide
        $s8 = "built by: WinDDK" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and 6 of them

Full rule:
rule bin_ndisk  
{
    
    meta:
        description = "Hacking Team Disclosure Sample - file ndisk.sys"
        author = "Florian Roth"
        reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/[PII_REDACTED]/"
        date = "2015-07-07"
        hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
    
    strings:
        $s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
        $s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
        $s3 = "\\Driver\\DeepFrz" fullword wide
        $s4 = "Microsoft Kernel Disk Manager" fullword wide
        $s5 = "ndisk.sys" fullword wide
        $s6 = "\\Device\\MSH4DEV1" fullword wide
        $s7 = "\\DosDevices\\MSH4DEV1" fullword wide
        $s8 = "built by: WinDDK" fullword wide
    
    condition:
        uint16(0) == 0x5a4d and filesize < 30KB and 6 of them
}
YARA Detection Rule: Hackingteam_Elevator_DLL
Repository: Yara-Rules/rules
Detects: Hacking Team Disclosure Sample - file elevator.dll
Author: Florian Roth
Reference: http://t.co/EG0qtVcKLh

Pattern signatures:
$s1 = "\\sysnative\\CI.dll" fullword ascii
        $s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
        $s3 = "mitmproxy0" fullword ascii
        $s4 = "\\insert_cert.exe" fullword ascii
        $s5 = "elevator.dll" fullword ascii
        $s6 = "CRTDLL.DLL" fullword ascii
        $s7 = "fail adding cert" fullword ascii
        $s8 = "DownloadingFile" fullword ascii
        $s9 = "fail adding cert: %s" fullword ascii
        $s10 = "InternetOpenA fail" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them

Full rule:
rule Hackingteam_Elevator_DLL 
{

    meta:
        description = "Hacking Team Disclosure Sample - file elevator.dll"
        author = "Florian Roth"
        reference = "http://t.co/EG0qtVcKLh"
        date = "2015-07-07"
        hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
   
    strings:
        $s1 = "\\sysnative\\CI.dll" fullword ascii
        $s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
        $s3 = "mitmproxy0" fullword ascii
        $s4 = "\\insert_cert.exe" fullword ascii
        $s5 = "elevator.dll" fullword ascii
        $s6 = "CRTDLL.DLL" fullword ascii
        $s7 = "fail adding cert" fullword ascii
        $s8 = "DownloadingFile" fullword ascii
        $s9 = "fail adding cert: %s" fullword ascii
        $s10 = "InternetOpenA fail" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them
}
YARA Detection Rule: HackingTeam_Elevator_EXE
Repository: Yara-Rules/rules
Detects: Hacking Team Disclosure Sample - file elevator.exe
Author: Florian Roth
Reference: Hacking Team Disclosure elevator.c

Pattern signatures:
$x1 = "CRTDLL.DLL" fullword ascii
        $x2 = "\\sysnative\\CI.dll" fullword ascii
        $x3 = "\\SystemRoot\\system32\\CI.dll" fullword ascii
        $x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
        $s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
        $s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
        $s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
        $s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "elevator.obj" fullword ascii
        $s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)

Full rule:
rule HackingTeam_Elevator_EXE 
{

    meta:
        description = "Hacking Team Disclosure Sample - file elevator.exe"
        author = "Florian Roth"
        reference = "Hacking Team Disclosure elevator.c"
        date = "2015-07-07"
        hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b[PII_REDACTED]3791671c1c"
        hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
        hash = "9261693b67b6e379ad0e[PII_REDACTED]2b8508998c0cb012ca23139212ae0009a1"

    strings:
        $x1 = "CRTDLL.DLL" fullword ascii
        $x2 = "\\sysnative\\CI.dll" fullword ascii
        $x3 = "\\SystemRoot\\system32\\CI.dll" fullword ascii
        $x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
        $s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
        $s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
        $s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
        $s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "elevator.obj" fullword ascii
        $s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */
   
    condition:
        uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)
}
YARA Detection Rule: RCS_Backdoor
Repository: Yara-Rules/rules
Detects: Hacking Team RCS Backdoor
Author: botherder https://github.com/botherder

Pattern signatures:
$filter1 = "$debug3"
        $filter2 = "$log2"
        $filter3 = "error2"
        $debug1 = /\- (C)hecking components/ wide ascii
        $debug2 = /\- (A)ctivating hiding system/ wide ascii
        $debug3 = /(f)ully operational/ wide ascii
        $log1 = /\- Browser activity \(FF\)/ wide ascii
        $log2 = /\- Browser activity \(IE\)/ wide ascii
        // Cause false positives.
        //$log3 = /\- About to call init routine at %p/ wide ascii
        //$log4 = /\- Calling init routine at %p/ wide ascii
        $error1 = /\[Unable to deploy\]/ wide ascii
        $error2 = /\[The system is already monitored\]/ wide ascii

Detection condition:
(2 of ($debug*) or 2 of ($log*) or all of ($error*)) and not any of ($filter*)

Full rule:
rule RCS_Backdoor
{
    
    meta:
        description = "Hacking Team RCS Backdoor"
        author = "botherder https://github.com/botherder"

    strings:
        $filter1 = "$debug3"
        $filter2 = "$log2"
        $filter3 = "error2"
        $debug1 = /\- (C)hecking components/ wide ascii
        $debug2 = /\- (A)ctivating hiding system/ wide ascii
        $debug3 = /(f)ully operational/ wide ascii
        $log1 = /\- Browser activity \(FF\)/ wide ascii
        $log2 = /\- Browser activity \(IE\)/ wide ascii
        // Cause false positives.
        //$log3 = /\- About to call init routine at %p/ wide ascii
        //$log4 = /\- Calling init routine at %p/ wide ascii
        $error1 = /\[Unable to deploy\]/ wide ascii
        $error2 = /\[The system is already monitored\]/ wide ascii

    condition:
        (2 of ($debug*) or 2 of ($log*) or all of ($error*)) and not any of ($filter*)
}
YARA Detection Rule: RCS_Scout
Repository: Yara-Rules/rules
Detects: Hacking Team RCS Scout
Author: botherder https://github.com/botherder

Pattern signatures:
$filter1 = "$engine5"
        $filter2 = "$start4"
        $filter3 = "$upd2"
        $filter4 = "$lookma6"

        $engine1 = /(E)ngine started/ wide ascii
        $engine2 = /(R)unning in background/ wide ascii
        $engine3 = /(L)ocking doors/ wide ascii
        $engine4 = /(R)otors engaged/ wide ascii
        $engine5 = /(I)\'m going to start it/ wide ascii

        $start1 = /Starting upgrade\!/ wide ascii
        $start2 = /(I)\'m going to start the program/ wide ascii
        $start3 = /(i)s it ok\?/ wide ascii
        $start4 = /(C)lick to start the program/ wide ascii

        $upd1 = /(U)pdJob/ wide ascii
        $upd2 = /(U)pdTimer/ wide ascii

        $lookma1 = /(O)wning PCI bus/ wide
        $lookma2 = /(F)ormatting bios/ wide
        $lookma3 = /(P)lease insert a disk in drive A:/ wide
        $lookma4 = /(U)pdating CPU microcode/ wide
        $lookma5 = /(N)ot sure what's happening/ wide
        $lookma6 = /(L)ook ma, no thread id\! \\\\o\// wide

Detection condition:
(all of ($engine*) or all of ($start*) or all of ($upd*) or 4 of ($lookma*)) and not any of ($filter*)

Full rule:
rule RCS_Scout
{
    
    meta:
        description = "Hacking Team RCS Scout"
        author = "botherder https://github.com/botherder"

    strings:
        $filter1 = "$engine5"
        $filter2 = "$start4"
        $filter3 = "$upd2"
        $filter4 = "$lookma6"

        $engine1 = /(E)ngine started/ wide ascii
        $engine2 = /(R)unning in background/ wide ascii
        $engine3 = /(L)ocking doors/ wide ascii
        $engine4 = /(R)otors engaged/ wide ascii
        $engine5 = /(I)\'m going to start it/ wide ascii

        $start1 = /Starting upgrade\!/ wide ascii
        $start2 = /(I)\'m going to start the program/ wide ascii
        $start3 = /(i)s it ok\?/ wide ascii
        $start4 = /(C)lick to start the program/ wide ascii

        $upd1 = /(U)pdJob/ wide ascii
        $upd2 = /(U)pdTimer/ wide ascii

        $lookma1 = /(O)wning PCI bus/ wide
        $lookma2 = /(F)ormatting bios/ wide
        $lookma3 = /(P)lease insert a disk in drive A:/ wide
        $lookma4 = /(U)pdating CPU microcode/ wide
        $lookma5 = /(N)ot sure what's happening/ wide
        $lookma6 = /(L)ook ma, no thread id\! \\\\o\// wide

    condition:
        (all of ($engine*) or all of ($start*) or all of ($upd*) or 4 of ($lookma*)) and not any of ($filter*)
}
YARA Detection Rule: sigma_ransomware
Repository: Yara-Rules/rules
Author: J from THL <j@techhelplist.com>

Pattern signatures:
$a = ".php?"
    $b = "uid="
    $c = "&uname="
    $d = "&os="
    $e = "&pcname="
    $f = "&total="
    $g = "&country="
    $h = "&network="
    $i = "&subid="

Detection condition:
all of them

Full rule:
rule sigma_ransomware {

  meta:
    author = "J from THL <j@techhelplist.com>"
    date = "20180509"
    reference1 = "https://www.virustotal.com/#/file/705ad78bf5503e6022f08da4c347afb47d4e740cfe6c39c08550c740c3be96ba"
    reference2 = "https://www.virustotal.com/#/file/bb3533440c27a115878ae541aba3bda02d441f3ea1864b868862255aabb0c8ff"
    version = 1
    maltype = "Ransomware"
    filetype = "memory"

  strings:
    $a = ".php?"
    $b = "uid="
    $c = "&uname="
    $d = "&os="
    $e = "&pcname="
    $f = "&total="
    $g = "&country="
    $h = "&network="
    $i = "&subid="

  condition:
    all of them
}
YARA Detection Rule: IMulerCode
Repository: Yara-Rules/rules
Detects: IMuler code tricks
Author: Seth Hardy

Pattern signatures:
// Load these function strings 4 characters at a time. These check the first two blocks:
        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }

Detection condition:
any of ($L4*)

Full rule:
rule IMulerCode : IMuler Family 
{
    meta:
        description = "IMuler code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-16"
        
    strings:
        // Load these function strings 4 characters at a time. These check the first two blocks:
        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
        
    condition:
        any of ($L4*)
}
YARA Detection Rule: IMulerStrings
Repository: Yara-Rules/rules
Detects: IMuler Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "/cgi-mac/"
        $ = "xnocz1"
        $ = "checkvir.plist"
        $ = "/Users/apple/Documents/mac back"
        $ = "iMuler2"
        $ = "/Users/imac/Desktop/macback/"
        $ = "xntaskz.gz"
        $ = "2wmsetstatus.cgi"
        $ = "launch-0rp.dat"
        $ = "2wmupload.cgi"
        $ = "xntmpz"
        $ = "2wmrecvdata.cgi"
        $ = "xnorz6"
        $ = "2wmdelfile.cgi"
        $ = "/LanchAgents/checkvir"
        $ = "0PERA:%s"
        $ = "/tmp/Spotlight"
        $ = "/tmp/launch-ICS000"

Detection condition:
any of them

Full rule:
rule IMulerStrings : IMuler Family
{
    meta:
        description = "IMuler Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-16"
        
    strings:
        $ = "/cgi-mac/"
        $ = "xnocz1"
        $ = "checkvir.plist"
        $ = "/Users/apple/Documents/mac back"
        $ = "iMuler2"
        $ = "/Users/imac/Desktop/macback/"
        $ = "xntaskz.gz"
        $ = "2wmsetstatus.cgi"
        $ = "launch-0rp.dat"
        $ = "2wmupload.cgi"
        $ = "xntmpz"
        $ = "2wmrecvdata.cgi"
        $ = "xnorz6"
        $ = "2wmdelfile.cgi"
        $ = "/LanchAgents/checkvir"
        $ = "0PERA:%s"
        $ = "/tmp/Spotlight"
        $ = "/tmp/launch-ICS000"
        
    condition:
        any of them
}
YARA Detection Rule: IMuler
Repository: Yara-Rules/rules
Detects: IMuler
Author: Seth Hardy

Detection condition:
IMulerCode or IMulerStrings

Full rule:
rule IMuler : Family
{
    meta:
        description = "IMuler"
        author = "Seth Hardy"
        last_modified = "2014-06-16"
        
    condition:
        IMulerCode or IMulerStrings
}
YARA Detection Rule: dubrute
Repository: Yara-Rules/rules
Detects: Rules for DuBrute Bruteforcer
Malware family: Hackingtool/Bruteforcer
Author: Christian Rebischke (@sh1bumi)

Pattern signatures:
$a = "WBrute"
        $b = "error.txt"
        $c = "good.txt"
        $d = "source.txt"
        $e = "bad.txt"
        $f = "Generator IP@Login;Password"

Detection condition:
//check for MZ Signature at offset 0
        uint16(0) == 0x5A4D 

        and 

        //check for dubrute specific strings
        $a and $b and $c and $d and $e and $f

Full rule:
rule dubrute : bruteforcer toolkit
{
    meta:
        author = "Christian Rebischke (@sh1bumi)"
        date = "2015-09-05"
        description = "Rules for DuBrute Bruteforcer"
        in_the_wild = true
        family = "Hackingtool/Bruteforcer"
    
    strings:
        $a = "WBrute"
        $b = "error.txt"
        $c = "good.txt"
        $d = "source.txt"
        $e = "bad.txt"
        $f = "Generator IP@Login;Password"

    condition:
        //check for MZ Signature at offset 0
        uint16(0) == 0x5A4D 

        and 

        //check for dubrute specific strings
        $a and $b and $c and $d and $e and $f 
}
YARA Detection Rule: apt_ProjectSauron_pipe_backdoor
Repository: Yara-Rules/rules
Detects: Rule to detect ProjectSauron pipe backdoors
Reference: https://securelist.com/blog/

Pattern signatures:
$a1 = "CreateNamedPipeW" fullword ascii
        $a2 = "SetSecurityDescriptorDacl" fullword ascii
        $a3 = "GetOverlappedResult" fullword ascii
        $a4 = "TerminateThread" fullword ascii
        $a5 = "%s%s%X" fullword wide

Detection condition:
uint16(0) == 0x5A4D  and (all of ($a*)) and filesize < 100000

Full rule:
rule apt_ProjectSauron_pipe_backdoor  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron pipe backdoors"
        version = "1.0"    
        reference = "https://securelist.com/blog/"
   
    strings:
        $a1 = "CreateNamedPipeW" fullword ascii
        $a2 = "SetSecurityDescriptorDacl" fullword ascii
        $a3 = "GetOverlappedResult" fullword ascii
        $a4 = "TerminateThread" fullword ascii
        $a5 = "%s%s%X" fullword wide  

    condition:
        uint16(0) == 0x5A4D  and (all of ($a*)) and filesize < 100000
}