deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_NK_AR18_165A_HiddenCobra_import_deob
Repository: Neo23x0/signature-base
Detects: Hidden Cobra - Detects installed proxy module as a service
Malware family: TYPEFRAME
Author: NCCIC trusted 3rd party - Edit: Tobias Michalski
Reference: https://www.us-cert.gov/ncas/analysis-reports/AR18-165A

Pattern signatures:
$ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
      $ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them

Full rule:
rule APT_NK_AR18_165A_HiddenCobra_import_deob {
   meta:
      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
      incident = "10135536"
      date = "2018-04-12"
      category = "hidden_cobra"
      family = "TYPEFRAME"
      md5 = "ae769e62fef4a1709c12c9046301aa5d"
      md5 = "e48fe20eblf5a5887f2ac631fed9ed63"
      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
      description = "Hidden Cobra - Detects installed proxy module as a service"
      id = "f403d589-be35-57a7-9675-f92657c11acc"
   strings:
      $ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
      $ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}
YARA Detection Rule: APT_NK_AR18_165A_1
Repository: Neo23x0/signature-base
Detects: Detects APT malware from AR18-165A report by US CERT
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/analysis-reports/AR18-165A

Pattern signatures:
$s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
      $s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them

Full rule:
rule APT_NK_AR18_165A_1 {
   meta:
      description = "Detects APT malware from AR18-165A report by US CERT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
      date = "2018-06-15"
      hash1 = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
      id = "45f5205d-7f69-5646-aef8-f95d139f9720"
   strings:
      $s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
      $s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
}
YARA Detection Rule: SUSP_AdobePDF_SFX_Bitmap_Combo_Executable
Repository: Neo23x0/signature-base
Detects: Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon
Author: Florian Roth (Nextron Systems)
Reference: https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw

Pattern signatures:
/* Adobe PDF Icon Bitmap */
      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
      /* SFX Icon Bitmap */
      $sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 

Detection condition:
uint16(0) == 0x5a4d and
      all of them
      and pe.number_of_signatures < 1

Full rule:
rule SUSP_AdobePDF_SFX_Bitmap_Combo_Executable {
   meta:
      description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
      date = "2020-11-02"
      score = 60
      hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
      id = "d2d078c9-fbe5-51f4-8f7e-5d943c5a8197"
   strings:
      /* Adobe PDF Icon Bitmap */
      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
      /* SFX Icon Bitmap */
      $sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
               FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00
               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00
               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }
   condition:
      uint16(0) == 0x5a4d and
      all of them
      and pe.number_of_signatures < 1
}
YARA Detection Rule: SUSP_AdobePDF_Bitmap_Executable
Repository: Neo23x0/signature-base
Detects: Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software
Author: Florian Roth (Nextron Systems)
Reference: https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw

Pattern signatures:
/* Adobe PDF Icon Bitmap */
      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
      /* Exclude actual Adobe software */
      $fp1 = "Adobe" ascii wide fullword

Detection condition:
uint16(0) == 0x5a4d and
      $sc1 and not 1 of ($fp*)
      and pe.number_of_signatures < 1

Full rule:
rule SUSP_AdobePDF_Bitmap_Executable {
   meta:
      description = "Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
      date = "2020-11-02"
      score = 60
      hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
      id = "86ebadd4-64a8-5290-b45e-ac125a10ea66"
   strings:
      /* Adobe PDF Icon Bitmap */
      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
      /* Exclude actual Adobe software */
      $fp1 = "Adobe" ascii wide fullword
   condition:
      uint16(0) == 0x5a4d and
      $sc1 and not 1 of ($fp*)
      and pe.number_of_signatures < 1
}
YARA Detection Rule: SUSP_THOR_Unsigned_Oct23_1
Repository: Neo23x0/signature-base
Detects: Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "THOR APT Scanner" wide fullword
      $s2 = "Nextron Systems GmbH" wide fullword

      /* OriginalFilename\x00thor */
      $sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 }

Detection condition:
uint16(0) == 0x5a4d
      and all of them
      and pe.number_of_signatures == 0

Full rule:
rule SUSP_THOR_Unsigned_Oct23_1 {
   meta:
      description = "Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2023-10-28"
      score = 75
      id = "2ca6a192-675e-5f02-a7b1-40369eeb9904"
   strings:
      $s1 = "THOR APT Scanner" wide fullword
      $s2 = "Nextron Systems GmbH" wide fullword

      /* OriginalFilename\x00thor */
      $sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 } 
   condition:
      uint16(0) == 0x5a4d
      and all of them
      and pe.number_of_signatures == 0
}
YARA Detection Rule: MAL_Katz_Stealer_May25
Repository: Neo23x0/signature-base
Detects: Detects Katz stealer
Author: MalGamy (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Motherboard Product: %s" ascii
      $s2 = "cmd.exe /c %s" ascii
      $s3 = "reg export \"%s\" \"%s\" /y" ascii
      $s4 = ").request({ hostname: '" ascii
      $s5 = "Type: Removable"
      $s6 = "%s\\Microsoft\\Windows Live Mail" ascii

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 300KB
      and 4 of them

Full rule:
rule MAL_Katz_Stealer_May25 {
   meta:
      description = "Detects Katz stealer"
      author = "MalGamy (Nextron Systems)"
      date = "2025-05-16"
      reference = "Internal Research"
      hash = "fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789"
      hash = "d92bb6e47cb0a0bdbb51403528ccfe643a9329476af53b5a729f04a4d2139647"
      score = 80
   strings:
      $s1 = "Motherboard Product: %s" ascii
      $s2 = "cmd.exe /c %s" ascii
      $s3 = "reg export \"%s\" \"%s\" /y" ascii
      $s4 = ").request({ hostname: '" ascii
      $s5 = "Type: Removable"
      $s6 = "%s\\Microsoft\\Windows Live Mail" ascii
   condition:
      uint16(0) == 0x5a4d
      and filesize < 300KB
      and 4 of them
}
YARA Detection Rule: MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25
Repository: Neo23x0/signature-base
Detects: Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer
Author: MAlGamy
Reference: Internal Research

Pattern signatures:
$s1 = "Failed to set proxy blanket." ascii
      $s2 = "Decryption failed. Last error:" ascii
      $s3 = "\\Google\\Chrome\\User Data\\Local State" ascii

      $op1 = {48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? 48 FF C3 EB ?? 48 8D 54 24 ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 48 89 F8 48 81 C4}

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 2MB
      and $op1 and 1 of ($s*)

Full rule:
rule MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25 {
   meta:
      description = "Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer"
      author = "MAlGamy"
      date = "2025-05-19"
      reference = "Internal Research"
      hash = "6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d"
      score = 80
   strings:
      $s1 = "Failed to set proxy blanket." ascii
      $s2 = "Decryption failed. Last error:" ascii
      $s3 = "\\Google\\Chrome\\User Data\\Local State" ascii

      $op1 = {48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? 48 FF C3 EB ?? 48 8D 54 24 ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 48 89 F8 48 81 C4}
   condition:
      uint16(0) == 0x5a4d
      and filesize < 2MB
      and $op1 and 1 of ($s*)
}
YARA Detection Rule: SUSP_Katz_Log_May25
Repository: Neo23x0/signature-base
Detects: Detects log file that contains system reconnaissance data, seen being generated by Katz stealer
Author: MalGamy
Reference: Internal Research

Pattern signatures:
$s1 = "Motherboard Manufacturer:" ascii
      $s2 = "===== System Information =====" ascii
      $s3 = "Volume Name:" ascii
      $s4 = "Desktop Hostname:" ascii

Detection condition:
filesize < 50KB
      and 3 of them

Full rule:
rule SUSP_Katz_Log_May25 {
   meta:
      description = "Detects log file that contains system reconnaissance data, seen being generated by Katz stealer"
      author = "MalGamy"
      date = "2025-05-20"
      reference = "Internal Research"
      hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
      hash = "ad76e[PII_REDACTED]dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
      hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
      hash = "b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031"
      hash = "5a984e2e308fe84e4e2071dd[PII_REDACTED]19ba0217c2c23da79dbb82dc15eac8"
      score = 65
   strings:
      $s1 = "Motherboard Manufacturer:" ascii
      $s2 = "===== System Information =====" ascii
      $s3 = "Volume Name:" ascii
      $s4 = "Desktop Hostname:" ascii
   condition:
      filesize < 50KB
      and 3 of them
}
YARA Detection Rule: MAL_NET_Katz_Stealer_Loader_May25
Repository: Neo23x0/signature-base
Detects: Detects .NET based Katz stealer loader
Author: Jonathan Peters (cod3nym)
Reference: Internal Research

Pattern signatures:
$x = "ExecutarMetodoVAI" ascii

      $s1 = "VirtualMachineDetector" ascii
      $s2 = "Wow64SetThreadContext_API" ascii
      $s3 = "nomedoarquivo" ascii
      $s4 = { 65 78 74 65 6E C3 A7 61 6F 00 }
      $s5 = "payloadBuffer" ascii
      $s6 = "caminhovbs" ascii

Detection condition:
3 of ($s*) or $x

Full rule:
rule MAL_NET_Katz_Stealer_Loader_May25 {
   meta:
      description = "Detects .NET based Katz stealer loader"
      author = "Jonathan Peters (cod3nym)"
      date = "2025-05-21"
      reference = "Internal Research"
      hash = "0df13fd42fb4a[PII_REDACTED]ea87895a3830eddcc7f3bd494e76acd604c4004f7"
      score = 80
   strings:
      $x = "ExecutarMetodoVAI" ascii

      $s1 = "VirtualMachineDetector" ascii
      $s2 = "Wow64SetThreadContext_API" ascii
      $s3 = "nomedoarquivo" ascii
      $s4 = { 65 78 74 65 6E C3 A7 61 6F 00 }
      $s5 = "payloadBuffer" ascii
      $s6 = "caminhovbs" ascii
   condition:
      3 of ($s*) or $x
}
YARA Detection Rule: MAL_NET_UAC_Bypass_May25
Repository: Neo23x0/signature-base
Detects: Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)
Author: Jonathan Peters (cod3nym)
Reference: Internal Research

Pattern signatures:
$x1 = "CmstpBypass" ascii
      $x2 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 00 00 33 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
      $x3 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B 00 69 00 6C 00 6C 00 20 00 2F 00 49 00 4D 00 20 00 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }

Detection condition:
uint16(0) == 0x5a4d
      and $x1
      or 1 of ($x2,$x3)

Full rule:
rule MAL_NET_UAC_Bypass_May25 {
   meta:
      description = "Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)"
      author = "Jonathan Peters (cod3nym)"
      date = "2025-05-21"
      reference = "Internal Research"
      hash = "4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7"
      hash = "fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed"
      score = 80
   strings:
      $x1 = "CmstpBypass" ascii
      $x2 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 00 00 33 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
      $x3 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B 00 69 00 6C 00 6C 00 20 00 2F 00 49 00 4D 00 20 00 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
   condition:
      uint16(0) == 0x5a4d
      and $x1
      or 1 of ($x2,$x3)
}
YARA Detection Rule: SUSP_Bad_PDF
Repository: Neo23x0/signature-base
Detects: Detects PDF that embeds code to steal NTLM hashes
Author: Florian Roth (Nextron Systems), Markus Neis
Reference: Internal Research

Pattern signatures:
$s1 = "         /F (http//" ascii
      $s2 = "        /F (\\\\\\\\" ascii
      $s3 = "<</F (\\\\" ascii

Detection condition:
( uint32(0) == 0x46445025 or uint32(0) == 0x4450250a ) and 1 of them

Full rule:
rule SUSP_Bad_PDF {
   meta:
      description = "Detects PDF that embeds code to steal NTLM hashes"
      author = "Florian Roth (Nextron Systems), Markus Neis"
      reference = "Internal Research"
      date = "2018-05-03"
      hash1 = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
      id = "149cf20c-4cfd-5b07-acc5-06ae25b209b1"
   strings:
      $s1 = "         /F (http//" ascii
      $s2 = "        /F (\\\\\\\\" ascii
      $s3 = "<</F (\\\\" ascii
   condition:
      ( uint32(0) == 0x46445025 or uint32(0) == 0x4450250a ) and 1 of them
}
YARA Detection Rule: Slingshot_APT_Spork_Downloader
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$s1 = "Usage: spork -c IP:PORT" fullword ascii wide
      $s2 = "connect-back IP address and port number"

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them

Full rule:
rule Slingshot_APT_Spork_Downloader {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      id = "21e02f78-40d8-5b56-b747-3f2a7a692259"
   strings:
      $s1 = "Usage: spork -c IP:PORT" fullword ascii wide
      $s2 = "connect-back IP address and port number"
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
}
YARA Detection Rule: Slingshot_APT_Minisling
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them

Full rule:
rule Slingshot_APT_Minisling {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      id = "99f9d5a1-b29f-52f7-9aec-02df4a51a756"
   strings:
      $s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
}
YARA Detection Rule: Slingshot_APT_Ring0_Loader
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$s1 = " -> Missing element in DataDir -- cannot install" ascii
      $s2 = " -> Primary loader not present in the DataDir" ascii
      $s3 = "\\\\.\\amxpci" fullword ascii
      $s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
      $s5 = "\\\\.\\Sandra" fullword ascii
      $s6 = " -> [Sandra] RingZeroCode" fullword ascii
      $s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them

Full rule:
rule Slingshot_APT_Ring0_Loader {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      id = "b5301a45-a4ec-5e56-a990-bc6300ee6365"
   strings:
      $s1 = " -> Missing element in DataDir -- cannot install" ascii
      $s2 = " -> Primary loader not present in the DataDir" ascii
      $s3 = "\\\\.\\amxpci" fullword ascii
      $s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
      $s5 = "\\\\.\\Sandra" fullword ascii
      $s6 = " -> [Sandra] RingZeroCode" fullword ascii
      $s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
}
YARA Detection Rule: Slingshot_APT_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$s1 = "SlingDll.dll" fullword ascii
      $s2 = "BogusDll." ascii
      $s3 = "smsvcrt -h 0x%p" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and (
        pe.imphash() == "7ead4bb0d752003ce7c062adb7ffc51a" or
        pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

Full rule:
rule Slingshot_APT_Malware_1 {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      hash1 = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
      id = "72f4a52b-c70b-511f-acf5-6d680a95c7d6"
   strings:
      $s1 = "SlingDll.dll" fullword ascii
      $s2 = "BogusDll." ascii
      $s3 = "smsvcrt -h 0x%p" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and (
        pe.imphash() == "7ead4bb0d752003ce7c062adb7ffc51a" or
        pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000") or
        1 of them
      )
}