deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: UnPack_rar_Folder_TBack
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file TBack.DLL
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
      $s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
      $s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
      $s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
      $s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
      $s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
      $s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
      $s8 = "Shell                                 -->Get A Shell" fullword ascii
      $s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
      $s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
      $s13 = "Online                                -->List All Connected IP" fullword ascii
      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) S

Detection condition:
4 of them

Full rule:
rule UnPack_rar_Folder_TBack {
   meta:
      description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
      id = "f672f987-0d43-53df-8338-084907b6da16"
   strings:
      $s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
      $s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
      $s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
      $s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
      $s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
      $s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
      $s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
      $s8 = "Shell                                 -->Get A Shell" fullword ascii
      $s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
      $s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
      $s13 = "Online                                -->List All Connected IP" fullword ascii
      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
      $s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
      $s18 = "Execute Program                       -->Execute A Program" fullword ascii
      $s19 = "Reboot                                -->Reboot The System" fullword ascii
      $s20 = "Password Sniffering Is Not Running" fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: sig_238_cmd_2
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file cmd.jsp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Process child = Runtime.getRuntime().exec(" ascii
      $s1 = "InputStream in = child.getInputStream();" fullword ascii
      $s2 = "String cmd = request.getParameter(\"" ascii
      $s3 = "while ((c = in.read()) != -1) {" fullword ascii
      $s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_cmd_2 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "be[PII_REDACTED]dacc6665b6532b03db9f87cfc2bb"
      id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"
   strings:
      $s0 = "Process child = Runtime.getRuntime().exec(" ascii
      $s1 = "InputStream in = child.getInputStream();" fullword ascii
      $s2 = "String cmd = request.getParameter(\"" ascii
      $s3 = "while ((c = in.read()) != -1) {" fullword ascii
      $s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: RangeScan
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file RangeScan.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RangeScan.EXE" fullword wide
      $s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
      $s9 = "Produced by isn0" fullword ascii
      $s10 = "RangeScan" fullword wide
      $s20 = "%d-%d-%d %d:%d:%d" fullword ascii

Detection condition:
3 of them

Full rule:
rule RangeScan {
   meta:
      description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
      id = "143d9e1e-41e2-579a-beee-30da2cf068f7"
   strings:
      $s0 = "RangeScan.EXE" fullword wide
      $s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
      $s9 = "Produced by isn0" fullword ascii
      $s10 = "RangeScan" fullword wide
      $s20 = "%d-%d-%d %d:%d:%d" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: XYZCmd_zip_Folder_Readme
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Readme.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
      $s20 = "XYZCmd V1.0" fullword ascii

Detection condition:
all of them

Full rule:
rule XYZCmd_zip_Folder_Readme {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Readme.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
      id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"
   strings:
      $s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
      $s20 = "XYZCmd V1.0" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: ByPassFireWall_zip_Folder_Inject
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Inject.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s6 = "Fail To Inject" fullword ascii
      $s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
      $s11 = " Successfully" fullword ascii

Detection condition:
all of them

Full rule:
rule ByPassFireWall_zip_Folder_Inject {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Inject.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
      id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"
   strings:
      $s6 = "Fail To Inject" fullword ascii
      $s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
      $s11 = " Successfully" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_sqlcmd
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file sqlcmd.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Permission denial to EXEC command.:(" ascii
      $s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
      $s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
      $s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
      $s6 = "SqlCmd2.exe Inside Edition." fullword ascii
      $s7 = "Http://www.patching.net  2000/12/14" fullword ascii
      $s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii

Detection condition:
4 of them

Full rule:
rule sig_238_sqlcmd {
   meta:
      description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 40
      hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
      id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"
   strings:
      $s0 = "Permission denial to EXEC command.:(" ascii
      $s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
      $s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
      $s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
      $s6 = "SqlCmd2.exe Inside Edition." fullword ascii
      $s7 = "Http://www.patching.net  2000/12/14" fullword ascii
      $s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
   condition:
      4 of them
}
YARA Detection Rule: ASPack_ASPACK
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file ASPACK.EXE
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "ASPACK.EXE" fullword wide
      $s5 = "CLOSEDFOLDER" fullword wide
      $s10 = "ASPack compressor" fullword wide

Detection condition:
all of them

Full rule:
rule ASPack_ASPACK {
   meta:
      description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
      id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"
   strings:
      $s0 = "ASPACK.EXE" fullword wide
      $s5 = "CLOSEDFOLDER" fullword wide
      $s10 = "ASPack compressor" fullword wide
   condition:
      all of them
}
YARA Detection Rule: sig_238_2323
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file 2323.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
      $s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
      $s3 = "Failed to execute shell" fullword ascii
      $s5 = "/h   - Hide Window" fullword ascii
      $s7 = "Accepted connection from client at %s" fullword ascii
      $s9 = "Error %d: %s" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_2323 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file 2323.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
      id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"
   strings:
      $s0 = "port - Port to listen on, defaults to 2323" fullword ascii
      $s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
      $s3 = "Failed to execute shell" fullword ascii
      $s5 = "/h   - Hide Window" fullword ascii
      $s7 = "Accepted connection from client at %s" fullword ascii
      $s9 = "Error %d: %s" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Jc_ALL_WinEggDropShell_rar_Folder_Install_2
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Install.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "http://go.163.com/sdemo" fullword wide
      $s2 = "Player.tmp" fullword ascii
      $s3 = "Player.EXE" fullword wide
      $s4 = "mailto:sdemo@263.net" fullword ascii
      $s5 = "S-Player.exe" fullword ascii
      $s9 = "http://www.BaiXue.net (" wide

Detection condition:
all of them

Full rule:
rule Jc_ALL_WinEggDropShell_rar_Folder_Install_2 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Install.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "95866e917f699ee74d[PII_REDACTED]640ea1a05afd"
      id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"
   strings:
      $s1 = "http://go.163.com/sdemo" fullword wide
      $s2 = "Player.tmp" fullword ascii
      $s3 = "Player.EXE" fullword wide
      $s4 = "mailto:sdemo@263.net" fullword ascii
      $s5 = "S-Player.exe" fullword ascii
      $s9 = "http://www.BaiXue.net (" wide
   condition:
      all of them
}
YARA Detection Rule: sig_238_TFTPD32
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file TFTPD32.EXE
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = " http://arm.533.net" fullword ascii
      $s1 = "Tftpd32.hlp" fullword ascii
      $s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
      $s3 = "TFTPD32 -- " fullword wide
      $s4 = "%d -- %s" fullword ascii
      $s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
      $s12 = "TftpPort" fullword ascii
      $s13 = "Ttftpd32BackGround" fullword ascii
      $s17 = "SOFTWARE\\TFTPD32" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_TFTPD32 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
      id = "071fba15-affe-539a-bcc0-c14943fff51a"
   strings:
      $s0 = " http://arm.533.net" fullword ascii
      $s1 = "Tftpd32.hlp" fullword ascii
      $s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
      $s3 = "TFTPD32 -- " fullword wide
      $s4 = "%d -- %s" fullword ascii
      $s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
      $s12 = "TftpPort" fullword ascii
      $s13 = "Ttftpd32BackGround" fullword ascii
      $s17 = "SOFTWARE\\TFTPD32" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_iecv
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file iecv.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "Edit The Content Of Cookie " fullword wide
      $s3 = "Accessories\\wordpad.exe" fullword ascii
      $s4 = "gorillanation.com" fullword ascii
      $s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
      $s12 = "http://nirsoft.cjb.net" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_iecv {
   meta:
      description = "Disclosed hacktool set (old stuff) - file iecv.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "6e6e75350a33f799039e7a024722cde463328b6d"
      id = "08126db3-267b-5289-b562-40bc264f6e3e"
   strings:
      $s1 = "Edit The Content Of Cookie " fullword wide
      $s3 = "Accessories\\wordpad.exe" fullword ascii
      $s4 = "gorillanation.com" fullword ascii
      $s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
      $s12 = "http://nirsoft.cjb.net" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Antiy_Ports_1_21
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "AntiyPorts.EXE" fullword wide
      $s7 = "AntiyPorts MFC Application" fullword wide
      $s20 = " @Stego:" fullword ascii

Detection condition:
all of them

Full rule:
rule Antiy_Ports_1_21 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
      id = "eb53fc91-4dec-5416-a2c7-1e[PII_REDACTED]"
   strings:
      $s0 = "AntiyPorts.EXE" fullword wide
      $s7 = "AntiyPorts MFC Application" fullword wide
      $s20 = " @Stego:" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: perlcmd_zip_Folder_cmd
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file cmd.cgi
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
      $s1 = "s/%20/ /ig;" fullword ascii
      $s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
      $s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
      $s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
      $s6 = "$execthis = $_;" fullword ascii
      $s7 = "system($execthis);" fullword ascii
      $s12 = "s/%2f/\\//ig;" fullword ascii

Detection condition:
6 of them

Full rule:
rule perlcmd_zip_Folder_cmd {
   meta:
      description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
      id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"
   strings:
      $s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
      $s1 = "s/%20/ /ig;" fullword ascii
      $s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
      $s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
      $s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
      $s6 = "$execthis = $_;" fullword ascii
      $s7 = "system($execthis);" fullword ascii
      $s12 = "s/%2f/\\//ig;" fullword ascii
   condition:
      6 of them
}
YARA Detection Rule: aspbackdoor_asp3
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file asp3.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
      $s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
      $s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
      $s14 = " Windows NT " fullword ascii
      $s16 = " WIndows 2000 " fullword ascii
      $s18 = "Old[CREDENTIAL_REDACTED].Form(\"OldPwd\") " fullword ascii
      $s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
      $s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_asp3 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file asp3.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
      id = "ed86e829-449b-5088-a105-f1fe79547540"
   strings:
      $s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
      $s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
      $s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
      $s14 = " Windows NT " fullword ascii
      $s16 = " WIndows 2000 " fullword ascii
      $s18 = "Old[CREDENTIAL_REDACTED].Form(\"OldPwd\") " fullword ascii
      $s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
      $s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_FPipe
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file FPipe.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
      $s2 = "source port for that outbound connection being set to 53 also." fullword ascii
      $s3 = " -s    - outbound source port number" fullword ascii
      $s5 = "http://www.foundstone.com" fullword ascii
      $s20 = "Attempting to connect to %s port %d" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_FPipe {
   meta:
      description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
      id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"
   strings:
      $s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
      $s2 = "source port for that outbound connection being set to 53 also." fullword ascii
      $s3 = " -s    - outbound source port number" fullword ascii
      $s5 = "http://www.foundstone.com" fullword ascii
      $s20 = "Attempting to connect to %s port %d" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_concon
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file concon.com
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_concon {
   meta:
      description = "Disclosed hacktool set (old stuff) - file concon.com"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
      id = "ca7862cc-1053-5fce-a569-6ecc069314df"
   strings:
      $s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspbackdoor_regdll
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file regdll.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
      $s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
      $s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
      $s5 = "Public Property Get oFS()" fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_regdll {
   meta:
      description = "Disclosed hacktool set (old stuff) - file regdll.asp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
      id = "37096c50-68d0-5412-847a-022062a5ff2a"
   strings:
      $s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
      $s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
      $s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
      $s5 = "Public Property Get oFS()" fullword ascii
   condition:
      all of them
}