deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Win32_Virus_Elerad
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Yara rule that detects Elerad virus.
Malware family: ELERAD
Author: ReversingLabs

Pattern signatures:
$elerad_body = {
            EB 77 60 E8 09 00 00 00 8B 64 24 08 E9 DD 01 00 00 33 D2 64 FF 32 64 89 22 50 8B D8 B9 FF 00 00 00 81 38 2E 65 78 65 74
            08 40 E2 F5 E9 BD 01 00 00 32 D2 38 50 04 0F 85 B2 01 00 00 33 D2 80 38 5C 74 07 3B C3 74 07 48 E2 F4 88 10 8B D0 58 BE
            00 00 E6 77 BF 23 C1 AB 00 EB 3E 60 E8 09 00 00 00 8B 64 24 08 E9 84 01 00 00 33 D2 64 FF 32 64 89 22 BE 00 00 E6 77 EB
            20 68 ?? ?? ?? ?? 60 8B 74 24 24 E8 09 00 00 00 8B 64 24 08 E9 5D 01 00 00 33 D2 64 FF 32 64 89 22 E8 00 00 00 00 5D 81
            ED ?? ?? ?? ?? 81 FF 23 C1 AB 00 75 0C 89 95 22 12 40 00 89 85 1E 12 40 00 BA ?? ?? ?? ?? B9 09 02 00 00 8D 85 D0 10 40
            00 31 10 83 C0 04 E2 F9
        }

Detection condition:
uint16(0) == 0x5A4D and 
        ($elerad_body at pe.entry_point)

Full rule:
rule Win32_Virus_Elerad : tc_detection malicious
{
    meta:

        author              = "ReversingLabs"

        source              = "ReversingLabs"
        status              = "RELEASED"
        sharing             = "TLP:WHITE"
        category            = "MALWARE"
        malware             = "ELERAD"
        description         = "Yara rule that detects Elerad virus."

        tc_detection_type   = "Virus"
        tc_detection_name   = "Elerad"
        tc_detection_factor = 5

    strings:
        $elerad_body = {
            EB 77 60 E8 09 00 00 00 8B 64 24 08 E9 DD 01 00 00 33 D2 64 FF 32 64 89 22 50 8B D8 B9 FF 00 00 00 81 38 2E 65 78 65 74
            08 40 E2 F5 E9 BD 01 00 00 32 D2 38 50 04 0F 85 B2 01 00 00 33 D2 80 38 5C 74 07 3B C3 74 07 48 E2 F4 88 10 8B D0 58 BE
            00 00 E6 77 BF 23 C1 AB 00 EB 3E 60 E8 09 00 00 00 8B 64 24 08 E9 84 01 00 00 33 D2 64 FF 32 64 89 22 BE 00 00 E6 77 EB
            20 68 ?? ?? ?? ?? 60 8B 74 24 24 E8 09 00 00 00 8B 64 24 08 E9 5D 01 00 00 33 D2 64 FF 32 64 89 22 E8 00 00 00 00 5D 81
            ED ?? ?? ?? ?? 81 FF 23 C1 AB 00 75 0C 89 95 22 12 40 00 89 85 1E 12 40 00 BA ?? ?? ?? ?? B9 09 02 00 00 8D 85 D0 10 40
            00 31 10 83 C0 04 E2 F9
        }

    condition:
        uint16(0) == 0x5A4D and 
        ($elerad_body at pe.entry_point)
}
YARA Detection Rule: Win32_Virus_Awfull
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Yara rule that detects Awfull virus.
Malware family: AWFULL
Author: ReversingLabs

Pattern signatures:
$awfull_body = {
              60 E8 ?? 00 00 00 8B 64 24 08 EB ?? [0-256]
              33 D2 64 FF 32 64 89 22 33 C0 C7 00 00 00 00 00 33 D2 64 8F 02
              5A 64 (8B 0D | 67 8B 0E ) 14 00 [0-2] E3 03 FA    
              EB FD 61 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 0B ED 74 ?? 
              [0-128] (BE | 8B 35) ?? ?? ?? ?? 03 F5 B9 ?? ?? ?? ??    
              56 5F AC F6 D0 AA 49 E3 02 EB F7
        }

Detection condition:
uint16(0) == 0x5A4D and 
        ($awfull_body at pe.entry_point)

Full rule:
rule Win32_Virus_Awfull : tc_detection malicious
{
    meta:

        author              = "ReversingLabs"

        source              = "ReversingLabs"
        status              = "RELEASED"
        sharing             = "TLP:WHITE"
        category            = "MALWARE"
        malware             = "AWFULL"
        description         = "Yara rule that detects Awfull virus."

        tc_detection_type   = "Virus"
        tc_detection_name   = "Awfull"
        tc_detection_factor = 5

    strings:
        $awfull_body = {
              60 E8 ?? 00 00 00 8B 64 24 08 EB ?? [0-256]
              33 D2 64 FF 32 64 89 22 33 C0 C7 00 00 00 00 00 33 D2 64 8F 02
              5A 64 (8B 0D | 67 8B 0E ) 14 00 [0-2] E3 03 FA    
              EB FD 61 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 0B ED 74 ?? 
              [0-128] (BE | 8B 35) ?? ?? ?? ?? 03 F5 B9 ?? ?? ?? ??    
              56 5F AC F6 D0 AA 49 E3 02 EB F7
        }
        
    condition:
        uint16(0) == 0x5A4D and 
        ($awfull_body at pe.entry_point)
}
YARA Detection Rule: IQY_File_With_Pivot_Extension_URL
Repository: InQuest/yara-rules
Detects: Detect Excel IQY files with URLs that contain commonly used malicious file extensions that may act as a pivot to a secondary stage.
Author: InQuest Labs
Reference: https://www.inquest.net

Pattern signatures:
/*
           match WEB on the first line of a file
           takes into account potential whitespace before or after case-insensitive "WEB" string
        */
         $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase

        /*
            generic URL to direct download a file containing a potentially malicious extension.
            File extensions were decided based upon common extensions seen in the wild
            The extension list can be expanded upon as new information comes available from matches
            on the Stage 1 or Stage 2 signatures
         */

        $url = /https?:\/\/[\w\.\/]+\.(scr|exe|hta|vbs|ps1|bat|dat|rar|zip|ace)/ nocase

Detection condition:
$web at 0 and $url

Full rule:
rule IQY_File_With_Pivot_Extension_URL
{
    meta:
        Author = "InQuest Labs"
        Reference = "https://www.inquest.net"
        Description = "Detect Excel IQY files with URLs that contain commonly used malicious file extensions that may act as a pivot to a secondary stage."
        Severity = "9"
    strings:
        /*
           match WEB on the first line of a file
           takes into account potential whitespace before or after case-insensitive "WEB" string
        */
         $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase

        /*
            generic URL to direct download a file containing a potentially malicious extension.
            File extensions were decided based upon common extensions seen in the wild
            The extension list can be expanded upon as new information comes available from matches
            on the Stage 1 or Stage 2 signatures
         */

        $url = /https?:\/\/[\w\.\/]+\.(scr|exe|hta|vbs|ps1|bat|dat|rar|zip|ace)/ nocase

    condition:
        $web at 0 and $url
}
YARA Detection Rule: PDF_Document_with_Embedded_IQY_File
Repository: InQuest/yara-rules
Detects: This signature detects IQY files embedded within PDF documents which use a JavaScript OpenAction object to run the IQY.
Author: InQuest Labs
Reference: https://blog.inquest.net

Pattern signatures:
$pdf_magic = "%PDF"
        $efile = /<<\/JavaScript [^\x3e]+\/EmbeddedFile/        
        $fspec = /<<\/Type\/Filespec\/F\(\w+\.iqy\)\/UF\(\w+\.iqy\)/
        $openaction = /OpenAction<<\/S\/JavaScript\/JS\(/
        
        /*
          <</Type/Filespec/F(10082016.iqy)/UF(10082016.iqy)/EF<</F 1 0 R/UF 1 0 R>>/Desc(10082016.iqy)>> 
          ...
          <</Names[(10082016.iqy) 2 0 R]>>
          ...
          <</JavaScript 9 0 R/EmbeddedFiles 10 0 R>>
          ...
          OpenAction<</S/JavaScript/JS(
        */
        
        /*
            obj 1.9
             Type: /EmbeddedFile
             Referencing:
             Contains stream
              <<
                /Length 51
                /Type /EmbeddedFile
                /Filter /FlateDecode
                /Params
                  <<
                    /ModDate "(D:[PII_REDACTED]5018+03'00')"
                    /Size 45
                  >>
              >>
             WEB
            1
            http://i86h.com/

Detection condition:
$pdf_magic in (0..60)  and all of them

Full rule:
rule PDF_Document_with_Embedded_IQY_File
{
    meta:
        Author = "InQuest Labs"
        Description = "This signature detects IQY files embedded within PDF documents which use a JavaScript OpenAction object to run the IQY."
        Reference = "https://blog.inquest.net"  
  
    strings:
        $pdf_magic = "%PDF"
        $efile = /<<\/JavaScript [^\x3e]+\/EmbeddedFile/        
        $fspec = /<<\/Type\/Filespec\/F\(\w+\.iqy\)\/UF\(\w+\.iqy\)/
        $openaction = /OpenAction<<\/S\/JavaScript\/JS\(/
        
        /*
          <</Type/Filespec/F(10082016.iqy)/UF(10082016.iqy)/EF<</F 1 0 R/UF 1 0 R>>/Desc(10082016.iqy)>> 
          ...
          <</Names[(10082016.iqy) 2 0 R]>>
          ...
          <</JavaScript 9 0 R/EmbeddedFiles 10 0 R>>
          ...
          OpenAction<</S/JavaScript/JS(
        */
        
        /*
            obj 1.9
             Type: /EmbeddedFile
             Referencing:
             Contains stream
              <<
                /Length 51
                /Type /EmbeddedFile
                /Filter /FlateDecode
                /Params
                  <<
                    /ModDate "(D:[PII_REDACTED]5018+03'00')"
                    /Size 45
                  >>
              >>
             WEB
            1
            http://i86h.com/data1.dat
            2
            3
            4
            5
        */
   
   condition:
      $pdf_magic in (0..60)  and all of them
}
YARA Detection Rule: Hex_Encoded_Powershell
Repository: InQuest/yara-rules
Author: InQuest Labs
Reference: https://twitter.com/InQuest/status/[PII_REDACTED]75398149

Pattern signatures:
// http or https, powershell, invoke-webrequest
        // generated via: https://labs.inquest.net/tools/yara/iq-mixed-case
        $http = /[46]8[57]4[57]4[57]0([57]3)?3a2f2f/ nocase
        $powershell = /[57]0[46]f[57]7[46]5[57]2[57]3[46]8[46]5[46]c[46]c/ nocase
        $invoke = /[46]9[46]e[57]6[46]f[46]b[46]52d[57]7[46]5[46]2[57]2[46]5[57]1[57]5[46]5[57]3[57]4/ nocase

Detection condition:
all of them

Full rule:
rule Hex_Encoded_Powershell
{
    meta:
        Author    = "InQuest Labs"
        Reference = "https://twitter.com/InQuest/status/[PII_REDACTED]75398149"
        Sample    = "https://labs.inquest.net/dfi/sha256/c430b2b2885804a638fc8d850b1aaca9eb0a981c7f5f9e467e44478e6bc961ee"
        Similar   = "https://labs.inquest.net/dfi/search/ext/ext_context/[PII_REDACTED][PII_REDACTED]636F6E74656E742E636F6D2F6A6F686E646F657465"

    strings:
        // http or https, powershell, invoke-webrequest
        // generated via: https://labs.inquest.net/tools/yara/iq-mixed-case
        $http = /[46]8[57]4[57]4[57]0([57]3)?3a2f2f/ nocase
        $powershell = /[57]0[46]f[57]7[46]5[57]2[57]3[46]8[46]5[46]c[46]c/ nocase
        $invoke = /[46]9[46]e[57]6[46]f[46]b[46]52d[57]7[46]5[46]2[57]2[46]5[57]1[57]5[46]5[57]3[57]4/ nocase

    condition:
        all of them
}
YARA Detection Rule: Microsoft_XLSX_with_Macrosheet
Repository: InQuest/yara-rules
Detects: Basic hunt rule for XLS* with macrosheets.
Author: InQuest Labs
Reference: https://inquest.net/blog/2020/05/06/ZLoader-4.0-Macrosheets-Evolution

Pattern signatures:
$magic_xlsx  = /^\x50\x4B\x03\x04/
        $anchor_xlsx = /xl\/macrosheets\/[a-zA-Z0-9_-]+\.xmlPK/

Detection condition:
$magic_xlsx at 0 and $anchor_xlsx

Full rule:
rule Microsoft_XLSX_with_Macrosheet
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://inquest.net/blog/2020/05/06/ZLoader-4.0-Macrosheets-Evolution"
        Description = "Basic hunt rule for XLS* with macrosheets." 

    strings:
        $magic_xlsx  = /^\x50\x4B\x03\x04/
        $anchor_xlsx = /xl\/macrosheets\/[a-zA-Z0-9_-]+\.xmlPK/

    condition:
        $magic_xlsx at 0 and $anchor_xlsx
}
YARA Detection Rule: Excel_Hidden_Macro_Sheet
Repository: InQuest/yara-rules
Detects: http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$ole_marker     = {D0 CF 11 E0 A1 B1 1A E1}
            $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
            $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}

Detection condition:
$ole_marker at 0 and 1 of ($macro_sheet_h*)

Full rule:
rule Excel_Hidden_Macro_Sheet
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/"
    strings:
            $ole_marker     = {D0 CF 11 E0 A1 B1 1A E1}
            $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
            $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
    condition:
            $ole_marker at 0 and 1 of ($macro_sheet_h*)
}
YARA Detection Rule: PE_File
Repository: InQuest/yara-rules
Detects: Discover embedded PE files, without relying on easily stripped/modified header strings.
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$mz = { 4D 5A }

Detection condition:
for any i in (1..#mz):
        (
            uint32(@mz[i] + uint32(@mz[i] + 0x3C)) == 0x00004550
        )

Full rule:
rule PE_File
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "Discover embedded PE files, without relying on easily stripped/modified header strings."
    strings:
        $mz = { 4D 5A }
    condition:
        for any i in (1..#mz):
        (
            uint32(@mz[i] + uint32(@mz[i] + 0x3C)) == 0x00004550
        )
}
YARA Detection Rule: Symbolic_Link_Files_Macros_File_Characteristic
Repository: InQuest/yara-rules
Detects: This signature detects Symbolic Link (SLK) files that contain Excel 4.0 macros. While not inherently malicious, these SLK files can be used used by attackers to evade detection and deliver malicious payloads.
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules/edit/master/Symbolic_Link_Files_Macros_File_Characteristic.rule

Pattern signatures:
$magic = "ID;P"
	
	$re1 = /\x0aO;E[\r\n]/ nocase
	/*The first line with the ID and P records is a marker that indicates this file is a SYLK file.
The second line with the O record sets options for this document. E marks that it is a macro-enabled document.
	*/
	
	//If we want to be extra cautious then we can enable $re2 
	//$re2 = /\x0aNN;NAuto_open;/ nocase
	//third line is a names record NN. We set the name Auto_open for the cell at row 1, column 1 (ER1C1).
	
	/*
	Sample:
	
	ID;P
	O;E
	NN;NAuto_open;ER1C1;KOutFlank;F
	C;Y1;X1;N;EDIRECTORY()
	C;X1;Y2;K0;ESELECT(R1C1)
	C;X1;Y2;N;K13;EFIND(":";;R1C1)
	C;X1;Y3;N;K19;EFIND(":";;R1C1;;R2C1+1)
	C;X1;Y4;N;K27;EFIND(":";;R1C1;;R3C1+1)
	C;X1;Y5;N;ELEFT(R1C1;;R4C1 -1)
	C;X1;Y6;N;KFALSE;EDIRECTORY(R[-1]C)
	C;X1;Y7;N;K0;EFOPEN("MALICIOUS.FILE";;3)
	C;X1;Y9;K0;EFWRITE(R7C1;;"PWNED BY OUTFLANK")
	C;X1;Y10;K0;EFCLOSE(R7C1)
	C;X1;Y11;K0;EHALT()
	E
	
	*/

Detection condition:
$magic in (0..100) and all of ($re*)

Full rule:
rule Symbolic_Link_Files_Macros_File_Characteristic
{

	meta:
		Author = "InQuest Labs"
		URL         = "https://github.com/InQuest/yara-rules/edit/master/Symbolic_Link_Files_Macros_File_Characteristic.rule"
		Description = "This signature detects Symbolic Link (SLK) files that contain Excel 4.0 macros. While not inherently malicious, these SLK files can be used used by attackers to evade detection and deliver malicious payloads."
		References = "https://outflank.nl/blog/2019/10/30/abusing-the-sylk-file-format/"

	strings:
			$magic = "ID;P"
	
	$re1 = /\x0aO;E[\r\n]/ nocase
	/*The first line with the ID and P records is a marker that indicates this file is a SYLK file.
The second line with the O record sets options for this document. E marks that it is a macro-enabled document.
	*/
	
	//If we want to be extra cautious then we can enable $re2 
	//$re2 = /\x0aNN;NAuto_open;/ nocase
	//third line is a names record NN. We set the name Auto_open for the cell at row 1, column 1 (ER1C1).
	
	/*
	Sample:
	
	ID;P
	O;E
	NN;NAuto_open;ER1C1;KOutFlank;F
	C;Y1;X1;N;EDIRECTORY()
	C;X1;Y2;K0;ESELECT(R1C1)
	C;X1;Y2;N;K13;EFIND(":";;R1C1)
	C;X1;Y3;N;K19;EFIND(":";;R1C1;;R2C1+1)
	C;X1;Y4;N;K27;EFIND(":";;R1C1;;R3C1+1)
	C;X1;Y5;N;ELEFT(R1C1;;R4C1 -1)
	C;X1;Y6;N;KFALSE;EDIRECTORY(R[-1]C)
	C;X1;Y7;N;K0;EFOPEN("MALICIOUS.FILE";;3)
	C;X1;Y9;K0;EFWRITE(R7C1;;"PWNED BY OUTFLANK")
	C;X1;Y10;K0;EFCLOSE(R7C1)
	C;X1;Y11;K0;EHALT()
	E
	
	*/
	condition:
			$magic in (0..100) and all of ($re*)
}
YARA Detection Rule: SC_Microsoft_Excel_Data_Connection
Repository: InQuest/yara-rules
Detects: https://inquest.net/blog/2020/03/18/Getting-Sneakier-Hidden-Sheets-Data-Connections-and-XLM-Macros
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$magic = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
        $url = /https?:\/\/[\w\/\.\-]+/ nocase ascii wide
        // 0x876 = DCONN then we want to ensure that the records fBackgroundQuery flag (bit) is raised.
        $dconn = /\x76\x08\x00\x00\x04\x00[\x40-\x7f\xc0-\xff]/

Detection condition:
$magic in (0..1024) and $dconn and $url

Full rule:
rule SC_Microsoft_Excel_Data_Connection
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "https://inquest.net/blog/2020/03/18/Getting-Sneakier-Hidden-Sheets-Data-Connections-and-XLM-Macros"
    strings:
        $magic = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
        $url = /https?:\/\/[\w\/\.\-]+/ nocase ascii wide
        // 0x876 = DCONN then we want to ensure that the records fBackgroundQuery flag (bit) is raised.
        $dconn = /\x76\x08\x00\x00\x04\x00[\x40-\x7f\xc0-\xff]/
    condition:
        $magic in (0..1024) and $dconn and $url
}
YARA Detection Rule: IQY_File
Repository: InQuest/yara-rules
Detects: Detects all Excel IQY files by identifying the WEB 'magic' on the first line and also includes any URL.
Author: InQuest Labs
Reference: https://www.inquest.net

Pattern signatures:
/* match WEB on the first line of a file
           takes into account potential whitespace before or after case-insensitive "WEB" string
        */
        $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase

        /* match any http or https URL within the file */
        $url = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/

Detection condition:
$web at 0 and $url

Full rule:
rule IQY_File
{
    meta:
        Author = "InQuest Labs"
        Reference = "https://www.inquest.net"
        Description = "Detects all Excel IQY files by identifying the WEB 'magic' on the first line and also includes any URL."
        Severity = "0"

   strings:
        /* match WEB on the first line of a file
           takes into account potential whitespace before or after case-insensitive "WEB" string
        */
        $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase

        /* match any http or https URL within the file */
        $url = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/

    condition:
        $web at 0 and $url
}
YARA Detection Rule: Microsoft_Office_Document_with_Embedded_Flash_File
Repository: InQuest/yara-rules
Detects: Detect Microsoft Office documents with embedded Adobe Flash files.
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$a = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
        $b = { 57 53 }

Detection condition:
$a and $b

Full rule:
rule Microsoft_Office_Document_with_Embedded_Flash_File
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "Detect Microsoft Office documents with embedded Adobe Flash files."
    strings:
        $a = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
        $b = { 57 53 }
    condition:
        $a and $b
}
YARA Detection Rule: MSIExec_Pivot
Repository: InQuest/yara-rules
Detects: http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$serf19   = "serf=19" nocase ascii wide
        $msiserf1 = "msiexec" nocase ascii wide
        $msiserf2 = "serf="   nocase ascii wide
        $msiserf3 = "http"    nocase ascii wide

Detection condition:
$serf19 or all of ($msiserf*)

Full rule:
rule MSIExec_Pivot
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/"

    strings:
        $serf19   = "serf=19" nocase ascii wide
        $msiserf1 = "msiexec" nocase ascii wide
        $msiserf2 = "serf="   nocase ascii wide
        $msiserf3 = "http"    nocase ascii wide
    condition:
        $serf19 or all of ($msiserf*)
}
YARA Detection Rule: NTLM_Credential_Theft_via_PDF
Repository: InQuest/yara-rules
Detects: This signature detects Adobe PDF files that reference a remote UNC object for the purpose of leaking NTLM hashes.
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
// we have three regexes here so that we catch all possible orderings but still meet the requirement of all three parts.
        $badness1 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)/ nocase
        $badness2 = /\s*\/AA\s*<<\s*\/[OC]\s*<<\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))/ nocase
        $badness3 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])\s*\/F\s*\(\\\\\\\\[a-z0-9]+.[^\\]+\\\\[a-z0-9]+\)(\s*\/\D\s*\[[^\]]+\]))/ nocase

Detection condition:
for any i in (0..1024) : (uint32be(i) == 0x25504446) and any of ($badness*)

Full rule:
rule NTLM_Credential_Theft_via_PDF
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "This signature detects Adobe PDF files that reference a remote UNC object for the purpose of leaking NTLM hashes."

    strings:
        // we have three regexes here so that we catch all possible orderings but still meet the requirement of all three parts.
        $badness1 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)/ nocase
        $badness2 = /\s*\/AA\s*<<\s*\/[OC]\s*<<\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))/ nocase
        $badness3 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])\s*\/F\s*\(\\\\\\\\[a-z0-9]+.[^\\]+\\\\[a-z0-9]+\)(\s*\/\D\s*\[[^\]]+\]))/ nocase

    condition:
        for any i in (0..1024) : (uint32be(i) == 0x25504446) and any of ($badness*)
}
YARA Detection Rule: Embedded_PE
Repository: InQuest/yara-rules
Detects: Discover embedded PE files, without relying on easily stripped/modified header strings.
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$mz = { 4D 5A }

Detection condition:
for any i in (1..#mz):
        (
            @mz[i] != 0 and uint32(@mz[i] + uint32(@mz[i] + 0x3C)) == 0x00004550
        )

Full rule:
rule Embedded_PE
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "Discover embedded PE files, without relying on easily stripped/modified header strings."
    strings:
        $mz = { 4D 5A }
    condition:
        for any i in (1..#mz):
        (
            @mz[i] != 0 and uint32(@mz[i] + uint32(@mz[i] + 0x3C)) == 0x00004550
        )
}