deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Xtreme_Sep17_1
Repository: Neo23x0/signature-base
Detects: Detects XTREME sample analyzed in September 2017
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "ServerKeyloggerU" fullword ascii
      $x2 = "TServerKeylogger" fullword ascii
      $x3 = "XtremeKeylogger" fullword wide
      $x4 = "XTREMEBINDER" fullword wide

      $s1 = "shellexecute=" fullword wide
      $s2 = "[Execute]" fullword wide
      $s3 = ";open=RECYCLER\\S-1-5-2[PII_REDACTED][PII_REDACTED]-682[PII_REDACTED]\\" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 4000KB and (
         pe.imphash() == "735af2a144f62c50ba8e89c1c59764eb" or
         ( 1 of ($x*) or 3 of them )
      )

Full rule:
rule Xtreme_Sep17_1 {
   meta:
      description = "Detects XTREME sample analyzed in September 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-27"
      hash1 = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
      id = "7517e237-9cad-5619-9028-4c7ab5463040"
   strings:
      $x1 = "ServerKeyloggerU" fullword ascii
      $x2 = "TServerKeylogger" fullword ascii
      $x3 = "XtremeKeylogger" fullword wide
      $x4 = "XTREMEBINDER" fullword wide

      $s1 = "shellexecute=" fullword wide
      $s2 = "[Execute]" fullword wide
      $s3 = ";open=RECYCLER\\S-1-5-2[PII_REDACTED][PII_REDACTED]-682[PII_REDACTED]\\" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 4000KB and (
         pe.imphash() == "735af2a144f62c50ba8e89c1c59764eb" or
         ( 1 of ($x*) or 3 of them )
      )
}
YARA Detection Rule: Xtreme_Sep17_2
Repository: Neo23x0/signature-base
Detects: Detects XTREME sample analyzed in September 2017
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Spy24.exe" fullword wide
      $s2 = "Remote Service Application" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and all of them )

Full rule:
rule Xtreme_Sep17_2 {
   meta:
      description = "Detects XTREME sample analyzed in September 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-27"
      hash1 = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
      id = "b4878e80-54dc-5a16-9129-ddf2b1a5d287"
   strings:
      $s1 = "Spy24.exe" fullword wide
      $s2 = "Remote Service Application" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 3000KB and all of them )
}
YARA Detection Rule: Xtreme_Sep17_3
Repository: Neo23x0/signature-base
Detects: Detects XTREME sample analyzed in September 2017
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s2 = "Keylogg" fullword ascii
      $s4 = "XTREME" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and all of them )

Full rule:
rule Xtreme_Sep17_3 {
   meta:
      description = "Detects XTREME sample analyzed in September 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-27"
      hash1 = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
      id = "160673ea-b263-520a-a1c1-da0f3e920f12"
   strings:
      $s2 = "Keylogg" fullword ascii
      $s4 = "XTREME" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and all of them )
}
YARA Detection Rule: Xtreme_RAT_Gen_Imp
Repository: Neo23x0/signature-base
Detects: Detects XTREME sample analyzed in September 2017
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "d0bdf112886f3d846cc7780967d8efb9" or
         pe.imphash() == "cc6f630f214cf890e63e899d8ebabba6" or
         pe.imphash() == "e0f7991d50ceee521d7190effa3c494e"
      )

Full rule:
rule Xtreme_RAT_Gen_Imp {
   meta:
      description = "Detects XTREME sample analyzed in September 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-27"
      hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
      id = "10b23099-2a87-5918-927b-f20bcba1cd70"
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "d0bdf112886f3d846cc7780967d8efb9" or
         pe.imphash() == "cc6f630f214cf890e63e899d8ebabba6" or
         pe.imphash() == "e0f7991d50ceee521d7190effa3c494e"
      )
}
YARA Detection Rule: APT_ArtraDownloader2_Aug19_1
Repository: Neo23x0/signature-base
Detects: Detects ArtraDownloader malware
Author: Florian Roth (Nextron Systems)
Reference: https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/

Pattern signatures:
$xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
               26 65 3D 00 25 32 30 }
      $xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
      $xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
      $xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
               0A 0D 0A 25 73 }
      $x1 = "Tpguxbsf]Njdsptpgu" ascii
      $x2 = ".gpsn.vsmfodpefe" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and 1 of them

Full rule:
rule APT_ArtraDownloader2_Aug19_1 {
   meta:
      description = "Detects ArtraDownloader malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
      date = "2019-08-27"
      hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
      id = "0e688e92-2366-5f36-a32d-083982181eb7"
   strings:
      $xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
               26 65 3D 00 25 32 30 }
      $xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
      $xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
      $xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
               0A 0D 0A 25 73 }
      $x1 = "Tpguxbsf]Njdsptpgu" ascii
      $x2 = ".gpsn.vsmfodpefe" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and 1 of them
}
YARA Detection Rule: generic_carbon
Repository: Neo23x0/signature-base
Detects: Turla Carbon malware
Author: ESET Research
Reference: https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/

Pattern signatures:
$s1 = "ModStart"
    $t1 = "STOP|OK"
    $t2 = "STOP|KILL"

Detection condition:
(uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*))

Full rule:
rule generic_carbon
{
  meta:
    author      = "ESET Research"
    date        = "2017-03-30"
    description = "Turla Carbon malware"
    reference   = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
    source = "https://github.com/eset/malware-ioc/"
    contact = "github@eset.com"
    license = "BSD 2-Clause"

    id = "efdc0d16-a974-5c00-a401-391d60f3081e"
  strings:
    $s1 = "ModStart"
    $t1 = "STOP|OK"
    $t2 = "STOP|KILL"

  condition:
    (uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*))
}
YARA Detection Rule: carbon_metadata
Repository: Neo23x0/signature-base
Detects: Turla Carbon malware
Author: ESET Research
Reference: https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/

Detection condition:
(pe.version_info["InternalName"] contains "SERVICE.EXE" or
       pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or
       pe.version_info["InternalName"] contains "MSXIML.DLL")
       and pe.version_info["CompanyName"] contains "Microsoft Corporation"

Full rule:
rule carbon_metadata
{
  meta:
    author      = "ESET Research"
    date        = "2017-03-30"
    description = "Turla Carbon malware"
    reference   = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
    source = "https://github.com/eset/malware-ioc/"
    contact = "github@eset.com"
    license = "BSD 2-Clause"

    id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"
   condition:
      (pe.version_info["InternalName"] contains "SERVICE.EXE" or
       pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or
       pe.version_info["InternalName"] contains "MSXIML.DLL")
       and pe.version_info["CompanyName"] contains "Microsoft Corporation"
}
YARA Detection Rule: skeleton_key_patcher
Repository: Neo23x0/signature-base
Detects: Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN
Author: Dell SecureWorks Counter Threat Unit
Reference: http://goo.gl/aAk3lN

Pattern signatures:
$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"

		$name = "HookDC.dll"

		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"

Detection condition:
all of them

Full rule:
rule skeleton_key_patcher
{
	meta:
		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
		id = "a2805cce-7605-58a4-85ce-9dff5586858e"
	strings:
		$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"

		$name = "HookDC.dll"

		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
	condition:
		all of them
}
YARA Detection Rule: skeleton_key_injected_code
Repository: Neo23x0/signature-base
Detects: Skeleton Key injected Code http://goo.gl/aAk3lN
Author: Dell SecureWorks Counter Threat Unit
Reference: http://goo.gl/aAk3lN

Pattern signatures:
$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }

		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }

		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 4

Detection condition:
any of them

Full rule:
rule skeleton_key_injected_code
{
	meta:
		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
		id = "29daaffa-cd9d-55d3-b79d-cde1c76e9e45"
	strings:
		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }

		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }

		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

	condition:
		any of them
}
YARA Detection Rule: WEBSHELL_JSP_Nov21_1
Repository: Neo23x0/signature-base
Detects: Detects JSP webshells
Author: Florian Roth (Nextron Systems)
Reference: https://www.ic3.gov/Media/News/2021/211117-2.pdf

Pattern signatures:
$x1 = "request.getParameter(\"pwd\")" ascii
      $x2 = "excuteCmd(request.getParameter(" ascii
      $x3 = "getRuntime().exec (request.getParameter(" ascii
      $x4 = "private static final String PW = \"whoami\"" ascii

Detection condition:
filesize < 400KB and 1 of them

Full rule:
rule WEBSHELL_JSP_Nov21_1 {
   meta:
      description = "Detects JSP webshells"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
      date = "2021-11-23"
      score = 70
      id = "117eed28-c44e-5983-b4c7-b555fc06d923"
   strings:
      $x1 = "request.getParameter(\"pwd\")" ascii
      $x2 = "excuteCmd(request.getParameter(" ascii
      $x3 = "getRuntime().exec (request.getParameter(" ascii
      $x4 = "private static final String PW = \"whoami\"" ascii
   condition:
      filesize < 400KB and 1 of them
}
YARA Detection Rule: EXPL_POC_SpringCore_0day_Indicators_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found after SpringCore exploitation attempts and in the POC script
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/vxunderground/status/[PII_REDACTED]69943303

Pattern signatures:
$x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
      $x2 = "?pwd=j&cmd=whoami"
      $x3 = ".getParameter(%22pwd%22)"
      $x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"

Detection condition:
1 of them

Full rule:
rule EXPL_POC_SpringCore_0day_Indicators_Mar22_1 {
   meta:
      description = "Detects indicators found after SpringCore exploitation attempts and in the POC script"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/vxunderground/status/[PII_REDACTED]69943303"
      date = "2022-03-30"
      score = 70
      id = "297e4b57-f831-56e0-a391-1ffbc9a4d438"
   strings:
      $x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
      $x2 = "?pwd=j&cmd=whoami"
      $x3 = ".getParameter(%22pwd%22)"
      $x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"
   condition:
      1 of them
}
YARA Detection Rule: EXPL_POC_SpringCore_0day_Webshell_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects webshell found after SpringCore exploitation attempts POC script
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/vxunderground/status/[PII_REDACTED]69943303

Pattern signatures:
$x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
      $x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
      $x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"

Detection condition:
filesize < 200KB and 1 of them

Full rule:
rule EXPL_POC_SpringCore_0day_Webshell_Mar22_1 {
   meta:
      description = "Detects webshell found after SpringCore exploitation attempts POC script"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/vxunderground/status/[PII_REDACTED]69943303"
      date = "2022-03-30"
      score = 70
      id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
   strings:
      $x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
      $x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
      $x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
   condition:
     filesize < 200KB and 1 of them
}
YARA Detection Rule: IronPanda_DNSTunClient
Repository: Neo23x0/signature-base
Detects: Iron Panda malware DnsTunClient - file named.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
		$s5 = "taskkill /im conime.exe" fullword ascii
		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) 
		or
		5 of them

Full rule:
rule IronPanda_DNSTunClient {
	meta:
		description = "Iron Panda malware DnsTunClient - file named.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		score = 80
		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
		id = "dd608176-d7e7-5819-a7d4-e8b89d4a59c2"
	strings:
		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
		$s5 = "taskkill /im conime.exe" fullword ascii
		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) 
		or
		5 of them
}
YARA Detection Rule: IronPanda_Malware1
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$x1 = "activedsimp.dll" fullword wide
		$s1 = "get_BadLoginAddress" fullword ascii
		$s2 = "get_LastFailedLogin" fullword ascii
		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
		$s4 = "get_PasswordExpirationDate" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule IronPanda_Malware1 {
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
		id = "14dc2611-4ca9-5dd2-ad00-9397a18d7be2"
	strings:
		$x1 = "activedsimp.dll" fullword wide
		$s1 = "get_BadLoginAddress" fullword ascii
		$s2 = "get_LastFailedLogin" fullword ascii
		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
		$s4 = "get_PasswordExpirationDate" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: IronPanda_Webshell_JSP
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware JSP
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii

Detection condition:
filesize < 330KB and 1 of them

Full rule:
rule IronPanda_Webshell_JSP {
	meta:
		description = "Iron Panda Malware JSP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
		id = "[PII_REDACTED]-a731-4f1d64e07588"
	strings:
		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
	condition:
		filesize < 330KB and 1 of them
}