deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_installdate
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file installdate.pl
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
        $x2 = "print \"Gimme hex: \";" fullword ascii
        $x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
        $s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
        $s2 = "if (not($cmdInput)) {" fullword ascii
        $s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii

Detection condition:
filesize < 2KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule EQGRP_installdate 
{

    meta:
        description = "Detects tool from EQGRP toolset - file installdate.pl"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
        $x2 = "print \"Gimme hex: \";" fullword ascii
        $x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
        $s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
        $s2 = "if (not($cmdInput)) {" fullword ascii
        $s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii

    condition:
        filesize < 2KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: EQGRP_teflondoor
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file teflondoor.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
        $x2 = "%s: %li b (%li%%)" fullword ascii
        $s1 = "no winsock" fullword ascii
        $s2 = "%s: %s file '%s'" fullword ascii
        $s3 = "peer: connect" fullword ascii
        $s4 = "read: write" fullword ascii
        $s5 = "%s: done!" fullword ascii
        $s6 = "%s: %li b" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them

Full rule:
rule EQGRP_teflondoor 
{

    meta:
        description = "Detects tool from EQGRP toolset - file teflondoor.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
        $x2 = "%s: %li b (%li%%)" fullword ascii
        $s1 = "no winsock" fullword ascii
        $s2 = "%s: %s file '%s'" fullword ascii
        $s3 = "peer: connect" fullword ascii
        $s4 = "read: write" fullword ascii
        $s5 = "%s: done!" fullword ascii
        $s6 = "%s: %li b" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them
}
YARA Detection Rule: EQGRP_durablenapkin_solaris_2_0_1
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
        $s2 = "send_request: putmsg \"%s\": %s" fullword ascii
        $s3 = "port undefined" fullword ascii
        $s4 = "recv_ack: %s getmsg: %s" fullword ascii
        $s5 = ">> %d -- %d" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 2 of them )

Full rule:
rule EQGRP_durablenapkin_solaris_2_0_1 
{

    meta:
        description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
        $s2 = "send_request: putmsg \"%s\": %s" fullword ascii
        $s3 = "port undefined" fullword ascii
        $s4 = "recv_ack: %s getmsg: %s" fullword ascii
        $s5 = ">> %d -- %d" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 40KB and 2 of them )
}
YARA Detection Rule: EQGRP_teflonhandle
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file teflonhandle.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
        $s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
        $s3 = "Random Key : 0x" fullword ascii
        $s4 = "done (%i bytes written)." fullword ascii
        $s5 = "%s --> %s..." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and 2 of them

Full rule:
rule EQGRP_teflonhandle 
{

    meta:
        description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
        $s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
        $s3 = "Random Key : 0x" fullword ascii
        $s4 = "done (%i bytes written)." fullword ascii
        $s5 = "%s --> %s..." fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
}
YARA Detection Rule: EQGRP_false
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file false.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
            00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
            2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
            0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
            0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
            00 25 64 20 2D 20 25 64 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and $s1

Full rule:
rule EQGRP_false 
{

    meta:
        description = "Detects tool from EQGRP toolset - file false.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
            00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
            00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
            2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
            0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
            0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
            00 25 64 20 2D 20 25 64 }

    condition:
        uint16(0) == 0x5a4d and filesize < 50KB and $s1
}
YARA Detection Rule: EQGRP_bc_genpkt
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file bc-genpkt
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "load auxiliary object=%s requested by file=%s" fullword ascii
        $x2 = "size of new packet, should be %d <= size <= %d bytes" fullword ascii
        $x3 = "verbosity - show lengths, packet dumps, etc" fullword ascii
        $s1 = "%s: error while loading shared libraries: %s%s%s%s%s" fullword ascii
        $s2 = "cannot dynamically load executable" fullword ascii
        $s3 = "binding file %s to %s: %s symbol `%s' [%s]" fullword ascii
        $s4 = "randomize the initiator cookie" fullword ascii

Detection condition:
uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($s*) and 3 of them )

Full rule:
rule EQGRP_bc_genpkt 
{

    meta:
        description = "Detects tool from EQGRP toolset - file bc-genpkt"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $x1 = "load auxiliary object=%s requested by file=%s" fullword ascii
        $x2 = "size of new packet, should be %d <= size <= %d bytes" fullword ascii
        $x3 = "verbosity - show lengths, packet dumps, etc" fullword ascii
        $s1 = "%s: error while loading shared libraries: %s%s%s%s%s" fullword ascii
        $s2 = "cannot dynamically load executable" fullword ascii
        $s3 = "binding file %s to %s: %s symbol `%s' [%s]" fullword ascii
        $s4 = "randomize the initiator cookie" fullword ascii
    
    condition:
        uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($s*) and 3 of them )
}
YARA Detection Rule: EQGRP_dn_1_0_2_1
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file dn.1.0.2.1.linux
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
        $s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
        $s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
        $s4 = "Not everything is set yet" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 2 of them )

Full rule:
rule EQGRP_dn_1_0_2_1 
{

    meta:
        description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
        $s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
        $s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
        $s4 = "Not everything is set yet" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 30KB and 2 of them )
}
YARA Detection Rule: EQGRP_morel
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file morel.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "%d - %d, %d" fullword ascii
        $s2 = "%d - %lu.%lu %d.%lu" fullword ascii
        $s3 = "%d - %d %d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 60KB and all of them )

Full rule:
rule EQGRP_morel 
{

    meta:
        description = "Detects tool from EQGRP toolset - file morel.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"
        hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"

    strings:
        $s1 = "%d - %d, %d" fullword ascii
        $s2 = "%d - %lu.%lu %d.%lu" fullword ascii
        $s3 = "%d - %d %d" fullword ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
}
YARA Detection Rule: EQGRP_bc_parser
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file bc-parser
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
        $s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii

Detection condition:
uint16(0) == 0x457f and 1 of them

Full rule:
rule EQGRP_bc_parser 
{

    meta:
        description = "Detects tool from EQGRP toolset - file bc-parser"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"
        hash1 = "879f2f1ae5d18a3a5310aeeafec[PII_REDACTED]9644e5ecb7d8a72f0877ac19cee"

    strings:
        $s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
        $s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii

    condition:
        uint16(0) == 0x457f and 1 of them
}
YARA Detection Rule: EQGRP_1212
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file 1212.pl
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
        $s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
        $s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
        $s4 = "$dstport=hextoPort($dstport);" fullword ascii
        $s5 = "sub hextoPort" fullword ascii
        $s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii

Detection condition:
filesize < 6KB and 4 of them

Full rule:
rule EQGRP_1212 
{

    meta:
        description = "Detects tool from EQGRP toolset - file 1212.pl"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
        $s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
        $s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
        $s4 = "$dstport=hextoPort($dstport);" fullword ascii
        $s5 = "sub hextoPort" fullword ascii
        $s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii

    condition:
        filesize < 6KB and 4 of them
}
YARA Detection Rule: EQGRP_1212_dehex
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
        $s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
        $s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
        $s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
        $s5 = "print hextoIP($ARGV[0]);" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )

Full rule:
rule EQGRP_1212_dehex 
{

    meta:
        description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
        $s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
        $s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
        $s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
        $s5 = "print hextoIP($ARGV[0]);" fullword ascii

    condition:
        ( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: install_get_persistent_filenames
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file install_get_persistent_filenames
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Generates the persistence file name and prints it out." fullword ascii

Detection condition:
( uint16(0) == 0x457f and all of them )

Full rule:
rule install_get_persistent_filenames 
{

    meta:
        description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"

    strings:
        $s1 = "Generates the persistence file name and prints it out." fullword ascii

    condition:
        ( uint16(0) == 0x457f and all of them )
}
YARA Detection Rule: EQGRP_create_dns_injection
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file create_dns_injection.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
        $s2 = "-a www.badguy.net,CNAME,1800,host.badguy.net \\\\" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_create_dns_injection
{

    meta:
        description = "EQGRP Toolset Firewall - file create_dns_injection.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"

    strings:
        $s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
        $s2 = "-a www.badguy.net,CNAME,1800,host.badguy.net \\\\" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_screamingplow
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file screamingplow.sh
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "What is the name of your PBD:" fullword ascii
        $s2 = "You are now ready for a ScreamPlow" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_screamingplow 
{

    meta:
        description = "EQGRP Toolset Firewall - file screamingplow.sh"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"

    strings:
        $s1 = "What is the name of your PBD:" fullword ascii
        $s2 = "You are now ready for a ScreamPlow" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_MixText
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file MixText.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "BinStore enabled implants." fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_MixText 
{

    meta:
        description = "EQGRP Toolset Firewall - file MixText.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"

    strings:
        $s1 = "BinStore enabled implants." fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_tunnel_state_reader
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file tunnel_state_reader
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
        $s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_tunnel_state_reader 
{

    meta:
        description = "EQGRP Toolset Firewall - file tunnel_state_reader"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "49d48ca1ec741f462fde80da68b64dfa[PII_REDACTED]520d29e345ef563113616c"

    strings:
        $s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
        $s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_payload
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file payload.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "can't find target version module!" fullword ascii
        $s2 = "class Payload:" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_payload 
{

    meta:
        description = "EQGRP Toolset Firewall - file payload.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"

    strings:
        $s1 = "can't find target version module!" fullword ascii
        $s2 = "class Payload:" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: EQGRP_eligiblecandidate
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file eligiblecandidate.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
        $o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
        $c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
        $c2 = "self.build_exploit_payload(cmd)" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_eligiblecandidate 
{

    meta:
        description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"

    strings:
        $o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
        $o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
        $c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
        $c2 = "self.build_exploit_payload(cmd)" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_BUSURPER_2211_724
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BUSURPER-2211-724.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
        $s2 = "_start_text" fullword ascii
        $s3 = "IMPLANT" fullword ascii
        $s4 = "KEEPGOING" fullword ascii
        $s5 = "upgrade_implant" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_BUSURPER_2211_724 
{

    meta:
        description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"

    strings:
        $s1 = ".got_loader" fullword ascii
        $s2 = "_start_text" fullword ascii
        $s3 = "IMPLANT" fullword ascii
        $s4 = "KEEPGOING" fullword ascii
        $s5 = "upgrade_implant" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: EQGRP_networkProfiler_orderScans
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file networkProfiler_orderScans.sh
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Unable to save off predefinedScans directory" fullword ascii
        $x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_networkProfiler_orderScans 
{

    meta:
        description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"

    strings:
        $x1 = "Unable to save off predefinedScans directory" fullword ascii
        $x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_epicbanana_2_1_0_1
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "failed to create version-specific payload" fullword ascii
        $s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_epicbanana_2_1_0_1 
{

    meta:
        description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"

    strings:
        $s1 = "failed to create version-specific payload" fullword ascii
        $s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_sniffer_xml2pcap
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file sniffer_xml2pcap
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
        $x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_sniffer_xml2pcap 
{

    meta:
        description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"

    strings:
        $x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
        $x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii

    condition:
        1 of them
}