deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Imphash_PassRevealer_PY_EXE
Repository: Neo23x0/signature-base
Detects: Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$fp1 = "Assmann Electronic GmbH" ascii wide
      $fp2 = "Oculus VR" ascii wide
      $fp3 = "efm8load" ascii  /* Corsair software */

Detection condition:
uint16(0) == 0x5a4d and filesize < 10000KB
      and pe.imphash() == "ed61beebc8d019dd9bec823e2d694afd"
      and not 1 of ($fp*)

Full rule:
rule SUSP_Imphash_PassRevealer_PY_EXE {
   meta:
      description = "Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-04-06"
      modified = "2021-11-09"
      score = 40
      hash1 = "371f104b7876b9080c[PII_REDACTED]35f36edb6668097de475949b84ab72ee9a9a"
      id = "9462dfc4-2feb-591d-ac0c-ba02f093c216"
   strings:
      $fp1 = "Assmann Electronic GmbH" ascii wide
      $fp2 = "Oculus VR" ascii wide
      $fp3 = "efm8load" ascii  /* Corsair software */
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB
      and pe.imphash() == "ed61beebc8d019dd9bec823e2d694afd"
      and not 1 of ($fp*)
}
YARA Detection Rule: MAL_Unknown_PWDumper_Apr18_3
Repository: Neo23x0/signature-base
Detects: Detects sample from unknown sample set - IL origin
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "loaderx86.dll" fullword ascii
      $s2 = "tcpsvcs.exe" fullword wide
      $s3 = "%Program Files, Common FOLDER%" fullword wide
      $s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
      $s5 = "loaderx86" fullword ascii
      $s6 = "TNtDllHook$" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of them

Full rule:
rule MAL_Unknown_PWDumper_Apr18_3 {
   meta:
      description = "Detects sample from unknown sample set - IL origin"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-04-06"
      hash1 = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
      hash2 = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
      id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"
   strings:
      $s1 = "loaderx86.dll" fullword ascii
      $s2 = "tcpsvcs.exe" fullword wide
      $s3 = "%Program Files, Common FOLDER%" fullword wide
      $s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
      $s5 = "loaderx86" fullword ascii
      $s6 = "TNtDllHook$" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}
YARA Detection Rule: ProcessInjector_Gen
Repository: Neo23x0/signature-base
Detects: Detects a process injection utility that can be used ofr good and bad purposes
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c

Pattern signatures:
$x1 = "Error injecting remote thread in process:" fullword ascii
      $s5 = "[-] Error getting access to process: %ld!" fullword ascii
      $s6 = "--process-name <name>  Process name to inject" fullword ascii
      $s12 = "No injection target has been provided!" fullword ascii
      $s17 = "[-] An app path is required when not injecting!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and (
         pe.imphash() == "d27e0fa013d7ae41be12aaf221e41f9b" or
         1 of them
      ) or 3 of them

Full rule:
rule ProcessInjector_Gen: HIGHVOL {
   meta:
      description = "Detects a process injection utility that can be used ofr good and bad purposes"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
      date = "2018-04-23"
      score = 60
      hash1 = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
      id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"
   strings:
      $x1 = "Error injecting remote thread in process:" fullword ascii
      $s5 = "[-] Error getting access to process: %ld!" fullword ascii
      $s6 = "--process-name <name>  Process name to inject" fullword ascii
      $s12 = "No injection target has been provided!" fullword ascii
      $s17 = "[-] An app path is required when not injecting!" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 50KB and (
         pe.imphash() == "d27e0fa013d7ae41be12aaf221e41f9b" or
         1 of them
      ) or 3 of them
}
YARA Detection Rule: Lazagne_PW_Dumper
Repository: Neo23x0/signature-base
Detects: Detects Lazagne PW Dumper
Author: Markus Neis / Florian Roth
Reference: https://github.com/AlessandroZ/LaZagne/releases/

Pattern signatures:
$s1 = "Crypto.Hash" fullword ascii
      $s2 = "laZagne" fullword ascii
      $s3 = "impacket.winregistry" fullword ascii

Detection condition:
3 of them

Full rule:
rule Lazagne_PW_Dumper {
   meta:
      description = "Detects Lazagne PW Dumper"
      author = "Markus Neis / Florian Roth"
      reference = "https://github.com/AlessandroZ/LaZagne/releases/"
      date = "2018-03-22"
      score = 70
      id = "1904029e-9336-5278-ae2e-4bc853316600"
   strings:
      $s1 = "Crypto.Hash" fullword ascii
      $s2 = "laZagne" fullword ascii
      $s3 = "impacket.winregistry" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: HKTL_shellpop_TCLsh
Repository: Neo23x0/signature-base
Detects: Detects suspicious TCLsh popshell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii

Detection condition:
filesize < 1KB and 1 of them

Full rule:
rule HKTL_shellpop_TCLsh {
   meta:
      description = "Detects suspicious TCLsh popshell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
      id = "24f6b626-383e-54c9-abd4-bd67c37af937"
   strings:
      $s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii
   condition:
      filesize < 1KB and 1 of them
}
YARA Detection Rule: HKTL_shellpop_ruby
Repository: Neo23x0/signature-base
Detects: Detects suspicious ruby shellpop
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii

Detection condition:
filesize < 1KB and all of them

Full rule:
rule HKTL_shellpop_ruby {
   meta:
      description = "Detects suspicious ruby shellpop"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
      id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"
   strings:
      $x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii
   condition:
      filesize < 1KB and all of them
}
YARA Detection Rule: HKTL_shellpop_awk
Repository: Neo23x0/signature-base
Detects: Detects suspicious AWK Shellpop
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
      $s2 = "; while(42) " ascii

Detection condition:
filesize < 1KB and 1 of them

Full rule:
rule HKTL_shellpop_awk {
   meta:
      description = "Detects suspicious AWK Shellpop"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
      id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"
   strings:
      $s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
      $s2 = "; while(42) " ascii
   condition:
      filesize < 1KB and 1 of them
}
YARA Detection Rule: HKTL_shellpop_Netcat_UDP
Repository: Neo23x0/signature-base
Detects: Detects suspicious netcat popshell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$s1 = "mkfifo fifo ; nc.traditional -u" ascii
      $s2 = "< fifo | { bash -i; } > fifo" fullword ascii

Detection condition:
filesize < 1KB and 1 of them

Full rule:
rule HKTL_shellpop_Netcat_UDP {
   meta:
      description = "Detects suspicious netcat popshell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee[PII_REDACTED]e88be"
      id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"
   strings:
      $s1 = "mkfifo fifo ; nc.traditional -u" ascii
      $s2 = "< fifo | { bash -i; } > fifo" fullword ascii
   condition:
      filesize < 1KB and 1 of them
}
YARA Detection Rule: HKTL_shellpop_socat
Repository: Neo23x0/signature-base
Detects: Detects suspicious socat popshell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$s1 = "socat tcp-connect" ascii
      $s2 = ",pty,stderr,setsid,sigint,sane" ascii

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule HKTL_shellpop_socat {
   meta:
      description = "Detects suspicious socat popshell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
      id = "23c331ba-217c-5b17-b45e-d553eea76a56"
   strings:
      $s1 = "socat tcp-connect" ascii
      $s2 = ",pty,stderr,setsid,sigint,sane" ascii
   condition:
      filesize < 1KB and 2 of them
}
YARA Detection Rule: HKTL_shellpop_Perl
Repository: Neo23x0/signature-base
Detects: Detects Shellpop Perl script
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
      $ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii

Detection condition:
filesize < 2KB and 1 of them

Full rule:
rule HKTL_shellpop_Perl {
   meta:
      description = "Detects Shellpop Perl script"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
      id = "d597d213-a70b-5412-adde-791b4d498848"
   strings:
      $ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
      $ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii
   condition:
      filesize < 2KB and 1 of them
}
YARA Detection Rule: HKTL_shellpop_Python
Repository: Neo23x0/signature-base
Detects: Detects malicious python shell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$ = "os.putenv('HISTFILE', '/dev/null');" ascii

Detection condition:
filesize < 2KB and 1 of them

Full rule:
rule HKTL_shellpop_Python {
   meta:
      description = "Detects malicious python shell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
      id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"
   strings:
      $ = "os.putenv('HISTFILE', '/dev/null');" ascii
   condition:
      filesize < 2KB and 1 of them
}
YARA Detection Rule: HKTL_shellpop_PHP_TCP
Repository: Neo23x0/signature-base
Detects: Detects malicious PHP shell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$x1 = "php -r \"\\$sock=fsockopen" ascii
      $x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii

Detection condition:
filesize < 3KB and all of them

Full rule:
rule HKTL_shellpop_PHP_TCP {
   meta:
      description = "Detects malicious PHP shell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
      id = "3bafc225-62e5-5183-84aa-9c3406b6c444"
   strings:
      $x1 = "php -r \"\\$sock=fsockopen" ascii
      $x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii
   condition:
      filesize < 3KB and all of them
}
YARA Detection Rule: HKTL_shellpop_Powershell_TCP
Repository: Neo23x0/signature-base
Detects: Detects malicious powershell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$ = "Something went wrong with execution of command on the target" ascii
      $ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii

Detection condition:
filesize < 3KB and 1 of them

Full rule:
rule HKTL_shellpop_Powershell_TCP {
   meta:
      description = "Detects malicious powershell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "[PII_REDACTED]696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
      id = "4f3a92db-f686-559a-9588-fb79f423c51f"
   strings:
      $ = "Something went wrong with execution of command on the target" ascii
      $ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii
   condition:
      filesize < 3KB and 1 of them
}
YARA Detection Rule: SUSP_Powershell_ShellCommand_May18_1
Repository: Neo23x0/signature-base
Detects: Detects a supcicious powershell commandline
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$x1 = "powershell -nop -ep bypass -Command" ascii

Detection condition:
filesize < 3KB and 1 of them

Full rule:
rule SUSP_Powershell_ShellCommand_May18_1 {
   meta:
      description = "Detects a supcicious powershell commandline"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "[PII_REDACTED]696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
      id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"
   strings:
      $x1 = "powershell -nop -ep bypass -Command" ascii
   condition:
      filesize < 3KB and 1 of them

}
YARA Detection Rule: HKTL_shellpop_Telnet_TCP
Repository: Neo23x0/signature-base
Detects: Detects malicious telnet shell
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
      $x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii

Detection condition:
filesize < 3KB and 1 of them

Full rule:
rule HKTL_shellpop_Telnet_TCP {
   meta:
      description = "Detects malicious telnet shell"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "cf5232bae[PII_REDACTED]adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
      id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"
   strings:
      $x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
      $x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii
   condition:
      filesize < 3KB and 1 of them
}
YARA Detection Rule: SUSP_shellpop_Bash
Repository: Neo23x0/signature-base
Detects: Detects susupicious bash command
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$x1 = "bash -i >& /dev/tcp/" ascii
      $x2 = "bash -i >& /dev/tcp/" ascii base64

      $fp1 = "bash -i >& /dev/tcp/IP/PORT" ascii

Detection condition:
1 of ($x*) and not 1 of ($fp*)

Full rule:
rule SUSP_shellpop_Bash {
   meta:
      description = "Detects susupicious bash command"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      modified = "2025-04-11"
      score = 70
      hash1 = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
      id = "771b7d01-272a-5986-af07-7417b84c52ed"
   strings:
      $x1 = "bash -i >& /dev/tcp/" ascii
      $x2 = "bash -i >& /dev/tcp/" ascii base64

      $fp1 = "bash -i >& /dev/tcp/IP/PORT" ascii
   condition:
      1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: HKTL_shellpop_netcat
Repository: Neo23x0/signature-base
Detects: Detects suspcious netcat shellpop
Author: Tobias Michalski
Reference: https://github.com/0x00-0x00/ShellPop

Pattern signatures:
$s1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
      $s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
      $s4 = "mknod /tmp/f p && nc" ascii
      $s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii

Detection condition:
filesize < 2KB and 1 of them

Full rule:
rule HKTL_shellpop_netcat {
   meta:
      description = "Detects suspcious netcat shellpop"
      author = "Tobias Michalski"
      reference = "https://github.com/0x00-0x00/ShellPop"
      date = "2018-05-18"
      hash1 = "98e3324f4c096bb1e[PII_REDACTED]a9e5c43c7913afa3070488b16d5b209e015ee"
      id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"
   strings:
      $s1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
      $s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
      $s4 = "mknod /tmp/f p && nc" ascii
      $s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii
   condition:
      filesize < 2KB and 1 of them
}
YARA Detection Rule: HKTL_beRootexe
Repository: Neo23x0/signature-base
Detects: Detects beRoot.exe which checks common Windows missconfigurations
Author: yarGen Rule Generator
Reference: https://github.com/AlessandroZ/BeRoot/tree/master/Windows

Pattern signatures:
$s1 = "checks.webclient.secretsdump(" ascii
      $s2 = "beroot.modules" fullword ascii
      $s3 = "beRoot.exe.manifest" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and
         filesize < 18000KB and
         1 of them)

Full rule:
rule HKTL_beRootexe {
   meta:
      description = "Detects beRoot.exe which checks common Windows missconfigurations"
      author = "yarGen Rule Generator"
      reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
      date = "2018-07-25"
      hash1 = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
      id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"
   strings:
      $s1 = "checks.webclient.secretsdump(" ascii
      $s2 = "beroot.modules" fullword ascii
      $s3 = "beRoot.exe.manifest" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and
         filesize < 18000KB and
         1 of them)
}
YARA Detection Rule: HKTL_beRootexe_output
Repository: Neo23x0/signature-base
Detects: Detects the output of beRoot.exe
Author: Tobias Michalski
Reference: https://github.com/AlessandroZ/BeRoot/tree/master/Windows

Pattern signatures:
$s1 = "permissions: {'change_config'" fullword wide
      $s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
      $s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
      $s4 = "! BANG BANG !" fullword wide

Detection condition:
filesize < 400KB and 3 of them

Full rule:
rule HKTL_beRootexe_output {
   meta:
      description = "Detects the output of beRoot.exe"
      author = "Tobias Michalski"
      reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
      date = "2018-07-25"
      id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"
   strings:
      $s1 = "permissions: {'change_config'" fullword wide
      $s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
      $s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
      $s4 = "! BANG BANG !" fullword wide
   condition:
      filesize < 400KB and 3 of them
}
YARA Detection Rule: HKTL_EmbeddedPDF
Repository: Neo23x0/signature-base
Detects: Detects Embedded PDFs which can start malicious content
Author: Tobias Michalski
Reference: https://twitter.com/infosecn1nja/status/[PII_REDACTED]99731968?s=12

Pattern signatures:
$x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii

      $s1 = "(This PDF document embeds file" fullword ascii
      $s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
      $s3 = "/Type /EmbeddedFile" fullword ascii

Detection condition:
uint16(0) == 0x5025 and
      2 of ($s*) and $x1

Full rule:
rule HKTL_EmbeddedPDF {
   meta:
      description = "Detects Embedded PDFs which can start malicious content"
      author = "Tobias Michalski"
      reference = "https://twitter.com/infosecn1nja/status/[PII_REDACTED]99731968?s=12"
      date = "2018-07-25"
      id = "d4e2d878-fb75-54c5-9879-fe94102911d1"
   strings:
      $x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii

      $s1 = "(This PDF document embeds file" fullword ascii
      $s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
      $s3 = "/Type /EmbeddedFile" fullword ascii
   condition:
      uint16(0) == 0x5025 and
      2 of ($s*) and $x1
}
YARA Detection Rule: HKTL_BlackBone_DriverInjector
Repository: Neo23x0/signature-base
Detects: Detects BlackBone Driver injector
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/DarthTon/Blackbone

Pattern signatures:
$s1 = "=INITtH=PAGEtA" fullword ascii
      $s2 = "BBInjectDll" fullword ascii
      $s3 = "LdrLoadDll" fullword ascii
      $s4 = "\\??\\pipe\\%ls" fullword wide
      $s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii

      $x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
      $x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
      $x4 = "%s: Invalid injection type specified - %d" fullword ascii
      $x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
      $x7 = "\\BlackBoneDrv\\bin\\" ascii
      $x8 = "DosDevices\\BlackBone" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 8000KB and (3 of them or 1 of ($x*))

Full rule:
rule HKTL_BlackBone_DriverInjector {
   meta:
      description = "Detects BlackBone Driver injector"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/DarthTon/Blackbone"
      date = "2018-09-11"
      modified = "2025-12-18"
      score = 60
      old_rule_name = "HTKL_BlackBone_DriverInjector"
      hash1 = "8062a4284c[PII_REDACTED]14458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
      hash2 = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
      hash3 = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
      id = "0d992a6c-c57a-5895-af0d-9c167d922601"
   strings:
      $s1 = "=INITtH=PAGEtA" fullword ascii
      $s2 = "BBInjectDll" fullword ascii
      $s3 = "LdrLoadDll" fullword ascii
      $s4 = "\\??\\pipe\\%ls" fullword wide
      $s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii

      $x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
      $x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
      $x4 = "%s: Invalid injection type specified - %d" fullword ascii
      $x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
      $x7 = "\\BlackBoneDrv\\bin\\" ascii
      $x8 = "DosDevices\\BlackBone" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 8000KB and (3 of them or 1 of ($x*))
}
YARA Detection Rule: HKTL_SqlMap
Repository: Neo23x0/signature-base
Detects: Detects sqlmap hacktool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/sqlmapproject/sqlmap

Pattern signatures:
$x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
      $x2 = "if conf.get(\"dumper\"):" fullword ascii

Detection condition:
filesize < 50KB and 1 of them

Full rule:
rule HKTL_SqlMap {
   meta:
      description = "Detects sqlmap hacktool"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/sqlmapproject/sqlmap"
      date = "2018-10-09"
      hash1 = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
      id = "da2029dd-c4ce-557f-a409-c468fa3deef3"
   strings:
      $x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
      $x2 = "if conf.get(\"dumper\"):" fullword ascii
   condition:
      filesize < 50KB and 1 of them
}