deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EditServer_Webshell_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file EditServer.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "@HOTMAIL.COM"
		$s1 = "Press Any Ke"
		$s3 = "glish MenuZ"

Detection condition:
all of them

Full rule:
rule EditServer_Webshell_2 {
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
	strings:
		$s0 = "@HOTMAIL.COM"
		$s1 = "Press Any Ke"
		$s3 = "glish MenuZ"
	condition:
		all of them
}
YARA Detection Rule: by064cli
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file by064cli.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s7 = "packet dropped,redirecting"
		$s9 = "input the password(the default one is 'by')"

Detection condition:
all of them

Full rule:
rule by064cli {
	meta:
		description = "Webshells Auto-generated - file by064cli.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "10e0dff366968b770ae929505d2a9885"
	strings:
		$s7 = "packet dropped,redirecting"
		$s9 = "input the password(the default one is 'by')"
	condition:
		all of them
}
YARA Detection Rule: Mithril_dllTest
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dllTest.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "please enter the password:"
		$s3 = "\\dllTest.pdb"

Detection condition:
all of them

Full rule:
rule Mithril_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
	strings:
		$s0 = "please enter the password:"
		$s3 = "\\dllTest.pdb"
	condition:
		all of them
}
YARA Detection Rule: peek_a_boo
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file peek-a-boo.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "__vbaHresultCheckObj"
		$s1 = "\\VB\\VB5.OLB"
		$s2 = "capGetDriverDescriptionA"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s8 = "__vbaErrorOverflow"

Detection condition:
all of them

Full rule:
rule peek_a_boo {
	meta:
		description = "Webshells Auto-generated - file peek-a-boo.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "aca339f60d41fdcba83773be5d646776"
	strings:
		$s0 = "__vbaHresultCheckObj"
		$s1 = "\\VB\\VB5.OLB"
		$s2 = "capGetDriverDescriptionA"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s8 = "__vbaErrorOverflow"
	condition:
		all of them
}
YARA Detection Rule: fmlibraryv3
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file fmlibraryv3.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"

Detection condition:
all of them

Full rule:
rule fmlibraryv3 {
	meta:
		description = "Webshells Auto-generated - file fmlibraryv3.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "c34c248fed6d5a20d8203924a2088acc"
	strings:
		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
	condition:
		all of them
}
YARA Detection Rule: Debug_dllTest_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dllTest.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "\\Debug\\dllTest.pdb"
		$s5 = "--list the services in the computer"

Detection condition:
all of them

Full rule:
rule Debug_dllTest_2 {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
	strings:
		$s4 = "\\Debug\\dllTest.pdb"
		$s5 = "--list the services in the computer"
	condition:
		all of them
}
YARA Detection Rule: connector
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file connector.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "If ( AttackID = BROADCAST_ATTACK )"
		$s4 = "Add UNIQUE ID for victims / zombies"

Detection condition:
all of them

Full rule:
rule connector {
	meta:
		description = "Webshells Auto-generated - file connector.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3ba1827fca7be37c8296cd60be9dc884"
	strings:
		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
		$s4 = "Add UNIQUE ID for victims / zombies"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_HideRun
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file HideRun.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Usage -- hiderun [AppName]"
		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_HideRun {
	meta:
		description = "Webshells Auto-generated - file HideRun.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "45436d9bfd8ff94b71eeaeb280025afe"
	strings:
		$s0 = "Usage -- hiderun [AppName]"
		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
	condition:
		all of them
}
YARA Detection Rule: regshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file regshell.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Changes the base hive to HKEY_CURRENT_USER."
		$s4 = "Displays a list of values and sub-keys in a registry Hive."
		$s5 = "Enter a menu selection number (1 - 3) or 99 to Exit: "

Detection condition:
all of them

Full rule:
rule regshell {
	meta:
		description = "Webshells Auto-generated - file regshell.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "db2fdc821ca6091bab3ebd0d8bc46ded"
	strings:
		$s0 = "Changes the base hive to HKEY_CURRENT_USER."
		$s4 = "Displays a list of values and sub-keys in a registry Hive."
		$s5 = "Enter a menu selection number (1 - 3) or 99 to Exit: "
	condition:
		all of them
}
YARA Detection Rule: PHP_Shell_v1_7
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file PHP_Shell_v1.7.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"

Detection condition:
all of them

Full rule:
rule PHP_Shell_v1_7 {
	meta:
		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b5978501c[PII_REDACTED]b4ca6fb77cba5"
	strings:
		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
	condition:
		all of them
}
YARA Detection Rule: xssshell_save
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file save.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
		$s5 = "VictimID = fm_NStr(Victims(i))"

Detection condition:
all of them

Full rule:
rule xssshell_save {
	meta:
		description = "Webshells Auto-generated - file save.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "865da1b3974e940936fe38e8e1964980"
	strings:
		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
		$s5 = "VictimID = fm_NStr(Victims(i))"
	condition:
		all of them
}
YARA Detection Rule: screencap
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file screencap.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "GetDIBColorTable"
		$s1 = "Screen.bmp"
		$s2 = "CreateDCA"

Detection condition:
all of them

Full rule:
rule screencap {
	meta:
		description = "Webshells Auto-generated - file screencap.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "51139091dea7a9418a50f2712ea72aa6"
	strings:
		$s0 = "GetDIBColorTable"
		$s1 = "Screen.bmp"
		$s2 = "CreateDCA"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phpinj_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phpinj.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"

Detection condition:
all of them

Full rule:
rule FSO_s_phpinj_2 {
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "dd39d17e9baca0363cc1c3664e608929"
	strings:
		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
	condition:
		all of them
}
YARA Detection Rule: ZXshell2_0_rar_Folder_zxrecv
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file zxrecv.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "RyFlushBuff"
		$s1 = "teToWideChar^FiYP"
		$s2 = "mdesc+8F D"
		$s3 = "\\von76std"
		$s4 = "5pur+virtul"
		$s5 = "- Kablto io"
		$s6 = "ac#f{lowi8a"

Detection condition:
all of them

Full rule:
rule ZXshell2_0_rar_Folder_zxrecv {
	meta:
		description = "Webshells Auto-generated - file zxrecv.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
	strings:
		$s0 = "RyFlushBuff"
		$s1 = "teToWideChar^FiYP"
		$s2 = "mdesc+8F D"
		$s3 = "\\von76std"
		$s4 = "5pur+virtul"
		$s5 = "- Kablto io"
		$s6 = "ac#f{lowi8a"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_ajan
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ajan.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "entrika.write \"BinaryStream.SaveToFile"

Detection condition:
all of them

Full rule:
rule FSO_s_ajan {
	meta:
		description = "Webshells Auto-generated - file ajan.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "22194f8c44524f80254e1b5aec67b03e"
	strings:
		$s4 = "entrika.write \"BinaryStream.SaveToFile"
	condition:
		all of them
}
YARA Detection Rule: c99shell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file c99shell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"

Detection condition:
all of them

Full rule:
rule c99shell {
	meta:
		description = "Webshells Auto-generated - file c99shell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
	strings:
		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
	condition:
		all of them
}
YARA Detection Rule: phpspy_2005_full
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phpspy_2005_full.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"

Detection condition:
all of them

Full rule:
rule phpspy_2005_full {
	meta:
		description = "Webshells Auto-generated - file phpspy_2005_full.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d1c69bb[PII_REDACTED]0e6c903bac16b2"
	strings:
		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_zehir4_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file zehir4.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "\"Program Files\\Serv-u\\Serv"

Detection condition:
all of them

Full rule:
rule FSO_s_zehir4_2 {
	meta:
		description = "Webshells Auto-generated - file zehir4.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5b496a61363d304532bcf52ee21f5d55"
	strings:
		$s4 = "\"Program Files\\Serv-u\\Serv"
	condition:
		all of them
}
YARA Detection Rule: httpdoor
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file httpdoor.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "''''''''''''''''''DaJKHPam"
		$s5 = "o,WideCharR]!n]"
		$s6 = "HAutoComplete"
		$s7 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:sch"

Detection condition:
all of them

Full rule:
rule httpdoor {
	meta:
		description = "Webshells Auto-generated - file httpdoor.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "6097ea963455a09474471a9864593dc3"
	strings:
		$s4 = "''''''''''''''''''DaJKHPam"
		$s5 = "o,WideCharR]!n]"
		$s6 = "HAutoComplete"
		$s7 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:sch"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_indexer_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file indexer.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"

Detection condition:
all of them

Full rule:
rule FSO_s_indexer_2 {
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "135fc50f85228691b401848caef3be9e"
	strings:
		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_2005
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
		$s9 = "scrollbar-face-color:#E4E4F3;"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
	strings:
		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
		$s9 = "scrollbar-face-color:#E4E4F3;"
	condition:
		all of them
}
YARA Detection Rule: _root_040_zip_Folder_deploy
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file deploy.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "halon synscan 127.0.0.1 1-65536"
		$s8 = "Obviously you replace the ip address with that of the target."

Detection condition:
all of them

Full rule:
rule _root_040_zip_Folder_deploy {
	meta:
		description = "Webshells Auto-generated - file deploy.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "2c9f9c58999256c73a5ebdb10a9be269"
	strings:
		$s5 = "halon synscan 127.0.0.1 1-65536"
		$s8 = "Obviously you replace the ip address with that of the target."

	condition:
		all of them
}
YARA Detection Rule: by063cli
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file by063cli.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "#popmsghello,are you all right?"
		$s4 = "connect failed,check your network and remote ip."

Detection condition:
all of them

Full rule:
rule by063cli {
	meta:
		description = "Webshells Auto-generated - file by063cli.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "49ce26eb97fd13b6d92a5e5d169db859"
	strings:
		$s2 = "#popmsghello,are you all right?"
		$s4 = "connect failed,check your network and remote ip."
	condition:
		all of them
}
YARA Detection Rule: icyfox007v1_10_rar_Folder_asp
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file asp.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"

Detection condition:
all of them

Full rule:
rule icyfox007v1_10_rar_Folder_asp {
	meta:
		description = "Webshells Auto-generated - file asp.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "2c412400b146b7b98d6e7755f7159bb9"
	strings:
		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_EFSO_2_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file EFSO_2.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"

Detection condition:
all of them

Full rule:
rule FSO_s_EFSO_2_2 {
	meta:
		description = "Webshells Auto-generated - file EFSO_2.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a341270f9ebd01320a7490c12cb2e64c"
	strings:
		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
	condition:
		all of them
}
YARA Detection Rule: byshell063_ntboot_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ntboot.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"

Detection condition:
all of them

Full rule:
rule byshell063_ntboot_2 {
	meta:
		description = "Webshells Auto-generated - file ntboot.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
	strings:
		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
	condition:
		all of them
}
YARA Detection Rule: u_uay
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file uay.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"

Detection condition:
1 of them

Full rule:
rule u_uay {
	meta:
		description = "Webshells Auto-generated - file uay.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
	strings:
		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
	condition:
		1 of them
}
YARA Detection Rule: bin_wuaus
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file wuaus.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "9(90989@9V9^9f9n9v9"
		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
		$s3 = ";(=@=G=O=T=X=\\="
		$s4 = "TCP Send Error!!"
		$s5 = "1\"1;1X1^1e1m1w1~1"
		$s8 = "=$=)=/=<=Y=_=j=p=z="

Detection condition:
all of them

Full rule:
rule bin_wuaus {
	meta:
		description = "Webshells Auto-generated - file wuaus.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "46a365992bec7377b48a2263c49e4e7d"
	strings:
		$s1 = "9(90989@9V9^9f9n9v9"
		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
		$s3 = ";(=@=G=O=T=X=\\="
		$s4 = "TCP Send Error!!"
		$s5 = "1\"1;1X1^1e1m1w1~1"
		$s8 = "=$=)=/=<=Y=_=j=p=z="
	condition:
		all of them
}
YARA Detection Rule: pwreveal
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file pwreveal.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "*<Blank - no es"
		$s3 = "JDiamondCS "
		$s8 = "sword set> [Leith=0 bytes]"
		$s9 = "ION\\System\\Floating-"

Detection condition:
all of them

Full rule:
rule pwreveal {
	meta:
		description = "Webshells Auto-generated - file pwreveal.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b4e8447826a45b76ca45ba151a97ad50"
	strings:
		$s0 = "*<Blank - no es"
		$s3 = "JDiamondCS "
		$s8 = "sword set> [Leith=0 bytes]"
		$s9 = "ION\\System\\Floating-"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_xwhois
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file xwhois.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "rting! "
		$s2 = "aTypCog("
		$s5 = "Diamond"
		$s6 = "r)r=rQreryr"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_xwhois {
	meta:
		description = "Webshells Auto-generated - file xwhois.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "0bc98bd576c80d921a3460f8be8816b4"
	strings:
		$s1 = "rting! "
		$s2 = "aTypCog("
		$s5 = "Diamond"
		$s6 = "r)r=rQreryr"
	condition:
		all of them
}
YARA Detection Rule: vanquish_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file vanquish.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "Vanquish - DLL injection failed:"

Detection condition:
all of them

Full rule:
rule vanquish_2 {
	meta:
		description = "Webshells Auto-generated - file vanquish.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "2dcb9055785a2ee01567f52b5a62b071"
	strings:
		$s2 = "Vanquish - DLL injection failed:"
	condition:
		all of them
}
YARA Detection Rule: down_rar_Folder_down
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file down.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"

Detection condition:
all of them

Full rule:
rule down_rar_Folder_down {
	meta:
		description = "Webshells Auto-generated - file down.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "db47d7a12b3584a2e[PII_REDACTED]86e71"
	strings:
		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
	condition:
		all of them
}
YARA Detection Rule: cmdShell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file cmdShell.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "if cmdPath=\"wscriptShell\" then"

Detection condition:
all of them

Full rule:
rule cmdShell {
	meta:
		description = "Webshells Auto-generated - file cmdShell.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "8a9fef43209b5d2d4b81dfbb45182036"
	strings:
		$s1 = "if cmdPath=\"wscriptShell\" then"
	condition:
		all of them
}
YARA Detection Rule: ZXshell2_0_rar_Folder_nc
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file nc.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "WSOCK32.dll"
		$s1 = "?bSUNKNOWNV"
		$s7 = "p@gram Jm6h)"
		$s8 = "ser32.dllCONFP@"

Detection condition:
all of them

Full rule:
rule ZXshell2_0_rar_Folder_nc {
	meta:
		description = "Webshells Auto-generated - file nc.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
	strings:
		$s0 = "WSOCK32.dll"
		$s1 = "?bSUNKNOWNV"
		$s7 = "p@gram Jm6h)"
		$s8 = "ser32.dllCONFP@"
	condition:
		all of them
}
YARA Detection Rule: portlessinst
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file portlessinst.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "Fail To Open Registry"
		$s3 = "f<-WLEggDr\""
		$s6 = "oMemoryCreateP"

Detection condition:
all of them

Full rule:
rule portlessinst {
	meta:
		description = "Webshells Auto-generated - file portlessinst.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "74213856fc61475443a91cd84e2a6c2f"
	strings:
		$s2 = "Fail To Open Registry"
		$s3 = "f<-WLEggDr\""
		$s6 = "oMemoryCreateP"
	condition:
		all of them
}
YARA Detection Rule: SetupBDoor
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file SetupBDoor.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "\\BDoor\\SetupBDoor"

Detection condition:
all of them

Full rule:
rule SetupBDoor {
	meta:
		description = "Webshells Auto-generated - file SetupBDoor.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "41f89e20398368e742eda4a3b45716b6"
	strings:
		$s1 = "\\BDoor\\SetupBDoor"
	condition:
		all of them
}