deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: hacktool_windows_mimikatz_files
Repository: Neo23x0/signature-base
Detects: Mimikatz credential dump tool: Files
Author: @fusionrace
Reference: https://github.com/gentilkiwi/mimikatz

Pattern signatures:
$s1 = "kiwifilter.log" fullword wide
        $s2 = "kiwissp.log" fullword wide
        $s3 = "mimilib.dll" fullword ascii wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and /* Added by Florian Roth to avoid false positives */
        any of them

Full rule:
rule hacktool_windows_mimikatz_files
{
    meta:
        description = "Mimikatz credential dump tool: Files"
        reference = "https://github.com/gentilkiwi/mimikatz"
        author = "@fusionrace"
        md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
        md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
    strings:
        $s1 = "kiwifilter.log" fullword wide
        $s2 = "kiwissp.log" fullword wide
        $s3 = "mimilib.dll" fullword ascii wide
    condition:
        uint16(0) == 0x5a4d and filesize < 800KB and /* Added by Florian Roth to avoid false positives */
        any of them
}
YARA Detection Rule: hacktool_windows_mimikatz_modules
Repository: Neo23x0/signature-base
Detects: Mimikatz credential dump tool: Modules
Author: @fusionrace
Reference: https://github.com/gentilkiwi/mimikatz

Pattern signatures:
$s1 = "mimilib" fullword ascii wide
        $s2 = "mimidrv" fullword ascii wide
        $s3 = "mimilove" fullword ascii wide

        $fp1 = "SgrmEnclave" wide
        $fp2 = "Kaspersky Lab Anti-Rootkit Monitor Driver" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and /* Added by Florian Roth to avoid false positives */
        1 of ($s*) and 
        not 1 of ($fp*)

Full rule:
rule hacktool_windows_mimikatz_modules
{
    meta:
        description = "Mimikatz credential dump tool: Modules"
        reference = "https://github.com/gentilkiwi/mimikatz"
        author = "@fusionrace"
        modified = "2023-07-26"
        md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
        md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
        md5_3 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
        md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
        md5_5 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
    strings:
        $s1 = "mimilib" fullword ascii wide
        $s2 = "mimidrv" fullword ascii wide
        $s3 = "mimilove" fullword ascii wide

        $fp1 = "SgrmEnclave" wide
        $fp2 = "Kaspersky Lab Anti-Rootkit Monitor Driver" wide
    condition:
        uint16(0) == 0x5a4d and filesize < 800KB and /* Added by Florian Roth to avoid false positives */
        1 of ($s*) and 
        not 1 of ($fp*)
}
YARA Detection Rule: hacktool_windows_mimikatz_sekurlsa
Repository: Neo23x0/signature-base
Detects: Mimikatz credential dump tool
Author: @fusionrace
Reference: https://github.com/gentilkiwi/mimikatz

Pattern signatures:
$s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
        $s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
        $s3 = "!SspCredentialList" ascii wide
        $s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
        $s5 = "wdigest!l_LogSessList" fullword ascii wide
        $s6 = "tspkg!TSGlobalCredTable" fullword ascii wide

Detection condition:
all of them

Full rule:
rule hacktool_windows_mimikatz_sekurlsa
{
    meta:
        description = "Mimikatz credential dump tool"
        reference = "https://github.com/gentilkiwi/mimikatz"
        author = "@fusionrace"
        SHA256_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
        SHA256_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
    strings:
        $s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
        $s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
        $s3 = "!SspCredentialList" ascii wide
        $s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
        $s5 = "wdigest!l_LogSessList" fullword ascii wide
        $s6 = "tspkg!TSGlobalCredTable" fullword ascii wide
    condition:
        all of them
}
YARA Detection Rule: MAL_ZIP_SocGholish_Mar21_1
Repository: Neo23x0/signature-base
Detects: Triggers on small zip files with typical SocGholish JS files in it
Author: Nils Kuhnert

Pattern signatures:
$a1 = /\.[a-z0-9]{6}\.js/ ascii
        $a2 = "Chrome" ascii
        $a3 = "Opera" ascii

        $b1 = "Firefox.js" ascii
        $b2 = "Edge.js" ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 1600 and (
            2 of ($a*) or
            any of ($b*)
        )

Full rule:
rule MAL_ZIP_SocGholish_Mar21_1 : zip js socgholish {
    meta:
        description = "Triggers on small zip files with typical SocGholish JS files in it"
        author = "Nils Kuhnert"
        date = "2021-03-29"
        hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
        hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
        hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
        id = "da35eefd-b34d-59cd-8afc-da9c78ace96e"
    strings:
        $a1 = /\.[a-z0-9]{6}\.js/ ascii
        $a2 = "Chrome" ascii
        $a3 = "Opera" ascii

        $b1 = "Firefox.js" ascii
        $b2 = "Edge.js" ascii
    condition:
        uint16(0) == 0x4b50 and filesize < 1600 and (
            2 of ($a*) or
            any of ($b*)
        )
}
YARA Detection Rule: EXT_MAL_JS_SocGholish_Mar21_1
Repository: Neo23x0/signature-base
Detects: Triggers on SocGholish JS files
Author: Nils Kuhnert

Pattern signatures:
/* $try = "try" ascii */

        $s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
        $s2 = "['DeleteFile']" ascii
        $s3 = "['WScript']['ScriptFullName']" ascii
        $s4 = "['WScript']['Sleep'](1000)" ascii
        $s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
        $s6 = "this['eval']" ascii
        $s7 = "String['fromCharCode']"
        $s8 = "2), 16)," ascii
        $s9 = "= 103," ascii
        $s10 = "'00000000'" ascii

Detection condition:
//$try in (0 .. 10) and 
        filesize > 3KB and filesize < 5KB and 8 of ($s*)

Full rule:
rule EXT_MAL_JS_SocGholish_Mar21_1 : js socgholish {
    meta:
        description = "Triggers on SocGholish JS files"
        author = "Nils Kuhnert"
        date = "2021-03-29"
        modified = "2023-01-02"
        hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
        hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
        hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc[PII_REDACTED]d63a51c"
        id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"
    strings:
        /* $try = "try" ascii */

        $s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
        $s2 = "['DeleteFile']" ascii
        $s3 = "['WScript']['ScriptFullName']" ascii
        $s4 = "['WScript']['Sleep'](1000)" ascii
        $s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
        $s6 = "this['eval']" ascii
        $s7 = "String['fromCharCode']"
        $s8 = "2), 16)," ascii
        $s9 = "= 103," ascii
        $s10 = "'00000000'" ascii
    condition:
        //$try in (0 .. 10) and 
        filesize > 3KB and filesize < 5KB and 8 of ($s*)
}
YARA Detection Rule: SocGholish_JS_22_02_2022
Repository: Neo23x0/signature-base
Detects: Detects SocGholish fake update Javascript files 22.02.2022
Author: Wojciech Cieślak

Pattern signatures:
$s1 = "encodeURIComponent(''+" ascii
        $s2 = "['open']('POST'," ascii 
        $s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii

Detection condition:
filesize < 5KB and all of them

Full rule:
rule SocGholish_JS_22_02_2022 {
    meta:
        description = "Detects SocGholish fake update Javascript files 22.02.2022"
        author = "Wojciech Cieślak"
        date = "2022-02-22"
        hash = "3e14d04da9cc38f371961f6115f37c30"
        hash = "dffa20158dcc110366f939bd137515c3"
        hash = "afee3af324951b1840c789540d5c8bff"
        hash = "c04a1625efec27fb6bbef9c66ca8372b"
        hash = "d08a2350df5abbd8fd530cff8339373e"
    
        id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
    strings:
        $s1 = "encodeURIComponent(''+" ascii
        $s2 = "['open']('POST'," ascii 
        $s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
    
    condition:
        filesize < 5KB and all of them
}
YARA Detection Rule: APT_NK_MAL_Keylogger_Unknown_Nov19_1
Repository: Neo23x0/signature-base
Detects: Detects unknown keylogger reported by CNMF in November 2019
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/CNMF_VirusAlert/status/[PII_REDACTED]07505921

Pattern signatures:
$x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
      $x2 = "Keylog file is saved >>>>>> %s" fullword ascii
      $x3 = "MicCap file is saved >>>>>> %s" fullword ascii
      $x4 = "cr5cr33nc4p.dat" fullword ascii
      $xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
      $xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
               25 30 32 64 2E 77 61 76 }
      $xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
               66 61 69 6C 65 64 }

      $s1 = "%s\\cmd.exe /c %s" fullword ascii
      $s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
      $s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
      $s4 = "%

Detection condition:
uint16(0) == 0x5a4d and filesize <= 40000KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule APT_NK_MAL_Keylogger_Unknown_Nov19_1 {
   meta:
      description = "Detects unknown keylogger reported by CNMF in November 2019"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/CNMF_VirusAlert/status/[PII_REDACTED]07505921"
      date = "2019-11-06"
      hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
      hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
      id = "5311d883-52e0-5503-9494-c583fabbedfe"
   strings:
      $x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
      $x2 = "Keylog file is saved >>>>>> %s" fullword ascii
      $x3 = "MicCap file is saved >>>>>> %s" fullword ascii
      $x4 = "cr5cr33nc4p.dat" fullword ascii
      $xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
      $xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
               25 30 32 64 2E 77 61 76 }
      $xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
               66 61 69 6C 65 64 }

      $s1 = "%s\\cmd.exe /c %s" fullword ascii
      $s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
      $s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
      $s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
      $s5 = "CARAT_Ws2_32.dll" fullword ascii
      $s6 = "PID [%s], open process failed." fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize <= 40000KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: VUL_Tomcat_Catalina_CVE_2020_1938
Repository: Neo23x0/signature-base
Detects: Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)
Author: Florian Roth (Nextron Systems)
Reference: https://www.chaitin.cn/en/ghostcat

Pattern signatures:
$h1 = "<?xml "
      $a1 = "<Service name=\"Catalina\">" ascii

      $v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii

      $fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
      $fp2 = " secret=\"" ascii
      $fp3 = " requiredSecret=\"" ascii

Detection condition:
$h1 at 0 and filesize <= 300KB and
      $a1 and $v1
      and not 1 of ($fp*)

Full rule:
rule VUL_Tomcat_Catalina_CVE_2020_1938 {
   meta:
      description = "Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.chaitin.cn/en/ghostcat"
      date = "2020-02-28"
      score = 50
      id = "d23af7ce-eb5d-50aa-be02-b4bf858641c2"
   strings:
      $h1 = "<?xml "
      $a1 = "<Service name=\"Catalina\">" ascii

      $v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii

      $fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
      $fp2 = " secret=\"" ascii
      $fp3 = " requiredSecret=\"" ascii
   condition:
      $h1 at 0 and filesize <= 300KB and
      $a1 and $v1
      and not 1 of ($fp*)
}
YARA Detection Rule: Waterbear_1_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "\\Release\\svc.pdb" ascii
      $s2 = "svc.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule Waterbear_1_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
      id = "2202506a-6009-5321-a8b2-df3bff51d06f"
   strings:
      $s1 = "\\Release\\svc.pdb" ascii
      $s2 = "svc.dll" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: Waterbear_2_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "downloading movie" fullword ascii
      $s2 = "name=\"test.exe\"/>" fullword ascii
      $s3 = "<description>Test Application</description>" fullword ascii
      $s4 = "UI look 2003" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule Waterbear_2_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
      id = "d3178f01-90a8-5a82-9c95-40bf8e9b567f"
   strings:
      $s1 = "downloading movie" fullword ascii
      $s2 = "name=\"test.exe\"/>" fullword ascii
      $s3 = "<description>Test Application</description>" fullword ascii
      $s4 = "UI look 2003" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: Waterbear_4_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii

      $s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
      $s2 = "read from pipe:%s" fullword ascii
      $s3 = "delete pipe" fullword ascii
      $s4 = "cmdcommand:%s" fullword ascii
      $s5 = "%s /c del %s" fullword ascii
      $s6 = "10.0.0.250" fullword ascii
      $s7 = "Vista/2008" fullword ascii
      $s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
      $s9 = "UNKOWN" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )

Full rule:
rule Waterbear_4_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
      id = "c7941f92-12ee-5d57-b58e-c8caf74ca6ba"
   strings:
      $x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii

      $s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
      $s2 = "read from pipe:%s" fullword ascii
      $s3 = "delete pipe" fullword ascii
      $s4 = "cmdcommand:%s" fullword ascii
      $s5 = "%s /c del %s" fullword ascii
      $s6 = "10.0.0.250" fullword ascii
      $s7 = "Vista/2008" fullword ascii
      $s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
      $s9 = "UNKOWN" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
}
YARA Detection Rule: Waterbear_5_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$a1 = "ICESWORD" fullword ascii
      $a2 = "klog.dat" fullword ascii

      $s1 = "\\cswbse.dll" ascii
      $s2 = "WIRESHARK" fullword ascii
      $s3 = "default_zz|" fullword ascii
      $s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
      $s5 = "1111%c%s" fullword ascii

Detection condition:
( uint16(0) == 0x3d53 and filesize < 100KB and ( all of ($a*) or 3 of them ) )

Full rule:
rule Waterbear_5_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      modified = "2023-01-07"
      hash1 = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
      id = "f92fe6d5-0afa-50a1-bdcf-c6dd78aa6809"
   strings:
      $a1 = "ICESWORD" fullword ascii
      $a2 = "klog.dat" fullword ascii

      $s1 = "\\cswbse.dll" ascii
      $s2 = "WIRESHARK" fullword ascii
      $s3 = "default_zz|" fullword ascii
      $s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
      $s5 = "1111%c%s" fullword ascii
   condition:
      ( uint16(0) == 0x3d53 and filesize < 100KB and ( all of ($a*) or 3 of them ) )
}
YARA Detection Rule: Waterbear_6_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "svcdll.dll" fullword ascii
      $s2 = "log.log" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 60KB and all of them )

Full rule:
rule Waterbear_6_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
      id = "86d203be-2d3a-54f2-b851-9080d5be36f5"
   strings:
      $s1 = "svcdll.dll" fullword ascii
      $s2 = "log.log" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
}
YARA Detection Rule: Waterbear_7_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "Bluthmon.exe" fullword wide
      $s2 = "Motomon.exe" fullword wide
      $s3 = "%d.%s%d%d%d" fullword ascii
      $s4 = "mywishes.hlp" fullword ascii
      $s5 = "filemon.rtf" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and all of them )

Full rule:
rule Waterbear_7_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
      id = "4613df5b-495e-5738-9b7f-ac8ff586cd17"
   strings:
      $s1 = "Bluthmon.exe" fullword wide
      $s2 = "Motomon.exe" fullword wide
      $s3 = "%d.%s%d%d%d" fullword ascii
      $s4 = "mywishes.hlp" fullword ascii
      $s5 = "filemon.rtf" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
}
YARA Detection Rule: Waterbear_8_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "Update.dll" fullword ascii
      $s2 = "ADVPACK32.DLL" fullword wide
      $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
      $s4 = "\\drivers\\sftst.sys" ascii
      $s5 = "\\\\.\\SFilter" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 40KB and all of them )

Full rule:
rule Waterbear_8_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      modified = "2023-01-07"
      hash1 = "bd06f6117a0abf[PII_REDACTED]f6f5e1932047b4a6c14add9149e8288ab4a902c3"
      hash1 = "5dba8ddf05cb204ef320a72a0c031e[PII_REDACTED]0d7883f2ff65135ec35b3dd0"
      id = "5ebeda22-ad67-5715-b42f-9b4bb5dcde94"
   strings:
      $s1 = "Update.dll" fullword ascii
      $s2 = "ADVPACK32.DLL" fullword wide
      $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
      $s4 = "\\drivers\\sftst.sys" ascii
      $s5 = "\\\\.\\SFilter" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 40KB and all of them )
}
YARA Detection Rule: Waterbear_9_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "ADVPACK32.DLL" fullword wide
      $s2 = "ADVPACK32" fullword wide

      $a1 = "U2_Dll.dll" fullword ascii

      $b1 = "ProUpdate" fullword ascii
      $b2 = "Update.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and all of ($s*) and ( $a1 or all of ($b*) )

Full rule:
rule Waterbear_9_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
      id = "727cdb55-ede5-5520-9aa9-5a265b5aeba1"
   strings:
      $s1 = "ADVPACK32.DLL" fullword wide
      $s2 = "ADVPACK32" fullword wide

      $a1 = "U2_Dll.dll" fullword ascii

      $b1 = "ProUpdate" fullword ascii
      $b2 = "Update.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 30KB and all of ($s*) and ( $a1 or all of ($b*) )
}