deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: OPCLEAVER_SynFlooder
Repository: Neo23x0/signature-base
Detects: Malware or hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
		$s2 = "s IP is : %s"
		$s3 = "Raw TCP Socket Created successfully."

Detection condition:
all of them

Full rule:
rule OPCLEAVER_SynFlooder
{
	meta:
		description = "Malware or hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "bdaf02f4-1226-569b-9f55-999be7ff397a"
	strings:
		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
		$s2 = "s IP is : %s"
		$s3 = "Raw TCP Socket Created successfully."
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_TinyZBot
Repository: Neo23x0/signature-base
Detects: Tiny Bot used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "NetScp" wide
		$s2 = "TinyZBot.Properties.Resources.resources"
		$s3 = "Aoao WaterMark"
		$s4 = "Run_a_exe"
		$s5 = "netscp.exe"
		$s6 = "get_MainModule_WebReference_DefaultWS"
		$s7 = "remove_CheckFileMD5Completed"
		$s8 = "http://tempuri.org/"
		$s9 = "Zhoupin_Cleaver"

Detection condition:
(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)

Full rule:
rule OPCLEAVER_TinyZBot
{
	meta:
		description = "Tiny Bot used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "4fad21a6-a900-5afb-876d-99a6d93e0c2c"
	strings:
		$s1 = "NetScp" wide
		$s2 = "TinyZBot.Properties.Resources.resources"
		$s3 = "Aoao WaterMark"
		$s4 = "Run_a_exe"
		$s5 = "netscp.exe"
		$s6 = "get_MainModule_WebReference_DefaultWS"
		$s7 = "remove_CheckFileMD5Completed"
		$s8 = "http://tempuri.org/"
		$s9 = "Zhoupin_Cleaver"
	condition:
		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
}
YARA Detection Rule: OPCLEAVER_ZhoupinExploitCrew
Repository: Neo23x0/signature-base
Detects: Keywords used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "zhoupin exploit crew" nocase
		$s2 = "zhopin exploit crew" nocase

Detection condition:
1 of them

Full rule:
rule OPCLEAVER_ZhoupinExploitCrew
{
	meta:
		description = "Keywords used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "4e7457a0-e6e1-535c-b04b-ad313b496ce1"
	strings:
		$s1 = "zhoupin exploit crew" nocase
		$s2 = "zhopin exploit crew" nocase
	condition:
		1 of them
}
YARA Detection Rule: OPCLEAVER_antivirusdetector
Repository: Neo23x0/signature-base
Detects: Hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "getShadyProcess"
		$s2 = "getSystemAntiviruses"
		$s3 = "AntiVirusDetector"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_antivirusdetector
{
	meta:
		description = "Hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "25ab4eaf-eae7-5a55-bed4-42f621d5f06c"
	strings:
		$s1 = "getShadyProcess"
		$s2 = "getSystemAntiviruses"
		$s3 = "AntiVirusDetector"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_csext
Repository: Neo23x0/signature-base
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "COM+ System Extentions"
		$s2 = "csext.exe"
		$s3 = "COM_Extentions_bin"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_csext
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "f865eae5-9988-5533-a004-e1694761a557"
	strings:
		$s1 = "COM+ System Extentions"
		$s2 = "csext.exe"
		$s3 = "COM_Extentions_bin"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_kagent
Repository: Neo23x0/signature-base
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "kill command is in last machine, going back"
		$s2 = "message data length in B64: %d Bytes"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_kagent
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "32d20495-eeed-5b2b-915d-cad60fa991f6"
	strings:
		$s1 = "kill command is in last machine, going back"
		$s2 = "message data length in B64: %d Bytes"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_mimikatzWrapper
Repository: Neo23x0/signature-base
Detects: Mimikatz Wrapper used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "mimikatzWrapper"
		$s2 = "get_mimikatz"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_mimikatzWrapper
{
	meta:
		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e9427e29-e581-5a5b-8f1d-4b9bfeec0946"
	strings:
		$s1 = "mimikatzWrapper"
		$s2 = "get_mimikatz"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_pvz_in
Repository: Neo23x0/signature-base
Detects: Parviz tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "LAST_TIME=00/00/0000:00:00PM$"
		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_pvz_in
{
	meta:
		description = "Parviz tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "dede12b3-f1dd-58ba-a860-829b2331b740"
	strings:
		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_pvz_out
Repository: Neo23x0/signature-base
Detects: Parviz tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Network Connectivity Module" wide
		$s2 = "OSPPSVC" wide

Detection condition:
all of them

Full rule:
rule OPCLEAVER_pvz_out
{
	meta:
		description = "Parviz tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "46b51bff-dfd9-5f56-897c-422112bc837b"
	strings:
		$s1 = "Network Connectivity Module" wide
		$s2 = "OSPPSVC" wide
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_wndTest
Repository: Neo23x0/signature-base
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "[Alt]" wide
		$s2 = "<< %s >>:" wide
		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_wndTest
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "f8daa0a8-f0f0-5bf7-b9ab-eaf5335ff2b9"
	strings:
		$s1 = "[Alt]" wide
		$s2 = "<< %s >>:" wide
		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_zhCat
Repository: Neo23x0/signature-base
Detects: Network tool used by Iranian hackers and used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
		$s2 = "ABC ( A Big Company )" wide fullword

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhCat
{
	meta:
		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e1f1bc48-b895-5e23-8ffd-b6ea9c8eb26f"
	strings:
		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
		$s2 = "ABC ( A Big Company )" wide fullword
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_zhLookUp
Repository: Neo23x0/signature-base
Detects: Hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "zhLookUp.Properties"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhLookUp
{
	meta:
		description = "Hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "45ef9a90-db4c-59c3-b694-da3f539b118b"
	strings:
		$s1 = "zhLookUp.Properties"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_zhmimikatz
Repository: Neo23x0/signature-base
Detects: Mimikatz wrapper used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "MimikatzRunner"
		$s2 = "zhmimikatz"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhmimikatz
{
	meta:
		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "fba8ab6e-3b61-53a1-b4df-178442e3cf24"
	strings:
		$s1 = "MimikatzRunner"
		$s2 = "zhmimikatz"
	condition:
		all of them
}
YARA Detection Rule: OPCLEAVER_Parviz_Developer
Repository: Neo23x0/signature-base
Detects: Parviz developer known from Operation Cleaver
Author: Florian Roth (Nextron Systems)
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Users\\parviz\\documents\\" nocase

Detection condition:
$s1

Full rule:
rule OPCLEAVER_Parviz_Developer
{
	meta:
		description = "Parviz developer known from Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		id = "2bfa90a0-0495-5b21-98f7-5ed7ebc74b2d"
	strings:
		$s1 = "Users\\parviz\\documents\\" nocase
	condition:
		$s1
}
YARA Detection Rule: OPCLEAVER_CCProxy_Config
Repository: Neo23x0/signature-base
Detects: CCProxy config known from Operation Cleaver
Author: Florian Roth (Nextron Systems)
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "UserName=User-001" fullword ascii
		$s2 = "Web=1" fullword ascii
		$s3 = "Mail=1" fullword ascii
		$s4 = "FTP=0" fullword ascii
		$x1 = "IPAddressLow=78.109.194.114" fullword ascii

Detection condition:
all of ($s*) or $x1

Full rule:
rule OPCLEAVER_CCProxy_Config
{
	meta:
		description = "CCProxy config known from Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		id = "c4d80a2a-2a32-585e-bc20-1c5118e4ee48"
	strings:
		$s1 = "UserName=User-001" fullword ascii
		$s2 = "Web=1" fullword ascii
		$s3 = "Mail=1" fullword ascii
		$s4 = "FTP=0" fullword ascii
		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
	condition:
		all of ($s*) or $x1
}
YARA Detection Rule: EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24
Repository: Neo23x0/signature-base
Detects: Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook
Author: X__Junior, Florian Roth
Reference: https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/

Pattern signatures:
$a1 = "Subject: "
      $a2 = "Received: "

      $xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/

Detection condition:
filesize < 1000KB
      and all of ($a*)
      and 1 of ($xr*)

Full rule:
rule EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 {
   meta:
      description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
      author = "X__Junior, Florian Roth"
      reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
      date = "2024-02-17"
      modified = "2024-02-19"
      score = 75
      id = "4512ca7b-0755-565e-84f1-596552949aa5"
   strings:
      $a1 = "Subject: "
      $a2 = "Received: "

      $xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/
   condition:
      filesize < 1000KB
      and all of ($a*)
      and 1 of ($xr*)
}
YARA Detection Rule: WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1
Repository: Neo23x0/signature-base
Detects: Detects DEWMODE webshells
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Pattern signatures:
$x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
      $x2 = "$(sh /tmp/.scr)"
      $x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
      
      $s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
      $s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
      $s3 = ",base64_decode('" ascii
      $s4 = "include \"remote.inc\";" ascii
      $s5 = "@system('sudo /usr/local" ascii

Detection condition:
uint16(0) == 0x3f3c and
      filesize < 9KB and
      ( 1 of ($x*) or 2 of them ) or 3 of them

Full rule:
rule WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 {
   meta:
      description = "Detects DEWMODE webshells"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
      date = "2021-02-22"
      hash1 = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
      hash2 = "5fa2b[PII_REDACTED]da7305356d[PII_REDACTED][PII_REDACTED]37626f621d794692c1b"
      id = "ea883f25-0e9b-5617-b05e-191a4a5c5a52"
   strings:
      $x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
      $x2 = "$(sh /tmp/.scr)"
      $x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
      
      $s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
      $s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
      $s3 = ",base64_decode('" ascii
      $s4 = "include \"remote.inc\";" ascii
      $s5 = "@system('sudo /usr/local" ascii
   condition:
      uint16(0) == 0x3f3c and
      filesize < 9KB and
      ( 1 of ($x*) or 2 of them ) or 3 of them
}
YARA Detection Rule: CVE_2017_8759_Mal_HTA
Repository: Neo23x0/signature-base
Detects: Detects malicious files related to CVE-2017-8759 - file cmd.hta
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii

Detection condition:
( uint16(0) == 0x683c and filesize < 1KB and all of them )

Full rule:
rule CVE_2017_8759_Mal_HTA {
   meta:
      description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae[PII_REDACTED]94b5"
      id = "e53b5149-fc94-5da5-8e35-7f09a9cd79fd"
   strings:
      $x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
   condition:
      ( uint16(0) == 0x683c and filesize < 1KB and all of them )
}
YARA Detection Rule: CVE_2017_8759_Mal_Doc
Repository: Neo23x0/signature-base
Detects: Detects malicious files related to CVE-2017-8759 - file Doc1.doc
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$s1 = "soap:wsdl=http://" ascii wide
      $s2 = "soap:wsdl=https://" ascii wide
      $s3 = "soap:wsdl=http%3" ascii wide
      $s4 = "soap:wsdl=https%3" ascii wide

      $c1 = "Project.ThisDocument.AutoOpen" fullword wide

Detection condition:
uint16(0) == 0xcfd0 and filesize < 500KB and ( 1 of ($s*) and $c1 )

Full rule:
rule CVE_2017_8759_Mal_Doc {
   meta:
      description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      modified = "2023-11-21"
      hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
      id = "48587c13-7661-5987-8331-732115f7823b"
   strings:
      $s1 = "soap:wsdl=http://" ascii wide
      $s2 = "soap:wsdl=https://" ascii wide
      $s3 = "soap:wsdl=http%3" ascii wide
      $s4 = "soap:wsdl=https%3" ascii wide

      $c1 = "Project.ThisDocument.AutoOpen" fullword wide
   condition:
      uint16(0) == 0xcfd0 and filesize < 500KB and ( 1 of ($s*) and $c1 )
}
YARA Detection Rule: CVE_2017_8759_SOAP_via_JS
Repository: Neo23x0/signature-base
Detects: Detects SOAP WDSL Download via JavaScript
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/buffaloverflow/status/[PII_REDACTED]78087680

Pattern signatures:
$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
      $s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase

Detection condition:
( filesize < 3KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_via_JS {
   meta:
      description = "Detects SOAP WDSL Download via JavaScript"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/buffaloverflow/status/[PII_REDACTED]78087680"
      date = "2017-09-14"
      score = 60
      id = "9e96cea3-4282-5f25-ad37-51bd69258790"
   strings:
      $s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
      $s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
   condition:
      ( filesize < 3KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_SOAP_Excel
Repository: Neo23x0/signature-base
Detects: Detects malicious files related to CVE-2017-8759
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/buffaloverflow/status/[PII_REDACTED]45869825

Pattern signatures:
$s1 = "|'soap:wsdl=" ascii wide nocase

Detection condition:
( filesize < 300KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_Excel {
   meta:
      description = "Detects malicious files related to CVE-2017-8759"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/buffaloverflow/status/[PII_REDACTED]45869825"
      date = "2017-09-15"
      score = 60
      id = "940ec910-49a4-5271-97e4-8536db271b80"
   strings:
      $s1 = "|'soap:wsdl=" ascii wide nocase
   condition:
      ( filesize < 300KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_SOAP_txt
Repository: Neo23x0/signature-base
Detects: Detects malicious file in releation with CVE-2017-8759 - file exploit.txt
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Pattern signatures:
$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
      $s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide

Detection condition:
( filesize < 200KB and 1 of them )

Full rule:
rule CVE_2017_8759_SOAP_txt {
   meta:
      description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
      date = "2017-09-14"
      hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc[PII_REDACTED]8e2444"
      id = "36474420-4fa9-5264-a46b-bb[PII_REDACTED]"
   strings:
      $s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
      $s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
   condition:
      ( filesize < 200KB and 1 of them )
}
YARA Detection Rule: CVE_2017_8759_WSDL_in_RTF
Repository: Neo23x0/signature-base
Detects: Detects malicious RTF file related CVE-2017-8759
Author: Security Doggo @xdxdxdxdoa
Reference: https://twitter.com/xdxdxdxdoa/status/[PII_REDACTED]99996416

Pattern signatures:
$doc = "d0cf11e0a1b11ae1"
      $obj = "\\objupdate"
      $wsdl = "[PII_REDACTED]006c003d00" nocase
      $http1 = "[PII_REDACTED]0070003a002f002f00" nocase
      $http2 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" nocase
      $http3 = "[PII_REDACTED]003a002f002f00" nocase

Detection condition:
uint32be(0) == 0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)

Full rule:
rule CVE_2017_8759_WSDL_in_RTF {
   meta:
      description = "Detects malicious RTF file related CVE-2017-8759"
      author = "Security Doggo @xdxdxdxdoa"
      reference = "https://twitter.com/xdxdxdxdoa/status/[PII_REDACTED]99996416"
      date = "2017-09-15"
      id = "daaa5489-af96-5a69-b2dd-81406c0a1edc"
   strings:
      $doc = "d0cf11e0a1b11ae1"
      $obj = "\\objupdate"
      $wsdl = "[PII_REDACTED]006c003d00" nocase
      $http1 = "[PII_REDACTED]0070003a002f002f00" nocase
      $http2 = "[PII_REDACTED][PII_REDACTED]3a002f002f00" nocase
      $http3 = "[PII_REDACTED]003a002f002f00" nocase
   condition:
      uint32be(0) == 0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)
}