deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Sofacy_Oct17_1
Repository: Neo23x0/signature-base
Detects: Detects Sofacy malware reported in October 2017
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html

Pattern signatures:
$x1 = "%localappdata%\\netwf.dll" fullword wide
      $x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
      $x3 = "%localappdata%\\netwf.bat" fullword wide
      $x4 = "KlpSvc.dll" fullword ascii

      /* used for generic approach */
      $g1 = "set path = \"%localappdata%\\" ascii
      $g2 = "%localappdata%\\" wide

      $s1 = "start rundll32.exe %path %,#1a" fullword ascii

      $s2 = "gshell32" fullword wide
      $s3 = "s - %lu" fullword ascii
      $s4 = "be run i" fullword ascii
      $s5 = "ingToBinhary" fullword ascii
      $s6 = "%j%Xjs" fullword ascii
      $s7 = "if NOT exist %path % (exit)" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
         pe.exports("KlpSvc") or
         ( 1 of ($x*) or 4 of them ) or
         ( $s1 and all of ($g*) )
      )

Full rule:
rule Sofacy_Oct17_1 {
   meta:
      description = "Detects Sofacy malware reported in October 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
      date = "2017-10-23"
      hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
      id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
   strings:
      $x1 = "%localappdata%\\netwf.dll" fullword wide
      $x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
      $x3 = "%localappdata%\\netwf.bat" fullword wide
      $x4 = "KlpSvc.dll" fullword ascii

      /* used for generic approach */
      $g1 = "set path = \"%localappdata%\\" ascii
      $g2 = "%localappdata%\\" wide

      $s1 = "start rundll32.exe %path %,#1a" fullword ascii

      $s2 = "gshell32" fullword wide
      $s3 = "s - %lu" fullword ascii
      $s4 = "be run i" fullword ascii
      $s5 = "ingToBinhary" fullword ascii
      $s6 = "%j%Xjs" fullword ascii
      $s7 = "if NOT exist %path % (exit)" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
         pe.exports("KlpSvc") or
         ( 1 of ($x*) or 4 of them ) or
         ( $s1 and all of ($g*) )
      )
}
YARA Detection Rule: Sofacy_Oct17_2
Repository: Neo23x0/signature-base
Detects: Detects Sofacy malware reported in October 2017
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html

Pattern signatures:
$x1 = "netwf.dll" fullword wide

      $s1 = "%s - %s - %2.2x" fullword wide
      $s2 = "%s - %lu" fullword ascii
      $s3 = "%s \"%s\", %s" fullword wide
      $s4 = "%j%Xjsf" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 90KB and (
            pe.imphash() == "13344e2a717849489bcd93692f9646f7" or
            ( 4 of them )
         )
      ) or ( all of them )

Full rule:
rule Sofacy_Oct17_2 {
   meta:
      description = "Detects Sofacy malware reported in October 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
      date = "2017-10-23"
      hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
      id = "c820eab0-9b64-5718-8681-a4f515ee462b"
   strings:
      $x1 = "netwf.dll" fullword wide

      $s1 = "%s - %s - %2.2x" fullword wide
      $s2 = "%s - %lu" fullword ascii
      $s3 = "%s \"%s\", %s" fullword wide
      $s4 = "%j%Xjsf" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 90KB and (
            pe.imphash() == "13344e2a717849489bcd93692f9646f7" or
            ( 4 of them )
         )
      ) or ( all of them )
}
YARA Detection Rule: Emissary_APT_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/V0epcf

Pattern signatures:
$s1 = "cmd.exe /c %s > %s" fullword ascii
		$s2 = "execute cmd timeout." fullword ascii
		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
		$s4 = "DownloadFile - exception:%s." fullword ascii
		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
		$s7 = "WinDLL.dll" fullword wide
		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and 3 of them

Full rule:
rule Emissary_APT_Malware_1 {
	meta:
		description = "Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/V0epcf"
		date = "2016-01-02"
		score = 75
		hash1 = "[PII_REDACTED]c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e[PII_REDACTED]d04cc9"
		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
		hash12 = "98fb1d2975babc18624e[PII_REDACTED]458642e[PII_REDACTED]0deee397df93f50e0"
		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
		id = "ae6ff471-9255-52a3-89d2-452eb2556184"
	strings:
		$s1 = "cmd.exe /c %s > %s" fullword ascii
		$s2 = "execute cmd timeout." fullword ascii
		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
		$s4 = "DownloadFile - exception:%s." fullword ascii
		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
		$s7 = "WinDLL.dll" fullword wide
		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
	condition:
		ui
YARA Detection Rule: APT_NK_Methodology_Artificial_UserAgent_IE_Win7
Repository: Neo23x0/signature-base
Detects: Detects hard-coded User-Agent string that has been present in several APT37 malware families.
Author: Steve Miller aka @stvemillertime

Pattern signatures:
$a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
        $a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}

        $fp1 = "Esumsoft" wide
        $fp2 = "Acunetix" wide ascii
        $fp3 = "TASER SYNC" ascii

Detection condition:
uint16(0) == 0x5A4D and all of ($a*) and not 1 of ($fp*)

Full rule:
rule APT_NK_Methodology_Artificial_UserAgent_IE_Win7 {
    meta:
        author = "Steve Miller aka @stvemillertime"
        description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."
        hash1 = "e63efbf8624a531bb435b7446dbbfc25"
        score = 45
        id = "a747c908-7af7-5c29-8386-a71db7648061"
    strings:
        $a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
        $a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}

        $fp1 = "Esumsoft" wide
        $fp2 = "Acunetix" wide ascii
        $fp3 = "TASER SYNC" ascii
    condition:
        uint16(0) == 0x5A4D and all of ($a*) and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_VHD_Suspicious_Small_Size
Repository: Neo23x0/signature-base
Detects: Detects suspicious VHD files
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/MeltX0R/status/[PII_REDACTED]77774850

Pattern signatures:
/* VHD */
      $hc1 = { 63 6F 6E 65 63 74 69 78 }
      $hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
      $hc2b = "connectix"

Detection condition:
not uint16(0) == 0x5a4d
      and filesize > 1KB and filesize <= 4000KB 
      and (
         $hc1 at 0 
         or all of ($hc2*)
      )

Full rule:
rule SUSP_VHD_Suspicious_Small_Size {
   meta:
      description = "Detects suspicious VHD files"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/MeltX0R/status/[PII_REDACTED]77774850"
      date = "2019-12-21"
      modified = "2023-01-27"
      score = 50
      hash1 = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
      id = "f4a72e7b-ddd3-5038-9440-1e81dc27755d"
   strings:
      /* VHD */
      $hc1 = { 63 6F 6E 65 63 74 69 78 }
      $hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
      $hc2b = "connectix"
   condition:
      not uint16(0) == 0x5a4d
      and filesize > 1KB and filesize <= 4000KB 
      and (
         $hc1 at 0 
         or all of ($hc2*)
      )
}
YARA Detection Rule: WMImplant
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file WMImplant.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html

Pattern signatures:
$x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
      $x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
      $x3 = "WMImplant -Creds" fullword ascii
      $x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
      $x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
      $x6 = "Invoke-WMImplant" fullword ascii

Detection condition:
1 of them

Full rule:
rule WMImplant {
   meta:
      description = "Auto-generated rule - file WMImplant.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
      date = "2017-03-24"
      hash1 = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
      id = "18dadc55-e12f-5c4c-9e11-27dc2d6c8dd2"
   strings:
      $x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
      $x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
      $x3 = "WMImplant -Creds" fullword ascii
      $x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
      $x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
      $x6 = "Invoke-WMImplant" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: Explosive_EXE
Repository: Neo23x0/signature-base
Detects: Explosion/Explosive Malware - Volatile Cedar APT
Author: Check Point Software Technologies Inc.

Pattern signatures:
$DLD_S = "DLD-S:"
		$DLD_E = "DLD-E:"

Detection condition:
all of them and
        uint16(0) == 0x5A4D

Full rule:
rule Explosive_EXE : APT {
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		author = "Check Point Software Technologies Inc."
		id = "3a9fb6b2-2f19-5d70-81ed-a08c3b8b2d80"
	strings:
		$DLD_S = "DLD-S:"
		$DLD_E = "DLD-E:"
	condition:
		all of them and
        uint16(0) == 0x5A4D
}
YARA Detection Rule: Explosion_Sample_1
Repository: Neo23x0/signature-base
Detects: Explosion/Explosive Malware - Volatile Cedar APT
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/5vYaNb

Pattern signatures:
$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
		$s11 = "IE:Password-Protected sites" fullword ascii
		$s12 = "\\his.sys" ascii
		$s13 = "HTTP Password" fullword ascii
		$s14 = "\\data.sys" ascii
		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
		$s17 = "Office Outlook HTTP" fullword ascii
		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii

Detection condition:
all of them and
        uint16(0) == 0x5A4D

Full rule:
rule Explosion_Sample_1 {
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5vYaNb"
		date = "2015/04/03"
		score = 70
		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
		id = "dcf28185-75a8-5c9f-9f60-edb8dc187e16"
	strings:
		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
		$s11 = "IE:Password-Protected sites" fullword ascii
		$s12 = "\\his.sys" ascii
		$s13 = "HTTP Password" fullword ascii
		$s14 = "\\data.sys" ascii
		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
		$s17 = "Office Outlook HTTP" fullword ascii
		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
	condition:
		all of them and
        uint16(0) == 0x5A4D
}
YARA Detection Rule: Explosion_Sample_2
Repository: Neo23x0/signature-base
Detects: Explosion/Explosive Malware - Volatile Cedar APT
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/5vYaNb

Pattern signatures:
$s0 = "serverhelp.dll" fullword wide
		$s1 = "Windows Help DLL" fullword wide
		$s5 = "SetWinHoK" fullword ascii

Detection condition:
all of them and
        uint16(0) == 0x5A4D

Full rule:
rule Explosion_Sample_2 {
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5vYaNb"
		date = "2015/04/03"
		score = 70
		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
		id = "8be7ed50-0bfc-5302-b4fa-8817bf1750d7"
	strings:
		$s0 = "serverhelp.dll" fullword wide
		$s1 = "Windows Help DLL" fullword wide
		$s5 = "SetWinHoK" fullword ascii
	condition:
		all of them and
        uint16(0) == 0x5A4D
}
YARA Detection Rule: Explosion_Generic_1
Repository: Neo23x0/signature-base
Detects: Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT
Author: Florian Roth (Nextron Systems)
Reference: not set

Pattern signatures:
$s0 = "autorun.exe" fullword
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
		$s2 = "%drp.exe" fullword
		$s3 = "%s_%s%d.exe" fullword
		$s4 = "open=autorun.exe" fullword
		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
		$s10 = "error.renamefile" fullword
		$s12 = "insufficient lookahead" fullword
		$s13 = "%s %s|" fullword
		$s16 = ":\\autorun.exe" fullword

Detection condition:
7 of them and
        uint16(0) == 0x5A4D

Full rule:
rule Explosion_Generic_1 {
	meta:
		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/04/03"
		score = 70
		super_rule = 1
		hash0 = "d0f059ba21f[PII_REDACTED]5a55220d1e822d1233f95879ea6f7cb9d301408c821"
		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
		hash4 = "03641e[PII_REDACTED]f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
		id = "dc3721b6-c19e-5449-9962-2a6f844e49b4"
	strings:
		$s0 = "autorun.exe" fullword
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
		$s2 = "%drp.exe" fullword
		$s3 = "%s_%s%d.exe" fullword
		$s4 = "open=autorun.exe" fullword
		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
		$s10 = "error.renamefile" fullword
		$s12 = "insufficient lookahead" fullword
		$s13 = "%s %s|" fullword
		$s16 = ":\\autorun.exe" fullword
	condition:
		7 of them and
        uint16(0) == 0x5A4D
}
YARA Detection Rule: Explosive_UA
Repository: Neo23x0/signature-base
Detects: Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/HQRCdw

Pattern signatures:
$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword

Detection condition:
$x1 and
        uint16(0) == 0x5A4D

Full rule:
rule Explosive_UA {
	meta:
		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/HQRCdw"
		date = "2015/04/03"
		score = 60
		id = "d88d5fd6-adf9-5ced-8b79-e47e3ffbde50"
	strings:
		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
	condition:
		$x1 and
        uint16(0) == 0x5A4D
}
YARA Detection Rule: Webshell_Caterpillar_ASPX
Repository: Neo23x0/signature-base
Detects: Volatile Cedar Webshell - from file caterpillar.aspx
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/emons5

Pattern signatures:
$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
		$s1 = "command = \"ipconfig /all\"" fullword
		$s3 = "For Each xfile In mydir.GetFiles()" fullword
		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
		$s12 = "b = Request.QueryString(\"src\")" fullword
		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword

Detection condition:
all of them

Full rule:
rule Webshell_Caterpillar_ASPX {
	meta:
		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/emons5"
		date = "2015/04/03"
		super_rule = 1
		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
		id = "9af48c64-3768-5765-8245-38df000598a7"
	strings:
		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
		$s1 = "command = \"ipconfig /all\"" fullword
		$s3 = "For Each xfile In mydir.GetFiles()" fullword
		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
		$s12 = "b = Request.QueryString(\"src\")" fullword
		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
	condition:
		all of them
}
YARA Detection Rule: MAL_ELF_ReverseShell_SSLShell_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)
Author: Florian Roth
Reference: https://www.barracuda.com/company/legal/esg-vulnerability

Pattern signatures:
$sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
      $s1 = "SSLShell"

Detection condition:
uint32be(0) == 0x7f454c46
      and uint16(0x10) == 0x0002
      and filesize < 5MB
      and all of them

Full rule:
rule MAL_ELF_ReverseShell_SSLShell_Jun23_1 {
   meta:
      description = "Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)"
      author = "Florian Roth"
      reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
      date = "2023-06-07"
      score = 75
      hash1 = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf[PII_REDACTED]7"
      id = "91b34eb7-61d2-592e-a444-249da43994ca"
   strings:
      $sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
      $s1 = "SSLShell"
   condition:
      uint32be(0) == 0x7f454c46
      and uint16(0x10) == 0x0002
      and filesize < 5MB
      and all of them
}
YARA Detection Rule: MAL_ELF_SALTWATER_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)
Author: Florian Roth
Reference: https://www.barracuda.com/company/legal/esg-vulnerability

Pattern signatures:
$x1 = "libbindshell.so"
      
      $s1 = "ShellChannel"
      $s2 = "MyWriteAll"
      $s3 = "CheckRemoteIp"
      $s4 = "run_cmd"
      $s5 = "DownloadByProxyChannel"
      $s6 = "[-] error: popen failed"
      $s7 = "/home/product/code/config/ssl_engine_cert.pem"

Detection condition:
uint16(0) == 0x457f and
      filesize < 6000KB and (
         ( 1 of ($x*) and 2 of them )
         or 3 of them
      ) or all of them

Full rule:
rule MAL_ELF_SALTWATER_Jun23_1 {
   meta:
      description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
      author = "Florian Roth"
      reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
      date = "2023-06-07"
      score = 80
      hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
      id = "10a038f6-6096-5d3a-aaf5-db441685102b"
   strings:
      $x1 = "libbindshell.so"
      
      $s1 = "ShellChannel"
      $s2 = "MyWriteAll"
      $s3 = "CheckRemoteIp"
      $s4 = "run_cmd"
      $s5 = "DownloadByProxyChannel"
      $s6 = "[-] error: popen failed"
      $s7 = "/home/product/code/config/ssl_engine_cert.pem"
   condition:
      uint16(0) == 0x457f and
      filesize < 6000KB and (
         ( 1 of ($x*) and 2 of them )
         or 3 of them
      ) or all of them
}