YARA Detection Rule: brc4_core
Repository: Neo23x0/signature-base
Detects: Hunts for known strings used in Badger till release v1.2.9 when not in an encrypted state
Author: @ninjaparanoid
Reference: https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara

Pattern signatures:
$coreStrings1 = "CLOSED"
        $coreStrings2 = "LISTENING"
        $coreStrings3 = "SYN_SENT"
        $coreStrings4 = "SYN_RCVD"
        $coreStrings5 = "ESTABLISHED"
        $coreStrings6 = "FIN_WAIT1"
        $coreStrings7 = "FIN_WAIT2"
        $coreStrings8 = "CLOSE_WAIT"
        $coreStrings9 = "CLOSING"
        $coreStrings10 = "LAST_ACK"
        $coreStrings11 = "TIME_WAIT"
        $coreStrings12 = "DELETE_TCB"
        $coreStrings13 = "v4.0.30319"
        $coreStrings14 = "bYXJm/3#M?:XyMBF"
        $coreStrings15 = "ServicesActive"
        $coreStrings16 = "coffee"
        $coreStrings17 = "Until Admin Unlock"
        $coreStrings18 = "alertable"
        $coreStrings19 = "%02d%02d%d_%02d%02d%2d%02d_%s"
        $coreStrings20 = "<Left-Mouse>;"
        $coreStrings21 = "<Right-Mouse>;"
        $coreStrings22 = "<Cancel>;"
        $coreStrings23 = "<Middle-Mouse>;"
        $coreStrings24 = "<X1-Mouse>;"
        $coreStrings25 = "<X2-Mouse>;"
        $coreStrings26 = "<BackSpace>;

Detection condition:
20 of them

Full rule:
rule brc4_core {
    meta:
        version = "first version"
        author = "@ninjaparanoid"
        reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
        date = "2022-11-19"
        description = "Hunts for known strings used in Badger till release v1.2.9 when not in an encrypted state"
        id = "3a702d21-392f-5b7d-90a7-eb053d259b32"
    strings:
        $coreStrings1 = "CLOSED"
        $coreStrings2 = "LISTENING"
        $coreStrings3 = "SYN_SENT"
        $coreStrings4 = "SYN_RCVD"
        $coreStrings5 = "ESTABLISHED"
        $coreStrings6 = "FIN_WAIT1"
        $coreStrings7 = "FIN_WAIT2"
        $coreStrings8 = "CLOSE_WAIT"
        $coreStrings9 = "CLOSING"
        $coreStrings10 = "LAST_ACK"
        $coreStrings11 = "TIME_WAIT"
        $coreStrings12 = "DELETE_TCB"
        $coreStrings13 = "v4.0.30319"
        $coreStrings14 = "bYXJm/3#M?:XyMBF"
        $coreStrings15 = "ServicesActive"
        $coreStrings16 = "coffee"
        $coreStrings17 = "Until Admin Unlock"
        $coreStrings18 = "alertable"
        $coreStrings19 = "%02d%02d%d_%02d%02d%2d%02d_%s"
        $coreStrings20 = "<Left-Mouse>;"
        $coreStrings21 = "<Right-Mouse>;"
        $coreStrings22 = "<Cancel>;"
        $coreStrings23 = "<Middle-Mouse>;"
        $coreStrings24 = "<X1-Mouse>;"
        $coreStrings25 = "<X2-Mouse>;"
        $coreStrings26 = "<BackSpace>;"
        $coreStrings27 = "<Enter>;"
        $coreStrings28 = "<Shift>;"
        $coreStrings29 = "<CTRL>;"
        $coreStrings30 = "<ALT>;"
        $coreStrings31 = "<Pause>;"
        $coreStrings32 = "<Caps-Lock>;"
        $coreStrings33 = "<ESC>;"
        $coreStrings34 = "<Page-Up>;"
        $coreStrings35 = "<Page-Down>;"
        $coreStrings36 = "<End>;"
        $coreStrings37 = "<Home-Key>;"
        $coreStrings38 = "<Left-Arrow>;"
        $coreStrings39 = "<Up-Arrow>;"
        $coreStrings40 = "<Right-Arrow>;"
        $coreStrings41 = "<Down-Arrow>;"