deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Honker_HASH_pwhash
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file pwhash.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them

Full rule:
rule CN_Honker_HASH_pwhash {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "689056588f95749f0382d201fac8f58bac393e98"
		id = "5d8c3648-a725-5f01-9800-b75b8c740cf1"
	strings:
		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
}
YARA Detection Rule: CN_Honker_cleaner_cl_2
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file cl.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "cl -eventlog All/Application/System/Security" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "clear iislog error!" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and all of them

Full rule:
rule CN_Honker_cleaner_cl_2 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
		id = "9aa36c0a-9e0f-5274-bebe-9179d81b05f7"
	strings:
		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "clear iislog error!" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 50KB and all of them
}
YARA Detection Rule: CN_Honker_SqlMap_Python_Run
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Run.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = ".\\Run.log" fullword ascii
		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
		$s3 = "%sSqlmap %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and all of them

Full rule:
rule CN_Honker_SqlMap_Python_Run {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
		id = "308d929a-0f38-5db4-92c2-2a7bf25bb64f"
	strings:
		$s1 = ".\\Run.log" fullword ascii
		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
		$s3 = "%sSqlmap %s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 30KB and all of them
}
YARA Detection Rule: CN_Honker_SAMInside
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file SAMInside.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "www.InsidePro.com" fullword wide
		$s1 = "SAMInside.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 650KB and all of them

Full rule:
rule CN_Honker_SAMInside {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
		id = "c5ac9f0a-d1af-59c3-9c13-91153180f3d8"
	strings:
		$s0 = "www.InsidePro.com" fullword wide
		$s1 = "SAMInside.exe" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 650KB and all of them
}
YARA Detection Rule: CN_Honker_WebScan_wwwscan
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file wwwscan.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule CN_Honker_WebScan_wwwscan {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
		id = "defe0024-f94a-560a-a9f6-b3849b41f9bb"
	strings:
		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: CN_Honker_sig_3389_2_3389
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file 3389.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "C:\\Documents and Settings\\Administrator\\" ascii /* PEStudio Blacklist: strings */
		$s2 = "net user guest /active:yes" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "\\Microsoft Word.exe" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 80KB and all of them

Full rule:
rule CN_Honker_sig_3389_2_3389 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
		id = "8b2f5f6d-4d7b-561c-bd77-2de351e5aca8"
	strings:
		$s1 = "C:\\Documents and Settings\\Administrator\\" ascii /* PEStudio Blacklist: strings */
		$s2 = "net user guest /active:yes" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "\\Microsoft Word.exe" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 80KB and all of them
}
YARA Detection Rule: CN_Honker_PHP_php11
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file php11.txt
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii /* PEStudio Blacklist: strings */
		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 800KB and all of them

Full rule:
rule CN_Honker_PHP_php11 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
		id = "e20eaab1-9799-5e61-9a25-3ac0dcce5f7f"
	strings:
		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii /* PEStudio Blacklist: strings */
		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		filesize < 800KB and all of them
}
YARA Detection Rule: CN_Honker_WebCruiserWVS
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "id:uid:user:username:[CREDENTIAL_REDACTED]:account:accounts:admin_id:admin_name:admin_" ascii /* PEStudio Blacklist: strings */
		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and all of them

Full rule:
rule CN_Honker_WebCruiserWVS {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
		id = "16bed1e8-a1f0-5fcf-9c03-83625a388547"
	strings:
		$s0 = "id:uid:user:username:[CREDENTIAL_REDACTED]:account:accounts:admin_id:admin_name:admin_" ascii /* PEStudio Blacklist: strings */
		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 700KB and all of them
}
YARA Detection Rule: CN_Honker_Hookmsgina
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Hookmsgina.dll
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule CN_Honker_Hookmsgina {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
		id = "77813637-ec9f-599c-90c9-be1dd93b45f7"
	strings:
		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: CN_Honker_sig_3389_xp3389
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file xp3389.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii /* PEStudio Blacklist: strings */
		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and all of them

Full rule:
rule CN_Honker_sig_3389_xp3389 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d776eb7596803b5b[PII_REDACTED]7667d34b60d880"
		id = "75d23c63-ba9e-55fd-90fe-5e054d28a777"
	strings:
		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii /* PEStudio Blacklist: strings */
		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 20KB and all of them
}
YARA Detection Rule: CN_Honker_CookiesView
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file CookiesView.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
		$s1 = "maotpo@126.com" fullword ascii
		$s2 = "www.baidu.com" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 640KB and all of them

Full rule:
rule CN_Honker_CookiesView {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c54e1f16d79066edfa0f84e920ed1f[PII_REDACTED]"
		id = "71a43797-4b5b-5f87-a70e-ebabc00d9319"
	strings:
		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
		$s1 = "maotpo@126.com" fullword ascii
		$s2 = "www.baidu.com" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 640KB and all of them
}
YARA Detection Rule: CN_Honker_T00ls_Lpk_Sethc_v4_LPK
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file LPK.DAT
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "\\sethc.exe /G everyone:F" ascii /* PEStudio Blacklist: strings */
		$s4 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 1 of them

Full rule:
rule CN_Honker_T00ls_Lpk_Sethc_v4_LPK {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
		id = "808f5de2-1360-521e-8939-b759e361507c"
	strings:
		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "\\sethc.exe /G everyone:F" ascii /* PEStudio Blacklist: strings */
		$s4 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
}
YARA Detection Rule: CN_Honker_ScanHistory
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ScanHistory.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "ScanHistory.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "select  * from  Results order by scandate desc" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule CN_Honker_ScanHistory {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
		id = "85585cd2-c5ed-5465-bcac-b[PII_REDACTED]5"
	strings:
		$s1 = "ScanHistory.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "select  * from  Results order by scandate desc" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: CN_Honker_InvasionErasor
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file InvasionErasor.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "c:\\winnt\\*.txt" fullword wide /* PEStudio Blacklist: os */
		$s3 = "Command1" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Win2003" fullword ascii /* PEStudio Blacklist: os */
		$s5 = "Win 2000" fullword ascii /* PEStudio Blacklist: os */

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule CN_Honker_InvasionErasor {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
		id = "03ccb643-9f92-5278-a358-65f56cf19ccc"
	strings:
		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "c:\\winnt\\*.txt" fullword wide /* PEStudio Blacklist: os */
		$s3 = "Command1" fullword ascii /* PEStudio Blacklist: strings */
		$s4 = "Win2003" fullword ascii /* PEStudio Blacklist: os */
		$s5 = "Win 2000" fullword ascii /* PEStudio Blacklist: os */
	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: CN_Honker_super_Injection1
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file super Injection1.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
		$s4 = "ScanInject.log" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule CN_Honker_super_Injection1 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8ff2df40c461f6c42b92b[PII_REDACTED]7f2b59b14"
		id = "ad84c5a0-4f03-5040-bdf7-819b40a08ad2"
	strings:
		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
		$s4 = "ScanInject.log" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: CN_Honker_Pk_Pker
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Pker.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide /* PEStudio Blacklist: strings */
		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide /* PEStudio Blacklist: strings */
		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
		$s6 = "Report.dat" fullword wide /* PEStudio Blacklist: strings */
		$s7 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 5 of them

Full rule:
rule CN_Honker_Pk_Pker {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
		id = "dff0e4fb-6b2e-5fa8-910d-63a9e5030b95"
	strings:
		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide /* PEStudio Blacklist: strings */
		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide /* PEStudio Blacklist: strings */
		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
		$s6 = "Report.dat" fullword wide /* PEStudio Blacklist: strings */
		$s7 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 5 of them
}
YARA Detection Rule: CN_Honker_GetPass_GetPass
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file GetPass.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "\\only\\Desktop\\" ascii
		$s2 = "To Run As Administuor" ascii /* PEStudio Blacklist: strings */
		$s3 = "Key to EXIT ... & pause > nul" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule CN_Honker_GetPass_GetPass {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
		id = "999d0ac0-a112-53db-9dbe-10fa4419cfae"
	strings:
		$s1 = "\\only\\Desktop\\" ascii
		$s2 = "To Run As Administuor" ascii /* PEStudio Blacklist: strings */
		$s3 = "Key to EXIT ... & pause > nul" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}