deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: BypassUac_9
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file BypassUac.zip
Author: yarGen Yara Rule Generator

Pattern signatures:
$s0 = "/x86/BypassUac.exe" fullword ascii
      $s1 = "/x64/BypassUac.exe" fullword ascii
      $s2 = "/x86/BypassUacDll.dll" fullword ascii
      $s3 = "/x64/BypassUacDll.dll" fullword ascii
      $s15 = "BypassUac" fullword ascii

Detection condition:
all of them

Full rule:
rule BypassUac_9 {
   meta:
      description = "Auto-generated rule - file BypassUac.zip"
      author = "yarGen Yara Rule Generator"
      hash = "93c2375b2e4f75fc780553600fbdfd3cb344e69d"
      id = "a5751d7d-d135-51bc-8351-40374a2d57bf"
   strings:
      $s0 = "/x86/BypassUac.exe" fullword ascii
      $s1 = "/x64/BypassUac.exe" fullword ascii
      $s2 = "/x86/BypassUacDll.dll" fullword ascii
      $s3 = "/x64/BypassUacDll.dll" fullword ascii
      $s15 = "BypassUac" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: BypassUacDll_6
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file BypassUacDll.aps
Author: yarGen Yara Rule Generator

Pattern signatures:
$s3 = "BypassUacDLL.dll" fullword wide
      $s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii

Detection condition:
all of them

Full rule:
rule BypassUacDll_6 {
   meta:
      description = "Auto-generated rule - file BypassUacDll.aps"
      author = "yarGen Yara Rule Generator"
      hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
      id = "5be27053-446f-5ea3-a242-2661aeffa3df"
   strings:
      $s3 = "BypassUacDLL.dll" fullword wide
      $s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: BypassUac_EXE
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file BypassUacDll.aps
Author: yarGen Yara Rule Generator

Pattern signatures:
$s1 = "Wole32.dll" wide
      $s3 = "System32\\migwiz" wide
      $s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
      $s5 = "Elevation:Administrator!new:" wide
      $s6 = "BypassUac" wide

Detection condition:
all of them

Full rule:
rule BypassUac_EXE {
   meta:
      description = "Auto-generated rule - file BypassUacDll.aps"
      author = "yarGen Yara Rule Generator"
      hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
      id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"
   strings:
      $s1 = "Wole32.dll" wide
      $s3 = "System32\\migwiz" wide
      $s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
      $s5 = "Elevation:Administrator!new:" wide
      $s6 = "BypassUac" wide
   condition:
      all of them
}
YARA Detection Rule: APT_Proxy_Malware_Packed_dev
Repository: Neo23x0/signature-base
Detects: APT Malware - Proxy
Author: FRoth

Pattern signatures:
$string0 = "PECompact2" fullword
      $string1 = "[LordPE]"
      $string2 = "steam_ker.dll"

Detection condition:
all of them

Full rule:
rule APT_Proxy_Malware_Packed_dev {
   meta:
      author = "FRoth"
      date = "2014-11-10"
      description = "APT Malware - Proxy"
      hash = "6b6a86ceeab64a6cb273debfa82aec58"
      score = 50
      id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"
   strings:
      $string0 = "PECompact2" fullword
      $string1 = "[LordPE]"
      $string2 = "steam_ker.dll"
   condition:
      all of them
}
YARA Detection Rule: Tzddos_DDoS_Tool_CN
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file tzddos
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f %%a in (host.txt) do (" ascii
      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
      $s2 = "del host.txt /q" fullword ascii
      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
      $s4 = "start Http.exe %%a %http%" fullword ascii
      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
      $s6 = "del Result.txt s2.txt s1.txt " fullword ascii

Detection condition:
all of them

Full rule:
rule Tzddos_DDoS_Tool_CN {
   meta:
      description = "Disclosed hacktool set - file tzddos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
      id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"
   strings:
      $s0 = "for /f %%a in (host.txt) do (" ascii
      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
      $s2 = "del host.txt /q" fullword ascii
      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
      $s4 = "start Http.exe %%a %http%" fullword ascii
      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
      $s6 = "del Result.txt s2.txt s1.txt " fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Ncat_Hacktools_CN
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file nc.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
      $s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
      $s3 = "gethostpoop fuxored" fullword ascii
      $s6 = "VERNOTSUPPORTED" fullword ascii
      $s7 = "%s [%s] %d (%s)" fullword ascii
      $s12 = " `--%s' doesn't allow an argument" fullword ascii

Detection condition:
all of them

Full rule:
rule Ncat_Hacktools_CN {
   meta:
      description = "Disclosed hacktool set - file nc.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "001c0c01c96fa56216159f83f6f298755366e528"
      id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"
   strings:
      $s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
      $s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
      $s3 = "gethostpoop fuxored" fullword ascii
      $s6 = "VERNOTSUPPORTED" fullword ascii
      $s7 = "%s [%s] %d (%s)" fullword ascii
      $s12 = " `--%s' doesn't allow an argument" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: MS08_067_Exploit_Hacktools_CN
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file cs.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
      $s3 = "Make SMB Connection error:%d" fullword ascii
      $s5 = "Send Payload Over!" fullword ascii
      $s7 = "Maybe Patched!" fullword ascii
      $s8 = "RpcExceptionCode() = %u" fullword ascii
      $s11 = "ph4nt0m" fullword wide
      $s12 = "\\\\%s\\IPC" ascii

Detection condition:
4 of them

Full rule:
rule MS08_067_Exploit_Hacktools_CN {
   meta:
      description = "Disclosed hacktool set - file cs.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "a3e9e[PII_REDACTED]253a1a60dbc763d[PII_REDACTED]"
      id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
   strings:
      $s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
      $s3 = "Make SMB Connection error:%d" fullword ascii
      $s5 = "Send Payload Over!" fullword ascii
      $s7 = "Maybe Patched!" fullword ascii
      $s8 = "RpcExceptionCode() = %u" fullword ascii
      $s11 = "ph4nt0m" fullword wide
      $s12 = "\\\\%s\\IPC" ascii
   condition:
      4 of them
}
YARA Detection Rule: Hacktools_CN_Burst_sql
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file sql.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
      $s2 = "s.exe start error...%d" fullword ascii
      $s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
      $s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
      $s10 = "Result.txt" fullword ascii
      $s11 = "Usage:sql.exe [options]" fullword ascii
      $s17 = "%s root %s %d error" fullword ascii
      $s18 = "Pass.txt" fullword ascii
      $s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii

Detection condition:
6 of them

Full rule:
rule Hacktools_CN_Burst_sql {
   meta:
      description = "Disclosed hacktool set - file sql.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "d5139b865e99b7a276af7ae11b14096adb928245"
      id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
   strings:
      $s0 = "s.exe %s %s %s %s %d /save" fullword ascii
      $s2 = "s.exe start error...%d" fullword ascii
      $s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
      $s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
      $s10 = "Result.txt" fullword ascii
      $s11 = "Usage:sql.exe [options]" fullword ascii
      $s17 = "%s root %s %d error" fullword ascii
      $s18 = "Pass.txt" fullword ascii
      $s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
   condition:
      6 of them
}
YARA Detection Rule: Hacktools_CN_Panda_445TOOL
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file 445TOOL.rar
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "scan.bat" fullword ascii
      $s1 = "Http.exe" fullword ascii
      $s2 = "GOGOGO.bat" fullword ascii
      $s3 = "ip.txt" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Panda_445TOOL {
   meta:
      description = "Disclosed hacktool set - file 445TOOL.rar"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "92050ba43029f[PII_REDACTED]98cf3b18e34457a11"
      id = "02075631-49cc-5b97-ad8e-92d734a26d34"
   strings:
      $s0 = "scan.bat" fullword ascii
      $s1 = "Http.exe" fullword ascii
      $s2 = "GOGOGO.bat" fullword ascii
      $s3 = "ip.txt" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_Panda_445
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file 445.rar
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
      $s1 = "445\\nc.exe" fullword ascii
      $s2 = "445\\s.exe" fullword ascii
      $s3 = "cs.exe %1" fullword ascii
      $s4 = "445\\cs.exe" fullword ascii
      $s5 = "445\\ip.txt" fullword ascii
      $s6 = "445\\cmd.bat" fullword ascii
      $s9 = "@echo off" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Panda_445 {
   meta:
      description = "Disclosed hacktool set - file 445.rar"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
      id = "02075631-49cc-5b97-ad8e-92d734a26d34"
   strings:
      $s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
      $s1 = "445\\nc.exe" fullword ascii
      $s2 = "445\\s.exe" fullword ascii
      $s3 = "cs.exe %1" fullword ascii
      $s4 = "445\\cs.exe" fullword ascii
      $s5 = "445\\ip.txt" fullword ascii
      $s6 = "445\\cmd.bat" fullword ascii
      $s9 = "@echo off" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_WinEggDrop
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file s.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
      $s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
      $s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
      $s8 = "Something Wrong About The Ports" fullword ascii
      $s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
      $s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
      $s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
      $s13 = "%-16s %-5d -> \"%s\"" fullword ascii
      $s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
      $s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
      $s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii

Detection condition:
5 of them

Full rule:
rule Hacktools_CN_WinEggDrop {
   meta:
      description = "Disclosed hacktool set - file s.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "[PII_REDACTED]ce01f57e8dc0a85d35ec556035145d"
      id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"
   strings:
      $s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
      $s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
      $s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
      $s8 = "Something Wrong About The Ports" fullword ascii
      $s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
      $s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
      $s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
      $s13 = "%-16s %-5d -> \"%s\"" fullword ascii
      $s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
      $s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
      $s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
   condition:
      5 of them
}
YARA Detection Rule: Hacktools_CN_Scan_BAT
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file scan.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f %%a in (host.txt) do (" ascii
      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
      $s2 = "del host.txt /q" fullword ascii
      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
      $s4 = "start Http.exe %%a %http%" fullword ascii
      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii

Detection condition:
5 of them

Full rule:
rule Hacktools_CN_Scan_BAT {
   meta:
      description = "Disclosed hacktool set - file scan.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
      id = "836e0618-93c7-5519-bbc4-705ff5c2e127"
   strings:
      $s0 = "for /f %%a in (host.txt) do (" ascii
      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
      $s2 = "del host.txt /q" fullword ascii
      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
      $s4 = "start Http.exe %%a %http%" fullword ascii
      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
   condition:
      5 of them
}
YARA Detection Rule: Hacktools_CN_Panda_Burst
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Burst.rar
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Panda_Burst {
   meta:
      description = "Disclosed hacktool set - file Burst.rar"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
      id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"
   strings:
      $s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_445_cmd
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file cmd.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$bat = "@echo off" fullword ascii
      $s0 = "cs.exe %1" fullword ascii
      $s2 = "nc %1 4444" fullword ascii

Detection condition:
uint32(0) == 0x68636540 and $bat at 0 and all of ($s*)

Full rule:
rule Hacktools_CN_445_cmd {
   meta:
      description = "Disclosed hacktool set - file cmd.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "69b105a3aec[PII_REDACTED]c1a913772c40c6b727a"
      id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"
   strings:
      $bat = "@echo off" fullword ascii
      $s0 = "cs.exe %1" fullword ascii
      $s2 = "nc %1 4444" fullword ascii
   condition:
      uint32(0) == 0x68636540 and $bat at 0 and all of ($s*)
}
YARA Detection Rule: Hacktools_CN_GOGOGO_Bat
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file GOGOGO.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
      $s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
      $s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
      $s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
      $s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
      $s6 = "del /f tcpip.sys" fullword ascii
      $s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
      $s10 = "call scan.bat" fullword ascii
      $s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
      $s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
      $s18 = "sc config LmHosts start= auto" fullword ascii
      $s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
      $s20 = "ren %systemroot%\\syste

Detection condition:
3 of them

Full rule:
rule Hacktools_CN_GOGOGO_Bat {
   meta:
      description = "Disclosed hacktool set - file GOGOGO.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "4bd4f5b070acf7fe70460d7eefb[PII_REDACTED]bbd"
      id = "b52cc150-81d4-5895-8f83-ee2006f75617"
   strings:
      $s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
      $s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
      $s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
      $s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
      $s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
      $s6 = "del /f tcpip.sys" fullword ascii
      $s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
      $s10 = "call scan.bat" fullword ascii
      $s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
      $s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
      $s18 = "sc config LmHosts start= auto" fullword ascii
      $s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
      $s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: Hacktools_CN_Burst_pass
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file pass.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "123456.com" fullword ascii
      $s1 = "123123.com" fullword ascii
      $s2 = "360.com" fullword ascii
      $s3 = "123.com" fullword ascii
      $s4 = "juso.com" fullword ascii
      $s5 = "sina.com" fullword ascii
      $s7 = "changeme" fullword ascii
      $s8 = "master" fullword ascii
      $s9 = "google.com" fullword ascii
      $s10 = "chinanet" fullword ascii
      $s12 = "lionking" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Burst_pass {
   meta:
      description = "Disclosed hacktool set - file pass.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "55a05cf93dbd274355d798534be471dff26803f9"
      id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"
   strings:
      $s0 = "123456.com" fullword ascii
      $s1 = "123123.com" fullword ascii
      $s2 = "360.com" fullword ascii
      $s3 = "123.com" fullword ascii
      $s4 = "juso.com" fullword ascii
      $s5 = "sina.com" fullword ascii
      $s7 = "changeme" fullword ascii
      $s8 = "master" fullword ascii
      $s9 = "google.com" fullword ascii
      $s10 = "chinanet" fullword ascii
      $s12 = "lionking" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_JoHor_Posts_Killer
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file JoHor_Posts_Killer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Multithreading Posts_Send Killer" fullword ascii
      $s3 = "GET [Access Point] HTTP/1.1" fullword ascii
      $s6 = "The program's need files was not exist!" fullword ascii
      $s7 = "JoHor_Posts_Killer" fullword wide
      $s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
      $s10 = "  ( /s ) :" fullword ascii
      $s11 = "forms.vbp" fullword ascii
      $s12 = "forms.vcp" fullword ascii
      $s13 = "Software\\FlySky\\E\\Install" fullword ascii

Detection condition:
5 of them

Full rule:
rule Hacktools_CN_JoHor_Posts_Killer {
   meta:
      description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
      id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"
   strings:
      $s0 = "Multithreading Posts_Send Killer" fullword ascii
      $s3 = "GET [Access Point] HTTP/1.1" fullword ascii
      $s6 = "The program's need files was not exist!" fullword ascii
      $s7 = "JoHor_Posts_Killer" fullword wide
      $s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
      $s10 = "  ( /s ) :" fullword ascii
      $s11 = "forms.vbp" fullword ascii
      $s12 = "forms.vcp" fullword ascii
      $s13 = "Software\\FlySky\\E\\Install" fullword ascii
   condition:
      5 of them
}