deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Reflective_DLL_Loader_Aug17_3
Repository: Neo23x0/signature-base
Detects: Detects Reflective DLL Loader
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "\\Release\\inject.pdb" ascii
      $s2 = "!!! Failed to gather information on system processes! " fullword ascii
      $s3 = "reflective_dll.dll" fullword ascii
      $s4 = "[-] %s. Error=%d" fullword ascii
      $s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "26ba48d3e3b964f75ff148b6679b42ec" or
           2 of them
        )
      ) or ( 3 of them )

Full rule:
rule Reflective_DLL_Loader_Aug17_3 {
   meta:
      description = "Detects Reflective DLL Loader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-20"
      modified = "2022-12-21"
      hash1 = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
      id = "91842f58-5205-533d-9e97-a1e84fbf259d"
   strings:
      $s1 = "\\Release\\inject.pdb" ascii
      $s2 = "!!! Failed to gather information on system processes! " fullword ascii
      $s3 = "reflective_dll.dll" fullword ascii
      $s4 = "[-] %s. Error=%d" fullword ascii
      $s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "26ba48d3e3b964f75ff148b6679b42ec" or
           2 of them
        )
      ) or ( 3 of them )
}
YARA Detection Rule: Reflective_DLL_Loader_Aug17_4
Repository: Neo23x0/signature-base
Detects: Detects Reflective DLL Loader
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii

      $s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
      $s2 = "<H2>Operating system: %s<H2>" fullword ascii
      $s3 = "<H2>System32 dir:  %s</H2>" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 2000KB and 2 of them
      )

Full rule:
rule Reflective_DLL_Loader_Aug17_4 {
   meta:
      description = "Detects Reflective DLL Loader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-20"
      hash1 = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
      hash2 = "f76151646a0b[PII_REDACTED]2cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
      id = "d2a28ea6-a3f7-5ceb-86fd-1e5b7f916a41"
   strings:
      $x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii

      $s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
      $s2 = "<H2>Operating system: %s<H2>" fullword ascii
      $s3 = "<H2>System32 dir:  %s</H2>" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 2000KB and 2 of them
      )
}
YARA Detection Rule: CobaltStrike_CN_Group_BeaconDropper_Aug17
Repository: Neo23x0/signature-base
Detects: Detects Script Dropper of Cobalt Gang used in August 2017
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
      $x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
      $x3 = "sh.Run(env('cmd /c set > %temp%" ascii
      $x4 = "sh.Run('regsvr32 /s /u /i:" ascii
      $x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
      $x6 = "scrobj.dll','********" ascii
      $x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
      $x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
      $x9 = "lnkName='office 365'; " fullword ascii
      $x10 = ";sh=x('WScript.Shell');" ascii

Detection condition:
( filesize < 200KB and 1 of them )

Full rule:
rule CobaltStrike_CN_Group_BeaconDropper_Aug17 {
   meta:
      description = "Detects Script Dropper of Cobalt Gang used in August 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-08-09"
      hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
      hash2 = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
      hash3 = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
      id = "5631b0bc-9e25-524a-9003-73779fd492f7"
   strings:
      $x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
      $x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
      $x3 = "sh.Run(env('cmd /c set > %temp%" ascii
      $x4 = "sh.Run('regsvr32 /s /u /i:" ascii
      $x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
      $x6 = "scrobj.dll','********" ascii
      $x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
      $x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
      $x9 = "lnkName='office 365'; " fullword ascii
      $x10 = ";sh=x('WScript.Shell');" ascii
   condition:
      ( filesize < 200KB and 1 of them )
}
YARA Detection Rule: CobaltGang_Malware_Aug17_1
Repository: Neo23x0/signature-base
Detects: Detects a Cobalt Gang malware
Author: Florian Roth (Nextron Systems)
Reference: https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c

Pattern signatures:
$s1 = "ServerSocket.EXE" fullword wide
      $s2 = "Incorrect version of WS2_32.dll found" fullword ascii
      $s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
      $s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )

Full rule:
rule CobaltGang_Malware_Aug17_1 {
   meta:
      description = "Detects a Cobalt Gang malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
      date = "2017-08-09"
      hash1 = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
      id = "56c6f4f8-ccf5-5665-ac21-67f0a9b67cf1"
   strings:
      $s1 = "ServerSocket.EXE" fullword wide
      $s2 = "Incorrect version of WS2_32.dll found" fullword ascii
      $s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
      $s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
}
YARA Detection Rule: CobaltGang_Malware_Aug17_2
Repository: Neo23x0/signature-base
Detects: Detects a Cobalt Gang malware
Author: Florian Roth (Nextron Systems)
Reference: https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c

Pattern signatures:
$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and all of them )

Full rule:
rule CobaltGang_Malware_Aug17_2 {
   meta:
      description = "Detects a Cobalt Gang malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
      date = "2017-08-09"
      hash1 = "80791d5e76782cc3cd14f37f351e33b[PII_REDACTED]92ab5b650f1cdf4f131cf72"
      id = "2839c119-0fa4-51f0-a406-5d381cc594a2"
   strings:
      $s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
}
YARA Detection Rule: MAL_CRIME_CobaltGang_Malware_Oct19_1
Repository: Neo23x0/signature-base
Detects: Detects CobaltGang malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/vxsh4d0w/status/[PII_REDACTED]15611392

Pattern signatures:
$op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }

      $op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
      $op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and (
         pe.imphash() == "d1e3f8d02cce09520379e5c1e72f862f" or
         pe.imphash() == "8e26df99c70f79cb8b1ea2ef6f8e52ac" or
         ( $op_a1 and 1 of ($op_b*) )
      )

Full rule:
rule MAL_CRIME_CobaltGang_Malware_Oct19_1 {
   meta:
      description = "Detects CobaltGang malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/vxsh4d0w/status/[PII_REDACTED]15611392"
      date = "2019-10-24"
      hash1 = "[PII_REDACTED]5f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
      hash2 = "[PII_REDACTED]02c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
      hash3 = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
      id = "95c16016-b09b-56f3-b5a4-fca18ac70ad5"
   strings:
      $op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }

      $op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
      $op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and (
         pe.imphash() == "d1e3f8d02cce09520379e5c1e72f862f" or
         pe.imphash() == "8e26df99c70f79cb8b1ea2ef6f8e52ac" or
         ( $op_a1 and 1 of ($op_b*) )
      )
}
YARA Detection Rule: MAL_Backdoor_DLL_Nov23_1
Repository: Neo23x0/signature-base
Detects: Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
Author: X__Junior
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Pattern signatures:
$s1 = "ERROR GET INTERVAL" ascii
      $s2 = "OFF HIDDEN MODE" ascii
      $s3 = "commandMod:" ascii
      $s4 = "RESULT:" ascii

      $op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
      $op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }

Detection condition:
uint16(0) == 0x5a4d
      and ( all of ($s*) or all of ($op*) )

Full rule:
rule MAL_Backdoor_DLL_Nov23_1 {
   meta:
      author = "X__Junior"
      description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
      date = "2023-11-23"
      hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
      hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
      score = 80
      id = "3588d437-b561-5380-8dac-73a31f4cdb5a"
   strings:
      $s1 = "ERROR GET INTERVAL" ascii
      $s2 = "OFF HIDDEN MODE" ascii
      $s3 = "commandMod:" ascii
      $s4 = "RESULT:" ascii

      $op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
      $op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
   condition:
      uint16(0) == 0x5a4d
      and ( all of ($s*) or all of ($op*) )
}
YARA Detection Rule: MAL_Trojan_DLL_Nov23
Repository: Neo23x0/signature-base
Detects: Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
Author: X__Junior
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Pattern signatures:
$op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
      $op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
      $op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule MAL_Trojan_DLL_Nov23 {
   meta:
      author = "X__Junior"
      description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
      date = "2023-11-23"
      hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
      score = 80
      id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"
   strings:
      $op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
      $op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
      $op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: MAL_DLL_Stealer_Nov23
Repository: Neo23x0/signature-base
Detects: Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
Author: X__Junior
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Pattern signatures:
$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule MAL_DLL_Stealer_Nov23 {
   meta:
      author = "X__Junior"
      description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
      date = "2023-11-23"
      hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
      score = 80
      id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"
   strings:
      $op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: MAL_Python_Backdoor_Script_Nov23
Repository: Neo23x0/signature-base
Detects: Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
Author: X__Junior
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Pattern signatures:
$s1 = "port = 443 if \"https\"" ascii
      $s2 = "winrm.Session basic error" ascii
      $s3 = "Windwoscmd.run_cmd(str(cmd))" ascii

Detection condition:
filesize < 50KB and all of them

Full rule:
rule MAL_Python_Backdoor_Script_Nov23 {
   meta:
      author = "X__Junior"
      description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
      date = "2023-11-23"
      hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
      score = 80
      id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"
   strings:
      $s1 = "port = 443 if \"https\"" ascii
      $s2 = "winrm.Session basic error" ascii
      $s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
   condition:
      filesize < 50KB and all of them
}
YARA Detection Rule: APT_RANSOM_Lockbit_ForensicArtifacts_Nov23
Repository: Neo23x0/signature-base
Detects: Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966
Author: Florian Roth
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Pattern signatures:
$x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
      $x2 = " 1> \\\\127.0.0.1\\admin$\\__"

Detection condition:
1 of ($x*)

Full rule:
rule APT_RANSOM_Lockbit_ForensicArtifacts_Nov23 {
   meta:
      description = "Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966"
      author = "Florian Roth"
      date = "2023-11-22"
      score = 75
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
      id = "04bde599-2a5b-5a33-a6f1-67d57a564946"
   strings:
      $x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
      $x2 = " 1> \\\\127.0.0.1\\admin$\\__"
   condition:
      1 of ($x*)
}
YARA Detection Rule: APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability
Author: Florian Roth
Reference: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

Pattern signatures:
$x1 = "cmd = base64.b64decode(rst.group"
      $x2 = "f.write(\"/*\"+output+\"*/\")"

      $x3 = "* * * * * root wget -qO- http://"
      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"

      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
      $x5b = "failed to unmarshal session(./../" // customer data

      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
      $x7 = "$(uname -a) > /var/" base64

Detection condition:
1 of them

Full rule:
rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
      author = "Florian Roth"
      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
      date = "2024-04-15"
      modified = "2024-04-18"
      score = 70
      id = "32cf18ff-784d-5849-87f8-14ede7315188"
   strings:
      $x1 = "cmd = base64.b64decode(rst.group"
      $x2 = "f.write(\"/*\"+output+\"*/\")"

      $x3 = "* * * * * root wget -qO- http://"
      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"

      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
      $x5b = "failed to unmarshal session(./../" // customer data

      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
      $x7 = "$(uname -a) > /var/" base64
   condition:
      1 of them
}
YARA Detection Rule: EXPL_PaloAlto_CVE_2024_3400_Apr24_1
Repository: Neo23x0/signature-base
Detects: Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400
Author: Florian Roth
Reference: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

Pattern signatures:
$x1 = "SESSID=../../../../opt/panlogs/"
      $x2 = "SESSID=./../../../../opt/panlogs/"
      
      $sa1 = "SESSID=../../../../"
      $sa2 = "SESSID=./../../../../"
      
      $sb2 = "${IFS}"

Detection condition:
1 of ($x*)
      or (1 of ($sa*) and $sb2)

Full rule:
rule EXPL_PaloAlto_CVE_2024_3400_Apr24_1 {
   meta:
      description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
      author = "Florian Roth"
      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
      date = "2024-04-15"
      score = 70
      id = "1bcf0415-5351-5e09-ab93-496e8dc47c92"
   strings:
      $x1 = "SESSID=../../../../opt/panlogs/"
      $x2 = "SESSID=./../../../../opt/panlogs/"
      
      $sa1 = "SESSID=../../../../"
      $sa2 = "SESSID=./../../../../"
      
      $sb2 = "${IFS}"
   condition:
      1 of ($x*)
      or (1 of ($sa*) and $sb2)
}
YARA Detection Rule: SUSP_LNX_Base64_Download_Exec_Apr24
Repository: Neo23x0/signature-base
Detects: Detects suspicious base64 encoded shell commands used for downloading and executing further stages
Author: Paul Hager
Reference: Internal Research

Pattern signatures:
$sa1 = "curl http" base64
      $sa2 = "wget http" base64
      
      $sb1 = "chmod 777 " base64
      $sb2 = "/tmp/" base64

Detection condition:
1 of ($sa*)
      and all of ($sb*)

Full rule:
rule SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT {
   meta:
      description = "Detects suspicious base64 encoded shell commands used for downloading and executing further stages"
      author = "Paul Hager"
      date = "2024-04-18"
      reference = "Internal Research"
      score = 75
      id = "df8dddef-3c49-500c-abc8-7f7de5aa69ae"
   strings:
      $sa1 = "curl http" base64
      $sa2 = "wget http" base64
      
      $sb1 = "chmod 777 " base64
      $sb2 = "/tmp/" base64
   condition:
      1 of ($sa*)
      and all of ($sb*)
}
YARA Detection Rule: SUSP_PY_Import_Statement_Apr24_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious Python import statement and socket usage often found in Python reverse shells
Author: Florian Roth
Reference: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

Pattern signatures:
$x1 = "import sys,socket,os,pty;s=socket.socket("

Detection condition:
1 of them

Full rule:
rule SUSP_PY_Import_Statement_Apr24_1 {
   meta:
      description = "Detects suspicious Python import statement and socket usage often found in Python reverse shells"
      author = "Florian Roth"
      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
      date = "2024-04-15"
      score = 65
      id = "8e05f9a1-40a8-5d01-9e45-8779b0ff7a45"
   strings:
      $x1 = "import sys,socket,os,pty;s=socket.socket("
   condition:
      1 of them
}