deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_SqlMap_backdoor
Repository: Neo23x0/signature-base
Detects: Detects SqlMap backdoors
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/sqlmapproject/sqlmap

Detection condition:
(uint32(0) == 0x8e859c07 or
         uint32(0) == 0x2d859c07 or
         uint32(0) == 0x92959c07 or
         uint32(0) == 0x929d9c07 or
         uint32(0) == 0x29959c07 or
         uint32(0) == 0x2b8d9c07 or
         uint32(0) == 0x2b859c07 or
         uint32(0) == 0x28b59c07) and filesize < 2KB

Full rule:
rule HKTL_SqlMap_backdoor {
   meta:
      description = "Detects SqlMap backdoors"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/sqlmapproject/sqlmap"
      date = "2018-10-09"
      id = "bf09caac-cf15-5936-b5b4-df4f28788961"
   condition:
      (uint32(0) == 0x8e859c07 or
         uint32(0) == 0x2d859c07 or
         uint32(0) == 0x92959c07 or
         uint32(0) == 0x929d9c07 or
         uint32(0) == 0x29959c07 or
         uint32(0) == 0x2b8d9c07 or
         uint32(0) == 0x2b859c07 or
         uint32(0) == 0x28b59c07) and filesize < 2KB
}
YARA Detection Rule: HKTL_Lazagne_PasswordDumper_Dec18_1
Repository: Neo23x0/signature-base
Detects: Detects password dumper Lazagne often used by middle eastern threat groups
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

Pattern signatures:
$s1 = "softwares.opera(" ascii
      $s2 = "softwares.mozilla(" ascii
      $s3 = "config.dico(" ascii
      $s4 = "softwares.chrome(" ascii
      $s5 = "softwares.outlook(" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 17000KB and 1 of them

Full rule:
rule HKTL_Lazagne_PasswordDumper_Dec18_1 {
   meta:
      description = "Detects password dumper Lazagne often used by middle eastern threat groups"
      author = "Florian Roth (Nextron Systems)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
      date = "2018-12-11"
      score = 85
      hash1 = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
      hash2 = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
      hash3 = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
      id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"
   strings:
      $s1 = "softwares.opera(" ascii
      $s2 = "softwares.mozilla(" ascii
      $s3 = "config.dico(" ascii
      $s4 = "softwares.chrome(" ascii
      $s5 = "softwares.outlook(" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 17000KB and 1 of them
}
YARA Detection Rule: HKTL_Lazagne_Gen_18
Repository: Neo23x0/signature-base
Detects: Detects Lazagne password extractor hacktool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/AlessandroZ/LaZagne

Pattern signatures:
$x1 = "lazagne.config.powershell_execute(" ascii
      $x2 = "creddump7.win32." ascii
      $x3 = "lazagne.softwares.windows.hashdump" ascii
      $x4 = ".softwares.memory.libkeepass.common(" ascii

Detection condition:
2 of them

Full rule:
rule HKTL_Lazagne_Gen_18 {
   meta:
      description = "Detects Lazagne password extractor hacktool"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/AlessandroZ/LaZagne"
      license = "https://creativecommons.org/licenses/by-nc/4.0/"
      date = "2018-12-11"
      score = 80
      hash1 = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c[PII_REDACTED]7eecf"
      id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"
   strings:
      $x1 = "lazagne.config.powershell_execute(" ascii
      $x2 = "creddump7.win32." ascii
      $x3 = "lazagne.softwares.windows.hashdump" ascii
      $x4 = ".softwares.memory.libkeepass.common(" ascii
   condition:
      2 of them
}
YARA Detection Rule: HKTL_NoPowerShell
Repository: Neo23x0/signature-base
Detects: Detects NoPowerShell hack tool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bitsadmin/nopowershell

Pattern signatures:
$x1 = "\\NoPowerShell.pdb" ascii
      $x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
      $x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
      $x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
      $x5 = "NoPowerShell.exe" fullword wide

Detection condition:
1 of them

Full rule:
rule HKTL_NoPowerShell {
   meta:
      description = "Detects NoPowerShell hack tool"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/bitsadmin/nopowershell"
      date = "2018-12-28"
      modified = "2022-12-21"
      hash1 = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
      id = "17d508d5-833f-5232-a071-dbed8758493b"
   strings:
      $x1 = "\\NoPowerShell.pdb" ascii
      $x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
      $x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
      $x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
      $x5 = "NoPowerShell.exe" fullword wide
   condition:
      1 of them
}
YARA Detection Rule: HKTL_htran_go
Repository: Neo23x0/signature-base
Detects: Detects go based htran variant
Author: Jeff Beley

Pattern signatures:
$s1 = "https://github.com/cw1997/NATBypass" fullword ascii
      $s2 = "-slave ip1:port1 ip2:port2" fullword ascii
      $s3 = "-tran port1 ip:port2" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them

Full rule:
rule HKTL_htran_go {
   meta:
      author = "Jeff Beley"
      hash1 = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
      description = "Detects go based htran variant"
      date = "2019-01-09"
      id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"
   strings:
      $s1 = "https://github.com/cw1997/NATBypass" fullword ascii
      $s2 = "-slave ip1:port1 ip2:port2" fullword ascii
      $s3 = "-tran port1 ip:port2" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them
}
YARA Detection Rule: SUSP_Katz_PDB
Repository: Neo23x0/signature-base
Detects: Detects suspicious PDB in file
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = /\\Release\\[a-z]{0,8}katz.pdb/
      $s2 = /\\Debug\\[a-z]{0,8}katz.pdb/

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and all of them

Full rule:
rule SUSP_Katz_PDB {
   meta:
      description = "Detects suspicious PDB in file"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-02-04"
      hash1 = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
      id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"
   strings:
      $s1 = /\\Release\\[a-z]{0,8}katz.pdb/
      $s2 = /\\Debug\\[a-z]{0,8}katz.pdb/
   condition:
      uint16(0) == 0x5a4d and filesize < 6000KB and all of them
}
YARA Detection Rule: HKTL_LNX_Pnscan
Repository: Neo23x0/signature-base
Detects: Detects Pnscan port scanner
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/ptrrkssn/pnscan

Pattern signatures:
$x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
      $x2 = "This program implements a multithreaded TCP port scanner." ascii wide

Detection condition:
filesize < 6000KB and 1 of them

Full rule:
rule HKTL_LNX_Pnscan {
   meta:
      description = "Detects Pnscan port scanner"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/ptrrkssn/pnscan"
      date = "2019-05-27"
      score = 55
      id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"
   strings:
      $x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
      $x2 = "This program implements a multithreaded TCP port scanner." ascii wide
   condition:
      filesize < 6000KB and 1 of them
}
YARA Detection Rule: PAExec
Repository: Neo23x0/signature-base
Detects: Detects remote access tool PAEXec (like PsExec) - file PAExec.exe
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/

Pattern signatures:
$x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
      $x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
      $x3 = "PAExec %s - Execute Programs Remotely" fullword wide
      $x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
      $x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
      $x6 = "%%SystemRoot%%\\%s.exe" fullword wide
      $x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
      $x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 600KB and 1 of ($x*)) or (3 of them)

Full rule:
rule PAExec {
   meta:
      description = "Detects remote access tool PAEXec (like PsExec) - file PAExec.exe"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
      date = "2017-03-27"
      score = 40
      hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
      id = "ee564534-b921-5639-a7ed-5da79d6bf86a"
   strings:
      $x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
      $x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
      $x3 = "PAExec %s - Execute Programs Remotely" fullword wide
      $x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
      $x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
      $x6 = "%%SystemRoot%%\\%s.exe" fullword wide
      $x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
      $x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 600KB and 1 of ($x*)) or (3 of them)
}
YARA Detection Rule: HKTL_DomainPasswordSpray
Repository: Neo23x0/signature-base
Detects: Detects the Powershell password spray tool DomainPasswordSpray
Author: Arnim Rupp
Reference: https://github.com/dafthack/DomainPasswordSpray

Pattern signatures:
$s = "Invoke-DomainPasswordSpray" fullword ascii wide

Detection condition:
filesize < 100KB and
      all of them

Full rule:
rule HKTL_DomainPasswordSpray {
   meta:
      description = "Detects the Powershell password spray tool DomainPasswordSpray"
      author = "Arnim Rupp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      reference = "https://github.com/dafthack/DomainPasswordSpray"
      date = "2023-01-13"
      score = 60
      hash1 = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
      id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"
   strings:
      $s = "Invoke-DomainPasswordSpray" fullword ascii wide
   condition:
      filesize < 100KB and
      all of them
}
YARA Detection Rule: HKTL_RustHound
Repository: Neo23x0/signature-base
Detects: Detect hacktool RustHound (Sharphound clone)
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/OPENCYBER-FR/RustHound

Pattern signatures:
$rh1 = "rusthound" fullword ascii wide
      $rh2 = "Making json/zip files finished!" ascii wide

Detection condition:
(
         // PE or elf
         uint16(0) == 0x5A4D or
         uint16(0) == 0x457f
      ) and
      1 of ($rh*)

Full rule:
rule HKTL_RustHound {
   meta:
      description = "Detect hacktool RustHound (Sharphound clone)"
      author = "Arnim Rupp (https://github.com/ruppde)"
      date = "2023-03-30"
      reference = "https://github.com/OPENCYBER-FR/RustHound"
      hash = "409f61a34d[PII_REDACTED]f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
      hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
      hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b[PII_REDACTED]"
      hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
      hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
      hash = "4edfed92b54d32a58b2cfc926f98a56637e[PII_REDACTED]6abcc469a8bc846bc85"
      hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
      hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
      hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
      hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
      id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
   strings:
      $rh1 = "rusthound" fullword ascii wide
      $rh2 = "Making json/zip files finished!" ascii wide
   condition:
      (
         // PE or elf
         uint16(0) == 0x5A4D or
         uint16(0) == 0x457f
      ) and
      1 of ($rh*)
}
YARA Detection Rule: Winnti_fonfig
Repository: Neo23x0/signature-base
Detects: Winnti sample - file fonfig.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/VbvJtL

Pattern signatures:
$s1 = "mciqtz.exe" fullword wide
      $s2 = "knat9y7m" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Winnti_fonfig {
   meta:
      description = "Winnti sample - file fonfig.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/VbvJtL"
      date = "2017-01-25"
      hash1 = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a[PII_REDACTED]41"
      id = "ca3c186c-0286-5b9b-9[PII_REDACTED]c8c3d"
   strings:
      $s1 = "mciqtz.exe" fullword wide
      $s2 = "knat9y7m" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: Winnti_NlaifSvc
Repository: Neo23x0/signature-base
Detects: Winnti sample - file NlaifSvc.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/VbvJtL

Pattern signatures:
$x1 = "cracked by ximo" ascii

      $s1 = "Yqrfpk" fullword ascii
      $s2 = "IVVTOC" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )

Full rule:
rule Winnti_NlaifSvc {
   meta:
      description = "Winnti sample - file NlaifSvc.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/VbvJtL"
      date = "2017-01-25"
      hash1 = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
      id = "d2bfcad4-9762-5f2a-88cc-e8cdc648e710"
   strings:
      $x1 = "cracked by ximo" ascii

      $s1 = "Yqrfpk" fullword ascii
      $s2 = "IVVTOC" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )
}
YARA Detection Rule: Elise_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Elise malware samples - fake Norton Security NavShExt.dll
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/blu3_team/status/[PII_REDACTED]29135105

Pattern signatures:
$s1 = "NavShExt.dll" fullword wide
      $s2 = "Norton Security" fullword wide

      $a1 = "donotbotherme" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and (
        pe.imphash() == "e9478ee4ebf085d1f14f64ba96ef082f" or
        ( 1 of ($s*) and $a1 )
      )

Full rule:
rule Elise_Jan18_1 {
   meta:
      description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/blu3_team/status/[PII_REDACTED]29135105"
      date = "2018-01-24"
      hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
      id = "8e4f4ec8-5d31-5990-8c14-861423571a79"
   strings:
      $s1 = "NavShExt.dll" fullword wide
      $s2 = "Norton Security" fullword wide

      $a1 = "donotbotherme" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 250KB and (
        pe.imphash() == "e9478ee4ebf085d1f14f64ba96ef082f" or
        ( 1 of ($s*) and $a1 )
      )
}
YARA Detection Rule: SUSP_XORed_Mozilla_Oct19
Repository: Neo23x0/signature-base
Detects: Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Author: Florian Roth
Reference: https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Pattern signatures:
$xo1 = "Mozilla/5.0" xor ascii wide
      $xof1 = "Mozilla/5.0" ascii wide

      $fpa1 = "Sentinel Labs" wide
      $fpa2 = "<filter object at" ascii /* Norton Security */

      $fpb1 = { 64 65 78 0a 30 33 35 } /* dex.035 */

Detection condition:
$xo1 
      and not $xof1 
      and not 1 of ($fpa*)
      and not $fpb1 at 0

Full rule:
rule SUSP_XORed_Mozilla_Oct19 {
   meta:
      old_rule_name = "SUSP_XORed_Mozilla"
      description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
      author = "Florian Roth"
      reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
      date = "2019-10-28"
      modified = "2023-11-03"
      score = 60
      id = "71e5b399-c384-5330-ae52-4e0a806e7969"
   strings:
      $xo1 = "Mozilla/5.0" xor ascii wide
      $xof1 = "Mozilla/5.0" ascii wide

      $fpa1 = "Sentinel Labs" wide
      $fpa2 = "<filter object at" ascii /* Norton Security */

      $fpb1 = { 64 65 78 0a 30 33 35 } /* dex.035 */
   condition:
      $xo1 
      and not $xof1 
      and not 1 of ($fpa*)
      and not $fpb1 at 0
}
YARA Detection Rule: SUSP_XORed_MSDOS_Stub_Message
Repository: Neo23x0/signature-base
Detects: Detects suspicious XORed MSDOS stub message
Author: Florian Roth
Reference: https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Pattern signatures:
$xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
      $xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide

      $fp1 = "AVAST Software" fullword wide ascii
      $fp2 = "AVG Netherlands" fullword wide ascii
      $fp3 = "AVG Technologies" ascii wide
      $fp4 = "Malicious Software Removal Tool" wide
      $fp5 = "McAfee Labs" fullword ascii wide
      $fp6 = "Kaspersky Lab" fullword ascii wide
      $fp7 = "<propertiesmap>" ascii wide  /* KasperSky Lab XML profiles */
      $fp10 = "Avira Engine Module" wide /* Program Files (x86)/Avira/Antivirus/aeheur.dll */
      $fp11 = "syntevo GmbH" wide fullword /* Program Files (x86)/DeepGit/bin/deepgit64.exe */
      $fp13 = "SophosClean" ascii /* ProgramData/Sophos/Update Manager/Update Manager/Warehouse/4d7da8cfbfbb16664dac79e78273a1e8x000.dat */
      $fp14 = "SophosHomeClean" wide

Detection condition:
1 of ($x*)
      and not 1 of ($fp*)
      and not uint16(0) == 0xb0b0 // AV sigs file
      and not uint16(0) == 0x5953 // AV sigs file

Full rule:
rule SUSP_XORed_MSDOS_Stub_Message {
   meta:
      description = "Detects suspicious XORed MSDOS stub message"
      author = "Florian Roth"
      reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
      date = "2019-10-28"
      modified = "2023-10-11"
      score = 55
      id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"
   strings:
      $xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
      $xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide

      $fp1 = "AVAST Software" fullword wide ascii
      $fp2 = "AVG Netherlands" fullword wide ascii
      $fp3 = "AVG Technologies" ascii wide
      $fp4 = "Malicious Software Removal Tool" wide
      $fp5 = "McAfee Labs" fullword ascii wide
      $fp6 = "Kaspersky Lab" fullword ascii wide
      $fp7 = "<propertiesmap>" ascii wide  /* KasperSky Lab XML profiles */
      $fp10 = "Avira Engine Module" wide /* Program Files (x86)/Avira/Antivirus/aeheur.dll */
      $fp11 = "syntevo GmbH" wide fullword /* Program Files (x86)/DeepGit/bin/deepgit64.exe */
      $fp13 = "SophosClean" ascii /* ProgramData/Sophos/Update Manager/Update Manager/Warehouse/4d7da8cfbfbb16664dac79e78273a1e8x000.dat */
      $fp14 = "SophosHomeClean" wide
   condition:
      1 of ($x*)
      and not 1 of ($fp*)
      and not uint16(0) == 0xb0b0 // AV sigs file
      and not uint16(0) == 0x5953 // AV sigs file
}
YARA Detection Rule: MAL_Chrysalis_DllLoader_Feb26
Repository: Neo23x0/signature-base
Detects: Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
Author: X__Junior
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$op1 = { 33 D2 8B C1 F7 F6 0F B6 C1 03 55 ?? 6B C0 ?? 32 02 88 04 0F 41 83 F9 ?? 72 }
      $op2 = { 0F B6 04 31 41 33 C2 69 D0 ?? ?? ?? ?? 3B CB 72 }

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule MAL_Chrysalis_DllLoader_Feb26 {
   meta:
      description = "Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "3bdc4c[PII_REDACTED]f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
      score = 80
   strings:
      $op1 = { 33 D2 8B C1 F7 F6 0F B6 C1 03 55 ?? 6B C0 ?? 32 02 88 04 0F 41 83 F9 ?? 72 }
      $op2 = { 0F B6 04 31 41 33 C2 69 D0 ?? ?? ?? ?? 3B CB 72 }
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: MAL_Chrysalis_Shellcode_Loader_Feb26
Repository: Neo23x0/signature-base
Detects: Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
Author: X__Junior
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$op1 = { 8B C7 03 D7 83 E0 ?? 47 8A 4C 05 ?? 8A 04 13 02 C1 32 C1 2A C1 88 02 8B 55 ?? 3B FE 7C ?? 8B 5D ?? 8B 45 }
      $op2 = { 03 F8 8B 45 ?? 8B 50 ?? 85 C9 79 ?? 0F B7 C1 EB ?? 8D 41 ?? 03 C3 50 FF 75 ?? FF D2 89 07 85 C0 74 ?? 8B 4D ?? 46 }

Detection condition:
1 of them

Full rule:
rule MAL_Chrysalis_Shellcode_Loader_Feb26 {
   meta:
      description = "Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
      score = 80
   strings:
      $op1 = { 8B C7 03 D7 83 E0 ?? 47 8A 4C 05 ?? 8A 04 13 02 C1 32 C1 2A C1 88 02 8B 55 ?? 3B FE 7C ?? 8B 5D ?? 8B 45 }
      $op2 = { 03 F8 8B 45 ?? 8B 50 ?? 85 C9 79 ?? 0F B7 C1 EB ?? 8D 41 ?? 03 C3 50 FF 75 ?? FF D2 89 07 85 C0 74 ?? 8B 4D ?? 46 }
   condition:
      1 of them
}