deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3
Repository: Neo23x0/signature-base
Detects: Detects VEILEDSIGNAL malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
      $si1 = "HttpSendRequestW" fullword
      $si2 = "CreateNamedPipeW" fullword
      $si3 = "CreateThread" fullword
      $se1 = "DllGetClassObject" fullword

Detection condition:
(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them

Full rule:
rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      score = 75
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      md5 = "c6441c961dcad0fe127514a918eaabd4"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "82790c65-1d93-509b-95df-841543943c30"
   strings:
      $ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
      $si1 = "HttpSendRequestW" fullword
      $si2 = "CreateNamedPipeW" fullword
      $si3 = "CreateThread" fullword
      $se1 = "DllGetClassObject" fullword
   condition:
      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
}
YARA Detection Rule: APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4
Repository: Neo23x0/signature-base
Detects: Detects VEILEDSIGNAL malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
      $sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
      $si1 = "CreateThread" fullword
      $si2 = "MultiByteToWideChar" fullword
      $si3 = "LocalAlloc" fullword
      $se1 = "DllGetClassObject" fullword

Detection condition:
(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them

Full rule:
rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      score = 75
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      hash1 = "404b09def6054a281b41d309d809a428" 
      hash2 = "c6441c961dcad0fe127514a918eaabd4"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"
   strings:
      $sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
      $sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
      $si1 = "CreateThread" fullword
      $si2 = "MultiByteToWideChar" fullword
      $si3 = "LocalAlloc" fullword
      $se1 = "DllGetClassObject" fullword
   condition:
      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
}
YARA Detection Rule: APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5
Repository: Neo23x0/signature-base
Detects: Detects VEILEDSIGNAL malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
      $ss1 = "chrome.exe" wide fullword
      $ss2 = "firefox.exe" wide fullword
      $ss3 = "msedge.exe" wide fullword
      $ss4 = "\\\\.\\pipe\\*" ascii fullword
      $ss5 = "FindFirstFileA" ascii fullword
      $ss6 = "Process32FirstW" ascii fullword
      $ss7 = "RtlAdjustPrivilege" ascii fullword
      $ss8 = "GetCurrentProcess" ascii fullword
      $ss9 = "NtWaitForSingleObject" ascii fullword

Detection condition:
(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them

Full rule:
rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      score = 75
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      hash1 = "[PII_REDACTED]ecf528240be21bb6e97f88"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "7d0718fc-4f1c-5293-8dc4-81a5783fbfb2"
   strings:
      $sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
      $ss1 = "chrome.exe" wide fullword
      $ss2 = "firefox.exe" wide fullword
      $ss3 = "msedge.exe" wide fullword
      $ss4 = "\\\\.\\pipe\\*" ascii fullword
      $ss5 = "FindFirstFileA" ascii fullword
      $ss6 = "Process32FirstW" ascii fullword
      $ss7 = "RtlAdjustPrivilege" ascii fullword
      $ss8 = "GetCurrentProcess" ascii fullword
      $ss9 = "NtWaitForSingleObject" ascii fullword
   condition:
      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
}
YARA Detection Rule: APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6
Repository: Neo23x0/signature-base
Detects: Detects VEILEDSIGNAL malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$ss1 = "C:\\Programdata\\" wide
      $ss2 = "devobj.dll" wide fullword
      $ss3 = "msvcr100.dll" wide fullword
      $ss4 = "TpmVscMgrSvr.exe" wide fullword
      $ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
      $ss6 = "CreateFileW" ascii fullword

Detection condition:
(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them

Full rule:
rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      score = 75
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"
   strings:
      $ss1 = "C:\\Programdata\\" wide
      $ss2 = "devobj.dll" wide fullword
      $ss3 = "msvcr100.dll" wide fullword
      $ss4 = "TpmVscMgrSvr.exe" wide fullword
      $ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
      $ss6 = "CreateFileW" ascii fullword
   condition:
      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
}
YARA Detection Rule: SUSP_NK_MAL_M_Hunting_POOLRAT
Repository: Neo23x0/signature-base
Detects: Detects strings found in POOLRAT malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
/*
      $hex1 = { 6e 61 6d 65 3d 22 75 69 64 22 25 73 25 73 25 75 25 73 }
      $hex_uni1 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 75 00 69 00 64 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s1 = "name=\"uid\"%s%s%u%s" ascii wide
      /*
      $hex2 = { 6e 61 6d 65 3d 22 73 65 73 73 69 6f 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni2 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s2 = "name=\"session\"%s%s%u%s" ascii wide
      /*
      $hex3 = { 6e 61 6d 65 3d 22 61 63 74 69 6f 6e 22 25 73 25 73 25 73 25 73 }
      $hex_uni3 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 61 00 63 00 74 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 }
      */
      $s3 = "name=\"action\"%s%s%s%s" ascii wide
      /*
      $hex4 = { 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni4 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 74 0

Detection condition:
any of ($s*) or $str1

Full rule:
rule SUSP_NK_MAL_M_Hunting_POOLRAT {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
      score = 70
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      description = "Detects strings found in POOLRAT malware"
      hash1 = "451c23709ecd5a8461ad060f6346930c"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"
   strings:
      /*
      $hex1 = { 6e 61 6d 65 3d 22 75 69 64 22 25 73 25 73 25 75 25 73 }
      $hex_uni1 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 75 00 69 00 64 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s1 = "name=\"uid\"%s%s%u%s" ascii wide
      /*
      $hex2 = { 6e 61 6d 65 3d 22 73 65 73 73 69 6f 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni2 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s2 = "name=\"session\"%s%s%u%s" ascii wide
      /*
      $hex3 = { 6e 61 6d 65 3d 22 61 63 74 69 6f 6e 22 25 73 25 73 25 73 25 73 }
      $hex_uni3 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 61 00 63 00 74 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 }
      */
      $s3 = "name=\"action\"%s%s%s%s" ascii wide
      /*
      $hex4 = { 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni4 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 74 00 6f 00 6b 00 65 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s4 = "name=\"token\"%s%s%u%s" ascii wide
      $str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
   condition:
      any of ($s*) or $str1
}
YARA Detection Rule: APT_NK_TradingTech_ForensicArtifacts_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736
Author: Florian Roth
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
      
      $xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
      $xf2 = "\\X_TRADER-ja.mst" ascii wide
      $xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
      $xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide

      $fp1 = "<html"

Detection condition:
not uint16(0) == 0x5025
      and 1 of ($x*) and not 1 of ($fp*)

Full rule:
rule APT_NK_TradingTech_ForensicArtifacts_Apr23_1 {
   meta:
      description = "Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      modified = "2023-04-21"
      score = 60
      id = "f79a5321-4f22-52d9-aa83-4aa750ecc036"
   strings:
      $x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
      
      $xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
      $xf2 = "\\X_TRADER-ja.mst" ascii wide
      $xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
      $xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide

      $fp1 = "<html"
   condition:
      not uint16(0) == 0x5025
      and 1 of ($x*) and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1
Repository: Neo23x0/signature-base
Detects: Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022
Author: Florian Roth
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$s1 = { 00 85 38 A6 C5 01 8F 50 FC } /* serial number */
      $s2 = "Go Daddy Secure Certificate Authority - G2" /* CA */
      $s3 = "Trading Technologies International, Inc"

Detection condition:
pe.timestamp >[PII_REDACTED] /* Sunday, May 1, 2022 12:00:00 AM */
      and all of them

Full rule:
rule SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1 {
   meta:
      description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      score = 65
      id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"
   strings:
      $s1 = { 00 85 38 A6 C5 01 8F 50 FC } /* serial number */
      $s2 = "Go Daddy Secure Certificate Authority - G2" /* CA */
      $s3 = "Trading Technologies International, Inc"
   condition:
      pe.timestamp >[PII_REDACTED] /* Sunday, May 1, 2022 12:00:00 AM */
      and all of them
}
YARA Detection Rule: APT_Lazarus_Dropper_Jun18_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group Dropper
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346

Pattern signatures:
$s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
      $s2 = "EYEJIW" fullword ascii
      $s3 = "update" fullword wide /* Goodware String - occured 254 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 21000KB and (
        pe.imphash() == "fcac768eff9896d667a7c706d70712ce" or
        all of them
      )

Full rule:
rule APT_Lazarus_Dropper_Jun18_1 {
   meta:
      description = "Detects Lazarus Group Dropper"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346"
      date = "2018-06-01"
      hash1 = "086a50476f5ceee4b10871c1a8b0a794e96a[PII_REDACTED]48a8289598b732bd47"
      hash2 = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
      id = "226be9d4-93c0-5512-9667-3388cd6f20d4"
   strings:
      $s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
      $s2 = "EYEJIW" fullword ascii
      $s3 = "update" fullword wide /* Goodware String - occured 254 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 21000KB and (
        pe.imphash() == "fcac768eff9896d667a7c706d70712ce" or
        all of them
      )
}
YARA Detection Rule: APT_Lazarus_RAT_Jun18_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group RAT
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346

Pattern signatures:
$a1 = "www.marmarademo.com/include/extend.php" fullword ascii
      $a2 = "www.33cow.com/include/control.php" fullword ascii
      $a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii

      $c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
      $c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
      $c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
      $c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
      $c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii

      $s1 = "Winhttp.dll" fullword ascii
      $s2 = "Wsock32.dll" fullword ascii
      $s3 = "WM*.tmp" fullword ascii
      $s4 = "FM*.tmp" fullword ascii
      $s5 = "Cache-Control: max-age=0" fullword ascii /* Goodware String - occured 1 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         1 of ($a*) or
         2 of ($c*) or
         4 of them
      )

Full rule:
rule APT_Lazarus_RAT_Jun18_1 {
   meta:
      description = "Detects Lazarus Group RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346"
      date = "2018-06-01"
      hash1 = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
      hash2 = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
      id = "fd394d15-70c5-543a-a845-2058f296b5f8"
   strings:
      $a1 = "www.marmarademo.com/include/extend.php" fullword ascii
      $a2 = "www.33cow.com/include/control.php" fullword ascii
      $a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii

      $c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
      $c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
      $c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
      $c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
      $c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii

      $s1 = "Winhttp.dll" fullword ascii
      $s2 = "Wsock32.dll" fullword ascii
      $s3 = "WM*.tmp" fullword ascii
      $s4 = "FM*.tmp" fullword ascii
      $s5 = "Cache-Control: max-age=0" fullword ascii /* Goodware String - occured 1 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         1 of ($a*) or
         2 of ($c*) or
         4 of them
      )
}
YARA Detection Rule: APT_Lazarus_RAT_Jun18_2
Repository: Neo23x0/signature-base
Detects: Detects Lazarus Group RAT
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346

Pattern signatures:
$s1 = "\\KB\\Release\\" ascii
      $s3 = "KB, Version 1.0" fullword wide
      $s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them

Full rule:
rule APT_Lazarus_RAT_Jun18_2 {
   meta:
      description = "Detects Lazarus Group RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/DrunkBinary/status/[PII_REDACTED]73721346"
      date = "2018-06-01"
      hash1 = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
      id = "4f2e280e-ed76-5fb9-b137-5191bbea2155"
   strings:
      $s1 = "\\KB\\Release\\" ascii
      $s3 = "KB, Version 1.0" fullword wide
      $s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
}
YARA Detection Rule: ATM_Malware_Loup
Repository: Neo23x0/signature-base
Detects: Detects ATM Malware Loup
Author: Frank Boldewin (@r3c0nst)
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]80327936

Pattern signatures:
$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii /* nocase */
		$String2 = "CurrencyDispenser1" ascii /* nocase */
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8} // Dispense

Detection condition:
uint16(0) == 0x5A4D and filesize < 100KB and all of ($String*) and $Code

Full rule:
rule ATM_Malware_Loup {
	meta:
		description = "Detects ATM Malware Loup"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/[PII_REDACTED]80327936"
		date = "2020-08-17"
		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
		
		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"
	strings:
		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii /* nocase */
		$String2 = "CurrencyDispenser1" ascii /* nocase */
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8} // Dispense
		
	condition:
		uint16(0) == 0x5A4D and filesize < 100KB and all of ($String*) and $Code
}
YARA Detection Rule: ProjectM_DarkComet_1
Repository: Neo23x0/signature-base
Detects: Detects ProjectM Malware
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/

Pattern signatures:
$x1 = "DarkO\\_2" fullword ascii

		$a1 = "AVICAP32.DLL" fullword ascii
		$a2 = "IDispatch4" fullword ascii
		$a3 = "FLOOD/" fullword ascii
		$a4 = "T<-/HTTP://" ascii
		$a5 = "infoes" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )

Full rule:
rule ProjectM_DarkComet_1 {
	meta:
		description = "Detects ProjectM Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
		date = "2016-03-26"
		modified = "2023-01-27"
		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
		id = "6de74d73-f9b2-5e7f-b15e-f850425d849c"
	strings:
		$x1 = "DarkO\\_2" fullword ascii

		$a1 = "AVICAP32.DLL" fullword ascii
		$a2 = "IDispatch4" fullword ascii
		$a3 = "FLOOD/" fullword ascii
		$a4 = "T<-/HTTP://" ascii
		$a5 = "infoes" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
}
YARA Detection Rule: ProjectM_CrimsonDownloader
Repository: Neo23x0/signature-base
Detects: Detects ProjectM Malware
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/

Pattern signatures:
$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"

		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
		$s2 = "secure_scan.exe" fullword wide
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
		$s4 = "secure_scan|mswall" fullword wide
		$s5 = "[Microsoft-Security-Essentials]" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )

Full rule:
rule ProjectM_CrimsonDownloader {
	meta:
		description = "Detects ProjectM Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
		date = "2016-03-26"
		hash = "dc8bd[PII_REDACTED]2c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
		id = "2e0658c9-a93d-5eef-93a2-eb1ab29acaee"
	strings:
		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"

		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
		$s2 = "secure_scan.exe" fullword wide
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
		$s4 = "secure_scan|mswall" fullword wide
		$s5 = "[Microsoft-Security-Essentials]" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
}