deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HYTop_DevPack_fso
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file fso.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<!-- PageFSO Below -->"
		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_fso {
	meta:
		description = "Webshells Auto-generated - file fso.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b37f3cde1a08890bd822a182c3a881f6"
	strings:
		$s0 = "<!-- PageFSO Below -->"
		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_ssh
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ssh.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "eval(gzinflate(str_rot13(base64_decode('"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_ssh {
	meta:
		description = "Webshells Auto-generated - file ssh.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1aa5307790d[PII_REDACTED]9989b4f900e"
	strings:
		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
	condition:
		all of them
}
YARA Detection Rule: Debug_BDoor
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file BDoor.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "\\BDoor\\"
		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

Detection condition:
all of them

Full rule:
rule Debug_BDoor {
	meta:
		description = "Webshells Auto-generated - file BDoor.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "e4e8e31dd44beb9320922c5f49739955"
	strings:
		$s1 = "\\BDoor\\"
		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
	condition:
		all of them
}
YARA Detection Rule: bin_Client
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Client.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Recieved respond from server!!"
		$s4 = "packet door client"
		$s5 = "input source port(whatever you want):"
		$s7 = "Packet sent,waiting for reply..."

Detection condition:
all of them

Full rule:
rule bin_Client {
	meta:
		description = "Webshells Auto-generated - file Client.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
	strings:
		$s0 = "Recieved respond from server!!"
		$s4 = "packet door client"
		$s5 = "input source port(whatever you want):"
		$s7 = "Packet sent,waiting for reply..."
	condition:
		all of them
}
YARA Detection Rule: ZXshell2_0_rar_Folder_ZXshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ZXshell.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "WPreviewPagesn"
		$s1 = "DA!OLUTELY N"

Detection condition:
all of them

Full rule:
rule ZXshell2_0_rar_Folder_ZXshell {
	meta:
		description = "Webshells Auto-generated - file ZXshell.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "246ce44502d2f6002d720d350e26c288"
	strings:
		$s0 = "WPreviewPagesn"
		$s1 = "DA!OLUTELY N"
	condition:
		all of them
}
YARA Detection Rule: RkNTLoad
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file RkNTLoad.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s2 = "5pur+virtu!"
		$s3 = "ugh spac#n"
		$s4 = "xcEx3WriL4"
		$s5 = "runtime error"
		$s6 = "loseHWait.Sr."
		$s7 = "essageBoxAw"
		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"

Detection condition:
all of them

Full rule:
rule RkNTLoad {
	meta:
		description = "Webshells Auto-generated - file RkNTLoad.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "262317c95ced56224f136ba532b8b34f"
	strings:
		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s2 = "5pur+virtu!"
		$s3 = "ugh spac#n"
		$s4 = "xcEx3WriL4"
		$s5 = "runtime error"
		$s6 = "loseHWait.Sr."
		$s7 = "essageBoxAw"
		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
	condition:
		all of them
}
YARA Detection Rule: binder2_binder2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file binder2.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "IsCharAlphaNumericA"
		$s2 = "WideCharToM"
		$s4 = "g 5pur+virtu!"
		$s5 = "\\syslog.en"
		$s6 = "heap7'7oqk?not="
		$s8 = "- Kablto in"

Detection condition:
all of them

Full rule:
rule binder2_binder2 {
	meta:
		description = "Webshells Auto-generated - file binder2.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d594e90ad23ae0bc0b65b59189c12f11"
	strings:
		$s0 = "IsCharAlphaNumericA"
		$s2 = "WideCharToM"
		$s4 = "g 5pur+virtu!"
		$s5 = "\\syslog.en"
		$s6 = "heap7'7oqk?not="
		$s8 = "- Kablto in"
	condition:
		all of them
}
YARA Detection Rule: thelast_orice2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file orice2.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = " $aa = $_GET['aa'];"
		$s1 = "echo $aa;"

Detection condition:
all of them

Full rule:
rule thelast_orice2 {
	meta:
		description = "Webshells Auto-generated - file orice2.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "aa63ffb27bde8d03d00dda04421237ae"
	strings:
		$s0 = " $aa = $_GET['aa'];"
		$s1 = "echo $aa;"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_sincap
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file sincap.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="

Detection condition:
all of them

Full rule:
rule FSO_s_sincap {
	meta:
		description = "Webshells Auto-generated - file sincap.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
	strings:
		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
	condition:
		all of them
}
YARA Detection Rule: PhpShell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file PhpShell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."

Detection condition:
all of them

Full rule:
rule PhpShell {
	meta:
		description = "Webshells Auto-generated - file PhpShell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "539baa0d39a9cf3c64d65ee7a8738620"
	strings:
		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_config
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file config.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "const adminPassword=\""
		$s2 = "const userPassword=\""
		$s3 = "const mVersion="

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_config {
	meta:
		description = "Webshells Auto-generated - file config.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b41d0e64e64a685178a[PII_REDACTED]d61"
	strings:
		$s0 = "const adminPassword=\""
		$s2 = "const userPassword=\""
		$s3 = "const mVersion="
	condition:
		all of them
}
YARA Detection Rule: sendmail
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file sendmail.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "_NextPyC808"
		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"

Detection condition:
all of them

Full rule:
rule sendmail {
	meta:
		description = "Webshells Auto-generated - file sendmail.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "75b86f4a21d8adefaf34b3a94629bd17"
	strings:
		$s3 = "_NextPyC808"
		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_zehir4
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file zehir4.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = " byMesaj "

Detection condition:
all of them

Full rule:
rule FSO_s_zehir4 {
	meta:
		description = "Webshells Auto-generated - file zehir4.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5b496a61363d304532bcf52ee21f5d55"
	strings:
		$s5 = " byMesaj "
	condition:
		all of them
}
YARA Detection Rule: hkshell_hkshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file hkshell.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "PrSessKERNELU"
		$s2 = "Cur3ntV7sion"
		$s3 = "Explorer8"

Detection condition:
all of them

Full rule:
rule hkshell_hkshell {
	meta:
		description = "Webshells Auto-generated - file hkshell.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "168cab58cee59dc4706b3be988312580"
	strings:
		$s1 = "PrSessKERNELU"
		$s2 = "Cur3ntV7sion"
		$s3 = "Explorer8"
	condition:
		all of them
}
YARA Detection Rule: iMHaPFtp
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file iMHaPFtp.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"

Detection condition:
all of them

Full rule:
rule iMHaPFtp {
	meta:
		description = "Webshells Auto-generated - file iMHaPFtp.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "12911b73bc6a5d313b494102abcf5c57"
	strings:
		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
	condition:
		all of them
}
YARA Detection Rule: Unpack_TBack
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file TBack.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "\\final\\new\\lcc\\public.dll"

Detection condition:
all of them

Full rule:
rule Unpack_TBack {
	meta:
		description = "Webshells Auto-generated - file TBack.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a9d1007823bf96fb163ab38726b48464"
	strings:
		$s5 = "\\final\\new\\lcc\\public.dll"
	condition:
		all of them
}
YARA Detection Rule: DarkSpy105
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file DarkSpy105.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"

Detection condition:
all of them

Full rule:
rule DarkSpy105 {
	meta:
		description = "Webshells Auto-generated - file DarkSpy105.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
	strings:
		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
	condition:
		all of them
}
YARA Detection Rule: EditServer_Webshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file EditServer.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "Server %s Have Been Configured"
		$s5 = "The Server Password Exceeds 32 Characters"
		$s8 = "9--Set Procecess Name To Inject DLL"

Detection condition:
all of them

Full rule:
rule EditServer_Webshell {
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "f945de25e0eba3bdaf1455b3a62b9832"
	strings:
		$s2 = "Server %s Have Been Configured"
		$s5 = "The Server Password Exceeds 32 Characters"
		$s8 = "9--Set Procecess Name To Inject DLL"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_reader
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file reader.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "mailto:mailbomb@hotmail."

Detection condition:
all of them

Full rule:
rule FSO_s_reader {
	meta:
		description = "Webshells Auto-generated - file reader.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
	strings:
		$s2 = "mailto:mailbomb@hotmail."
	condition:
		all of them
}
YARA Detection Rule: ASP_CmdAsp
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file CmdAsp.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "' -- Read the output from our command and remove the temp file -- '"
		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
		$s9 = "' -- create the COM objects that we will be using -- '"

Detection condition:
all of them

Full rule:
rule ASP_CmdAsp {
	meta:
		description = "Webshells Auto-generated - file CmdAsp.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
	strings:
		$s2 = "' -- Read the output from our command and remove the temp file -- '"
		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
		$s9 = "' -- create the COM objects that we will be using -- '"
	condition:
		all of them
}
YARA Detection Rule: KA_uShell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file KA_uShell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"

Detection condition:
all of them

Full rule:
rule KA_uShell {
	meta:
		description = "Webshells Auto-generated - file KA_uShell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "685f5d4f7f6751eaefc[PII_REDACTED]aab"
	strings:
		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
	condition:
		all of them
}
YARA Detection Rule: PHP_Backdoor_v1
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file PHP Backdoor v1.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"

Detection condition:
all of them

Full rule:
rule PHP_Backdoor_v1 {
	meta:
		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "0506ba90759d11d78befd21cabf41f3d"
	strings:

		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
	condition:
		all of them
}
YARA Detection Rule: svchostdll
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file svchostdll.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "InstallService"
		$s1 = "RundllInstallA"
		$s2 = "UninstallService"
		$s3 = "&G3 Users In RegistryD"
		$s4 = "OL_SHUTDOWN;I"
		$s5 = "SvcHostDLL.dll"
		$s6 = "RundllUninstallA"
		$s7 = "InternetOpenA"
		$s8 = "Check Cloneomplete"

Detection condition:
all of them

Full rule:
rule svchostdll {
	meta:
		description = "Webshells Auto-generated - file svchostdll.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "0f6756c8cb0b454c452055f189e4c3f4"
	strings:
		$s0 = "InstallService"
		$s1 = "RundllInstallA"
		$s2 = "UninstallService"
		$s3 = "&G3 Users In RegistryD"
		$s4 = "OL_SHUTDOWN;I"
		$s5 = "SvcHostDLL.dll"
		$s6 = "RundllUninstallA"
		$s7 = "InternetOpenA"
		$s8 = "Check Cloneomplete"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_server
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file server.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<!-- PageServer Below -->"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_server {
	meta:
		description = "Webshells Auto-generated - file server.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1d38526a215df13c7373da4635541b43"
	strings:
		$s0 = "<!-- PageServer Below -->"
	condition:
		all of them
}
YARA Detection Rule: vanquish
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file vanquish.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"

Detection condition:
all of them

Full rule:
rule vanquish {
	meta:
		description = "Webshells Auto-generated - file vanquish.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "684450adde37a93e8bb362994efc898c"
	strings:
		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
	condition:
		all of them
}
YARA Detection Rule: winshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file winshell.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
		$s1 = "WinShell Service"
		$s2 = "__GLOBAL_HEAP_SELECTED"
		$s3 = "__MSVCRT_HEAP_SELECT"
		$s4 = "Provide Windows CmdShell Service"
		$s5 = "URLDownloadToFileA"
		$s6 = "RegisterServiceProcess"
		$s7 = "GetModuleBaseNameA"
		$s8 = "WinShell v5.0 (C)2002 janker.org"

Detection condition:
all of them

Full rule:
rule winshell {
	meta:
		description = "Webshells Auto-generated - file winshell.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3144410a37dd4c29d004a814a294ea26"
	strings:
		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
		$s1 = "WinShell Service"
		$s2 = "__GLOBAL_HEAP_SELECTED"
		$s3 = "__MSVCRT_HEAP_SELECT"
		$s4 = "Provide Windows CmdShell Service"
		$s5 = "URLDownloadToFileA"
		$s6 = "RegisterServiceProcess"
		$s7 = "GetModuleBaseNameA"
		$s8 = "WinShell v5.0 (C)2002 janker.org"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_remview
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file remview.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"

Detection condition:
all of them

Full rule:
rule FSO_s_remview {
	meta:
		description = "Webshells Auto-generated - file remview.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b4a09911a5b23e00b55abe546ded691c"
	strings:
		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
	condition:
		all of them
}
YARA Detection Rule: saphpshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file saphpshell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"

Detection condition:
all of them

Full rule:
rule saphpshell {
	meta:
		description = "Webshells Auto-generated - file saphpshell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d7bba8def713512ddda14baf9cd6889a"
	strings:
		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006Z
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2006Z.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006Z {
	meta:
		description = "Webshells Auto-generated - file 2006Z.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "fd1b6129abd4ab177fed135e3b665488"
	strings:
		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
	condition:
		all of them
}
YARA Detection Rule: admin_ad
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file admin-ad.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"

Detection condition:
all of them

Full rule:
rule admin_ad {
	meta:
		description = "Webshells Auto-generated - file admin-ad.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
	strings:
		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_casus15
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file casus15.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"

Detection condition:
all of them

Full rule:
rule FSO_s_casus15 {
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "8d155b4239d922367af5d0a1b89533a3"
	strings:
		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
	condition:
		all of them
}
YARA Detection Rule: BIN_Client
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Client.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "=====Remote Shell Closed====="
		$s2 = "All Files(*.*)|*.*||"
		$s6 = "WSAStartup Error!"
		$s7 = "SHGetFileInfoA"
		$s8 = "CreateThread False!"
		$s9 = "Port Number Error"

Detection condition:
4 of them

Full rule:
rule BIN_Client {
	meta:
		description = "Webshells Auto-generated - file Client.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
	strings:
		$s0 = "=====Remote Shell Closed====="
		$s2 = "All Files(*.*)|*.*||"
		$s6 = "WSAStartup Error!"
		$s7 = "SHGetFileInfoA"
		$s8 = "CreateThread False!"
		$s9 = "Port Number Error"
	condition:
		4 of them
}
YARA Detection Rule: shelltools_g0t_root_uptime
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file uptime.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "JDiamondCSlC~"
		$s1 = "CharactQA"
		$s2 = "$Info: This file is packed with the UPX executable packer $"
		$s5 = "HandlereateConso"
		$s7 = "ION\\System\\FloatingPo"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_uptime {
	meta:
		description = "Webshells Auto-generated - file uptime.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
	strings:
		$s0 = "JDiamondCSlC~"
		$s1 = "CharactQA"
		$s2 = "$Info: This file is packed with the UPX executable packer $"
		$s5 = "HandlereateConso"
		$s7 = "ION\\System\\FloatingPo"
	condition:
		all of them
}