deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PoseidonGroup_MalDoc_1
Repository: Yara-Rules/rules
Detects: Detects Poseidon Group - Malicious Word Document
Author: Florian Roth
Reference: https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/

Pattern signatures:
$s1 = "c:\\cmd32dll.exe" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 500KB and all of them

Full rule:
rule PoseidonGroup_MalDoc_1 
{

    meta:
        description = "Detects Poseidon Group - Malicious Word Document"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
        date = "2016-02-09"
        score = 80
        hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"

    strings:
        $s1 = "c:\\cmd32dll.exe" fullword ascii

    condition:
        uint16(0) == 0xcfd0 and filesize < 500KB and all of them
}
YARA Detection Rule: PoseidonGroup_MalDoc_2
Repository: Yara-Rules/rules
Detects: Detects Poseidon Group - Malicious Word Document
Author: Florian Roth
Reference: https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/

Pattern signatures:
$s0 = "{\\*\\generator Msftedit 5.41." ascii
        $s1 = "Attachment 1: Complete Professional Background" ascii
        $s2 = "E-mail:  \\cf1\\ul\\f1"
        $s3 = "Education:\\par" ascii
        $s5 = "@gmail.com" ascii

Detection condition:
uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them

Full rule:
rule PoseidonGroup_MalDoc_2 
{

    meta:
        description = "Detects Poseidon Group - Malicious Word Document"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
        date = "2016-02-09"
        score = 70
        hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
        hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
        hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
        hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
        hash5 = "[PII_REDACTED]2fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
        hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"

    strings:
        $s0 = "{\\*\\generator Msftedit 5.41." ascii
        $s1 = "Attachment 1: Complete Professional Background" ascii
        $s2 = "E-mail:  \\cf1\\ul\\f1"
        $s3 = "Education:\\par" ascii
        $s5 = "@gmail.com" ascii

    condition:
        uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
}
YARA Detection Rule: Turla_APT_srsvc
Repository: Yara-Rules/rules
Detects: Detects Turla malware (based on sample used in the RUAG APT case)
Malware family: Turla
Author: Florian Roth
Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case

Pattern signatures:
$x1 = "SVCHostServiceDll.dll" fullword ascii
        $s2 = "msimghlp.dll" fullword wide
        $s3 = "srservice" fullword wide
        $s4 = "ModStart" fullword ascii
        $s5 = "ModStop" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or all of ($s*) ) ) or ( all of them )

Full rule:
rule Turla_APT_srsvc 
{

    meta:
        description = "Detects Turla malware (based on sample used in the RUAG APT case)"
        author = "Florian Roth"
        family = "Turla"
        reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
        date = "2016-06-09"
        hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
        hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
  
    strings:
        $x1 = "SVCHostServiceDll.dll" fullword ascii
        $s2 = "msimghlp.dll" fullword wide
        $s3 = "srservice" fullword wide
        $s4 = "ModStart" fullword ascii
        $s5 = "ModStop" fullword ascii
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or all of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: Turla_APT_Malware_Gen1
Repository: Yara-Rules/rules
Detects: Detects Turla malware (based on sample used in the RUAG APT case)
Malware family: Turla
Author: Florian Roth
Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case

Pattern signatures:
$x1 = "too long data for this type of transport" fullword ascii
        $x2 = "not enough server resources to complete operation" fullword ascii
        $x3 = "Task not execute. Arg file failed." fullword ascii
        $x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
        $s1 = "peer has closed the connection" fullword ascii
        $s2 = "tcpdump.exe" fullword ascii
        $s3 = "windump.exe" fullword ascii
        $s4 = "dsniff.exe" fullword ascii
        $s5 = "wireshark.exe" fullword ascii
        $s6 = "ethereal.exe" fullword ascii
        $s7 = "snoop.exe" fullword ascii
        $s8 = "ettercap.exe" fullword ascii
        $s9 = "miniport.dat" fullword ascii
        $s10 = "net_password=%s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or 8 of ($s*) ) ) or ( 12 of them )

Full rule:
rule Turla_APT_Malware_Gen1 
{

    meta:
        description = "Detects Turla malware (based on sample used in the RUAG APT case)"
        author = "Florian Roth"
        family = "Turla"
        reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
        date = "2016-06-09"
        hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
        hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b[PII_REDACTED]a214c0155a1f08b9"
        hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
        hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
        hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
        hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
        hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
        hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
        hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
        hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
    
    strings:
        $x1 = "too long data for this type of transport" fullword ascii
        $x2 = "not enough server resources to complete operation" fullword ascii
        $x3 = "Task not execute. Arg file failed." fullword ascii
        $x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
        $s1 = "peer has closed the connection" fullword ascii
        $s2 = "tcpdump.exe" fullword ascii
        $s3 = "windump.exe" fullword ascii
        $s4 = "dsniff.exe" fullword ascii
        $s5 = "wireshark.exe" fullword ascii
        $s6 = "ethereal.exe" fullword ascii
        $s7 = "snoop.exe" fullword ascii
        $s8 = "ettercap.exe" fullword ascii
        $s9 = "miniport.dat" fullword ascii
        $s10 = "net_password=%s" fullword ascii
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or
YARA Detection Rule: Turla_APT_Malware_Gen2
Repository: Yara-Rules/rules
Detects: Detects Turla malware (based on sample used in the RUAG APT case)
Malware family: Turla
Author: Florian Roth
Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case

Pattern signatures:
$x1 = "Internal command not support =((" fullword ascii
        $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
        $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
        $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
        $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
        $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
        $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
        $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
        $x9 = "Plugin dll stop failed." fullword ascii
        $x10 = "AS_USER:LogonUser():%d" fullword ascii
        $s1 = "MSIMGHLP.DLL" fullword wide
        $s2 = "msimghlp.dll" fullword ascii
        $s3 = "ximarsh.dll" fullword ascii
        $s4 = "msximl.dll" fullword ascii
        $s5 = "INTERNAL.dll" fullword ascii
        $s6 = "\\\\.\\Global\\PIPE\\" fullword ascii
        $s7 = "ieuser.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 10 of them )

Full rule:
rule Turla_APT_Malware_Gen2 
{

    meta:
        description = "Detects Turla malware (based on sample used in the RUAG APT case)"
        author = "Florian Roth"
        family = "Turla"
        reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
        date = "2016-06-09"
        hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
        hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b[PII_REDACTED]a214c0155a1f08b9"
        hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
        hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
  
    strings:
        $x1 = "Internal command not support =((" fullword ascii
        $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
        $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
        $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
        $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
        $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
        $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
        $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
        $x9 = "Plugin dll stop failed." fullword ascii
        $x10 = "AS_USER:LogonUser():%d" fullword ascii
        $s1 = "MSIMGHLP.DLL" fullword wide
        $s2 = "msimghlp.dll" fullword ascii
        $s3 = "ximarsh.dll" fullword ascii
        $s4 = "msximl.dll" fullword ascii
        $s5 = "INTERNAL.dll" fullword ascii
        $s6 = "\\\\.\\Global\\PIPE\\" fullword ascii
        $s7 = "ieuser.exe" fullword ascii
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 10 of them )
}
YARA Detection Rule: RUAG_Tavdig_Malformed_Executable
Repository: Yara-Rules/rules
Detects: Detects an embedded executable with a malformed header - known from Tavdig malware
Author: Florian Roth
Reference: https://goo.gl/N5MEj0

Detection condition:
/* MZ Header and malformed PE header > 0x0bad */
    uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x0000AD0B

Full rule:
rule RUAG_Tavdig_Malformed_Executable 
{

  meta:
    description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
    author = "Florian Roth"
    reference = "https://goo.gl/N5MEj0"
    score = 60
  
  condition:
  /* MZ Header and malformed PE header > 0x0bad */
    uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x0000AD0B 
}
YARA Detection Rule: RUAG_Bot_Config_File
Repository: Yara-Rules/rules
Detects: Detects a specific config file used by malware in RUAG APT case
Author: Florian Roth
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$s1 = "[CONFIG]" ascii
    $s2 = "name = " ascii
    $s3 = "exe = cmd.exe" ascii

Detection condition:
$s1 at 0 and $s2 and $s3 and filesize < 160

Full rule:
rule RUAG_Bot_Config_File 
{

  meta:
    description = "Detects a specific config file used by malware in RUAG APT case"
    author = "Florian Roth"
    reference = "https://goo.gl/N5MEj0"
    score = 60
  
  strings:
    $s1 = "[CONFIG]" ascii
    $s2 = "name = " ascii
    $s3 = "exe = cmd.exe" ascii
  
  condition:
    $s1 at 0 and $s2 and $s3 and filesize < 160 
}
YARA Detection Rule: RUAG_Cobra_Malware
Repository: Yara-Rules/rules
Detects: Detects a malware mentioned in the RUAG Case called Carbon/Cobra
Author: Florian Roth
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii

Detection condition:
uint16(0) == 0x5a4d and $s1

Full rule:
rule RUAG_Cobra_Malware 
{

  meta:
    description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
    author = "Florian Roth"
    reference = "https://goo.gl/N5MEj0"
    score = 60
 
  strings:
    $s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
  
  condition:
    uint16(0) == 0x5a4d and $s1
}
YARA Detection Rule: RUAG_Cobra_Config_File
Repository: Yara-Rules/rules
Detects: Detects a config text file used by malware Cobra in RUAG case
Author: Florian Roth
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$h1 = "[NAME]" ascii
    $s1 = "object_id=" ascii
    $s2 = "[TIME]" ascii fullword
    $s3 = "lastconnect" ascii 
    $s4 = "[CW_LOCAL]" ascii fullword
    $s5 = "system_pipe" ascii
    $s6 = "user_pipe" ascii
    $s7 = "[TRANSPORT]" ascii
    $s8 = "run_task_system" ascii
    $s9 = "[WORKDATA]" ascii 
    $s10 = "address1" ascii

Detection condition:
$h1 at 0 and 8 of ($s*) and filesize < 5KB

Full rule:
rule RUAG_Cobra_Config_File 
{

  meta:
    description = "Detects a config text file used by malware Cobra in RUAG case"
    author = "Florian Roth"
    reference = "https://goo.gl/N5MEj0"
    score = 60

  strings:
    $h1 = "[NAME]" ascii
    $s1 = "object_id=" ascii
    $s2 = "[TIME]" ascii fullword
    $s3 = "lastconnect" ascii 
    $s4 = "[CW_LOCAL]" ascii fullword
    $s5 = "system_pipe" ascii
    $s6 = "user_pipe" ascii
    $s7 = "[TRANSPORT]" ascii
    $s8 = "run_task_system" ascii
    $s9 = "[WORKDATA]" ascii 
    $s10 = "address1" ascii
  
  condition:
    $h1 at 0 and 8 of ($s*) and filesize < 5KB
}
YARA Detection Rule: RUAG_Exfil_Config_File
Repository: Yara-Rules/rules
Detects: Detects a config text file used in data exfiltration in RUAG case
Author: Florian Roth
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$h1 = "[TRANSPORT]" ascii
    $s1 = "system_pipe" ascii
    $s2 = "spstatus" ascii
    $s3 = "adaptable" ascii 
    $s4 = "post_frag" ascii
    $s5 = "pfsgrowperiod" ascii

Detection condition:
$h1 at 0 and all of ($s*) and filesize < 1KB

Full rule:
rule RUAG_Exfil_Config_File 
{

  meta:
    description = "Detects a config text file used in data exfiltration in RUAG case"
    author = "Florian Roth"
    reference = "https://goo.gl/N5MEj0"
    score = 60

  strings:
    $h1 = "[TRANSPORT]" ascii
    $s1 = "system_pipe" ascii
    $s2 = "spstatus" ascii
    $s3 = "adaptable" ascii 
    $s4 = "post_frag" ascii
    $s5 = "pfsgrowperiod" ascii
  
  condition:
    $h1 at 0 and all of ($s*) and filesize < 1KB
}
YARA Detection Rule: WaterBug_turla_dll
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - Trojan Turla DLL
Author: Symantec Security Response
Reference: http://www.symantec.com/connect/blogs/turla-spying-tool-targets-governments-and-diplomats

Pattern signatures:
$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/

Detection condition:
pe.exports("ee") and $a

Full rule:
rule WaterBug_turla_dll 
{
  
    meta:
        description = "Symantec Waterbug Attack - Trojan Turla DLL"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://www.symantec.com/connect/blogs/turla-spying-tool-targets-governments-and-diplomats"   

    strings:
        $a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
   
    condition:
        pe.exports("ee") and $a
}
YARA Detection Rule: turla_dropper
Repository: Yara-Rules/rules
Detects: This sample was pulled from the bae systems snake campaign report. The Turla dropper creates a file in teh temp dir and registers an auto start service call \
Reference: http://info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
        $eventid="4688"
        $data="AppData\\Local\\Temp\\rsys.exe"

        $type1="Service Control Manager"
        $eventid1="7036"
        $data1="RPC Endpoint Locator"
        $data2="running"

        $type2="Service Control Manager"
        $eventid2="7045"
        $data3="RPC Endpoint Locator"
        $data4="user mode service" 
        $data5="auto start"

Detection condition:
($type and $eventid and $data) or ($type1 and $eventid1 and $data1 and $data2 and $type2 and $eventid2 and $data3 and $data4 and $data5)

Full rule:
rule turla_dropper
{ 
   
    meta:
        maltype = "turla dropper"
        ref = "https://github.com/reed1713"
        reference = "http://info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf"
        date = "3/13/2014"
        description = "This sample was pulled from the bae systems snake campaign report. The Turla dropper creates a file in teh temp dir and registers an auto start service call \"RPC Endpoint Locator\"."
    strings:

        $type="Microsoft-Windows-Security-Auditing"
        $eventid="4688"
        $data="AppData\\Local\\Temp\\rsys.exe"

        $type1="Service Control Manager"
        $eventid1="7036"
        $data1="RPC Endpoint Locator"
        $data2="running"

        $type2="Service Control Manager"
        $eventid2="7045"
        $data3="RPC Endpoint Locator"
        $data4="user mode service" 
        $data5="auto start"

    condition:
    ($type and $eventid and $data) or ($type1 and $eventid1 and $data1 and $data2 and $type2 and $eventid2 and $data3 and $data4 and $data5)
}
YARA Detection Rule: Korplug_FAST
Repository: Yara-Rules/rules
Detects: Rule to detect Korplug/PlugX FAST variant
Author: Florian Roth

Pattern signatures:
$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii

        $a1 = "ShadowPlay" fullword ascii

        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
        $s2 = "nvdisps.dll" fullword ascii
        $s3 = "%snvdisps.dll" fullword ascii
        $s4 = "\\winhlp32.exe" fullword ascii
        $s5 = "nvdisps_user.dat" fullword ascii
        $s6 = "%snvdisps_user.dat" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 
        (
            $x1 or
            ($a1 and 1 of ($s*)) or 
            4 of ($s*)
        )

Full rule:
rule Korplug_FAST {
    meta:
        description = "Rule to detect Korplug/PlugX FAST variant"
        author = "Florian Roth"
        date = "2015-08-20"
        hash = "c437465db[PII_REDACTED]3fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
    strings:
        $x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii

        $a1 = "ShadowPlay" fullword ascii

        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
        $s2 = "nvdisps.dll" fullword ascii
        $s3 = "%snvdisps.dll" fullword ascii
        $s4 = "\\winhlp32.exe" fullword ascii
        $s5 = "nvdisps_user.dat" fullword ascii
        $s6 = "%snvdisps_user.dat" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and 
        (
            $x1 or
            ($a1 and 1 of ($s*)) or 
            4 of ($s*)
        )
}
YARA Detection Rule: Korplug
Repository: Yara-Rules/rules
Detects: IOC looks for events associated with the KORPLUG Backdoor linked to the recent operation greedy wonk activity.
Author: https://github.com/reed1713
Reference: http://www.symantec.com/connect/blogs/new-sample-backdoorkorplug-signed-stolen-certificate

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="ProgramData\\RasTls\\RasTls.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="ProgramData\\RasTls\\rundll32.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="ProgramData\\RasTls\\svchost.exe"

Detection condition:
all of them

Full rule:
rule Korplug
{ 
	meta:
		maltype = "Korplug Backdoor"
        author = "https://github.com/reed1713"
		reference = "http://www.symantec.com/connect/blogs/new-sample-backdoorkorplug-signed-stolen-certificate"
		description = "IOC looks for events associated with the KORPLUG Backdoor linked to the recent operation greedy wonk activity."
		
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="ProgramData\\RasTls\\RasTls.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="ProgramData\\RasTls\\rundll32.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="ProgramData\\RasTls\\svchost.exe"
	condition:
		all of them
}
YARA Detection Rule: xDedic_SysScan_unpacked
Repository: Yara-Rules/rules
Author:  Kaspersky Lab

Pattern signatures:
$a1="/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
$a2="SysScan DEBUG Mode!!!" ascii wide
$a3="This rechecking? (set 0/1 or press enter key)" ascii wide
$a4="http://37.49.224.144:8189/manual_result" ascii wide
$b1="Checker end work!" ascii wide
$b2="Trying send result..." ascii wide

Detection condition:
((uint16(0) == 0x5A4D)) and (filesize < 5000000) and
((any of ($a*)) or (all of ($b*)))

Full rule:
rule xDedic_SysScan_unpacked : crimeware {
meta:
author = " Kaspersky Lab"
ref = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
maltype = "crimeware"
type ="crimeware"
filetype = "Win32 EXE"
date = "2016-03-14"
version = "1.0"
hash = "fac495be1c71012682ebb27092060b43"
hash = "e8cc69231e209db7968397e8a244d104"
hash = "a53847a51561a7e76fd034043b9aa36d"
hash = "e8691fa5872c528cd8e72b82e7880e98"
hash = "F661b50d45400e7052a2427919e2f777"
strings:
$a1="/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
$a2="SysScan DEBUG Mode!!!" ascii wide
$a3="This rechecking? (set 0/1 or press enter key)" ascii wide
$a4="http://37.49.224.144:8189/manual_result" ascii wide
$b1="Checker end work!" ascii wide
$b2="Trying send result..." ascii wide
condition:
((uint16(0) == 0x5A4D)) and (filesize < 5000000) and
((any of ($a*)) or (all of ($b*)))
}
YARA Detection Rule: xdedic_packed_syscan
Repository: Yara-Rules/rules
Author: Kaspersky Lab

Pattern signatures:
$a1 = "SysScan.exe" nocase ascii wide

Detection condition:
uint16(0) == 0x5A4D
and any of ($a*) and filesize > 1000000 and filesize <1200000 and
pe.number_of_sections == 13 and pe.version_info["FileVersion"] contains "1.3.4."

Full rule:
rule xdedic_packed_syscan : crimeware {
meta:
author = "Kaspersky Lab"
company = "Kaspersky Lab"
ref = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
strings:
$a1 = "SysScan.exe" nocase ascii wide
condition:
uint16(0) == 0x5A4D
and any of ($a*) and filesize > 1000000 and filesize <1200000 and
pe.number_of_sections == 13 and pe.version_info["FileVersion"] contains "1.3.4."
}
YARA Detection Rule: lateral_movement
Repository: Yara-Rules/rules
Detects: methodology sig looking for signs of lateral movement
Author: https://github.com/reed1713

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="PsExec.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="Windows\\System32\\net.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="Windows\\System32\\at.exe"

Detection condition:
($type and $eventid and $data) or ($type1 and $eventid1 and $data1) or ($type2 and $eventid2 and $data2)

Full rule:
rule lateral_movement
{ 
	meta:
		date = "3/12/2014"
		author = "https://github.com/reed1713"
    description = "methodology sig looking for signs of lateral movement"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="PsExec.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="Windows\\System32\\net.exe"

		$type2="Microsoft-Windows-Security-Auditing"
		$eventid2="4688"
		$data2="Windows\\System32\\at.exe"
	condition:
		($type and $eventid and $data) or ($type1 and $eventid1 and $data1) or ($type2 and $eventid2 and $data2)
}