deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_LNX_Academic_Camp_May20_Loader_1
Repository: Neo23x0/signature-base
Detects: Detects malware used in attack on academic data centers
Author: Florian Roth (Nextron Systems)
Reference: https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/

Pattern signatures:
$sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A 
               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
      $sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }

Detection condition:
uint16(0) == 0x457f and
      filesize < 10KB and all of them

Full rule:
rule APT_LNX_Academic_Camp_May20_Loader_1 {
   meta:
      description = "Detects malware used in attack on academic data centers"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
      date = "2020-05-16"
      hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
      id = "cda65abd-d918-5ee6-8f4a-554d47532d76"
   strings:
      $sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A 
               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
      $sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
   condition:
      uint16(0) == 0x457f and
      filesize < 10KB and all of them
}
YARA Detection Rule: Rombertik_CarbonGrabber
Repository: Neo23x0/signature-base
Detects: Detects CarbonGrabber alias Rombertik - file Copy#064046.scr
Author: Florian Roth (Nextron Systems)
Reference: http://blogs.cisco.com/security/talos/rombertik

Pattern signatures:
$x1 = "ZwGetWriteWatch" fullword ascii
		$x2 = "OutputDebugStringA" fullword ascii
		$x3 = "malwar" fullword ascii
		$x4 = "sampl" fullword ascii
		$x5 = "viru" fullword ascii
		$x6 = "sandb" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5MB and all of them

Full rule:
rule Rombertik_CarbonGrabber {
	meta:
		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
		hash3 = "c2005c8d1a79da5e02e6a15d[PII_REDACTED]8c264c" 
		hash4 = "98223d4ec272d3a631498b621618d875dd32161d" 	
		id = "b3aee336-9f3b-5fae-928d-8357408a7b69"
	strings:
		$x1 = "ZwGetWriteWatch" fullword ascii
		$x2 = "OutputDebugStringA" fullword ascii
		$x3 = "malwar" fullword ascii
		$x4 = "sampl" fullword ascii
		$x5 = "viru" fullword ascii
		$x6 = "sandb" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 5MB and all of them
}
YARA Detection Rule: Rombertik_CarbonGrabber_Panel_InstallScript
Repository: Neo23x0/signature-base
Detects: Detects CarbonGrabber alias Rombertik panel install script - file install.php
Author: Florian Roth (Nextron Systems)
Reference: http://blogs.cisco.com/security/talos/rombertik

Pattern signatures:
$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
		$s3 = "`post` text NOT NULL," fullword ascii
		$s4 = "`host` text NOT NULL," fullword ascii
		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
		$s9 = "$db->exec($insert);" fullword ascii
		$s10 = "`browser` text NOT NULL," fullword ascii
		$s13 = "`ip` text NOT NULL," fullword ascii

Detection condition:
filesize < 3KB and all of them

Full rule:
rule Rombertik_CarbonGrabber_Panel_InstallScript {
	meta:
		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
	strings:
		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
		$s3 = "`post` text NOT NULL," fullword ascii
		$s4 = "`host` text NOT NULL," fullword ascii
		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
		$s9 = "$db->exec($insert);" fullword ascii
		$s10 = "`browser` text NOT NULL," fullword ascii
		$s13 = "`ip` text NOT NULL," fullword ascii
	condition:
		filesize < 3KB and all of them
}
YARA Detection Rule: Rombertik_CarbonGrabber_Panel
Repository: Neo23x0/signature-base
Detects: Detects CarbonGrabber alias Rombertik Panel - file index.php
Author: Florian Roth (Nextron Systems)
Reference: http://blogs.cisco.com/security/talos/rombertik

Pattern signatures:
$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii

Detection condition:
filesize < 46KB and all of them

Full rule:
rule Rombertik_CarbonGrabber_Panel {
	meta:
		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
	strings:
		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
	condition:
		filesize < 46KB and all of them
}
YARA Detection Rule: Rombertik_CarbonGrabber_Builder
Repository: Neo23x0/signature-base
Detects: Detects CarbonGrabber alias Rombertik Builder - file Builder.exe
Author: Florian Roth (Nextron Systems)
Reference: http://blogs.cisco.com/security/talos/rombertik

Pattern signatures:
$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
		$s1 = "Host(www.panel.com): " fullword ascii
		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
		$s3 = "FileName: " fullword ascii
		$s4 = "~Rich8" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 35KB and all of them

Full rule:
rule Rombertik_CarbonGrabber_Builder {
	meta:
		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
		id = "3233c139-ac06-576c-9870-51306d5aa385"
	strings:
		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
		$s1 = "Host(www.panel.com): " fullword ascii
		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
		$s3 = "FileName: " fullword ascii
		$s4 = "~Rich8" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 35KB and all of them
}
YARA Detection Rule: Rombertik_CarbonGrabber_Builder_Server
Repository: Neo23x0/signature-base
Detects: Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe
Author: Florian Roth (Nextron Systems)
Reference: http://blogs.cisco.com/security/talos/rombertik

Pattern signatures:
$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
		$s4 = "chrome.exe" fullword ascii
		$s5 = "firefox.exe" fullword ascii
		$s6 = "chrome.dll" fullword ascii
		$s7 = "@KERNEL32.DLL" fullword wide
		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
		$s10 = "&post=" fullword ascii
		$s11 = "&host=" fullword ascii
		$s12 = "Ws2_32.dll" fullword ascii
		$s16 = "&browser=" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and 8 of them

Full rule:
rule Rombertik_CarbonGrabber_Builder_Server {
	meta:
		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
		id = "742003a2-3716-5ad9-a720-b9e2be71554a"
	strings:
		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
		$s4 = "chrome.exe" fullword ascii
		$s5 = "firefox.exe" fullword ascii
		$s6 = "chrome.dll" fullword ascii
		$s7 = "@KERNEL32.DLL" fullword wide
		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
		$s10 = "&post=" fullword ascii
		$s11 = "&host=" fullword ascii
		$s12 = "Ws2_32.dll" fullword ascii
		$s16 = "&browser=" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and 8 of them
}
YARA Detection Rule: APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
Repository: Neo23x0/signature-base
Detects: Detects artefacts found in Hermetic Wiper malware related intrusions
Author: Florian Roth (Nextron Systems)
Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia

Pattern signatures:
$sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
      $sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
      $sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
      $sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
      $sx5 = "\\policydefinitions\\postgresql.exe" ascii wide

      $sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
      $sx7 = "powershell -exec bypass gp.ps1" ascii wide
      $sx8 = "powershell -exec bypass -File link.ps1" ascii wide

      /* 16 is the prefix of an epoch timestamp that shouldn't change until the 14th of November 2023 */
      $sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
      
      $sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
      $sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
      $sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide

      $fp1 = "<html" ascii

Detection condition:
1 of ($sx*) or all of ($sa*)
      and not 1 of ($fp*)

Full rule:
rule APT_UA_Hermetic_Wiper_Artefacts_Feb22_1 {
   meta:
      description = "Detects artefacts found in Hermetic Wiper malware related intrusions"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
      date = "2022-02-25"
      score = 75
      id = "77f793c1-b02c-59c3-b3e4-75758f5b3b8d"
   strings:
      $sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
      $sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
      $sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
      $sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
      $sx5 = "\\policydefinitions\\postgresql.exe" ascii wide

      $sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
      $sx7 = "powershell -exec bypass gp.ps1" ascii wide
      $sx8 = "powershell -exec bypass -File link.ps1" ascii wide

      /* 16 is the prefix of an epoch timestamp that shouldn't change until the 14th of November 2023 */
      $sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
      
      $sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
      $sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
      $sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide

      $fp1 = "<html" ascii
   condition:
      1 of ($sx*) or all of ($sa*)
      and not 1 of ($fp*)
}
YARA Detection Rule: APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
Repository: Neo23x0/signature-base
Detects: Detects scheduled task pattern found in Hermetic Wiper malware related intrusions
Author: Florian Roth (Nextron Systems)
Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia

Pattern signatures:
$a0 = "<Task version=" ascii wide

      $sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
      $sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
      $sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide

Detection condition:
$a0 and 1 of ($s*)

Full rule:
rule APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1 {
   meta:
      description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
      date = "2022-02-25"
      score = 85
      id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"
   strings:
      $a0 = "<Task version=" ascii wide

      $sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
      $sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
      $sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide
   condition:
      $a0 and 1 of ($s*)
}
YARA Detection Rule: VULN_KeePass_DB_Brute_Forcible
Repository: Neo23x0/signature-base
Detects: Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://keepass.info/help/base/security.html#secdictprotect

Pattern signatures:
$keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
      // bytes 3-5 (after 06 08) are the number of iterations. if byte 3 is 00 the iterations are below 65536
      $below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }

Detection condition:
$keepass_magic at 0 and
      $below_65536_rounds at 108

Full rule:
rule VULN_KeePass_DB_Brute_Forcible {
   meta:
      description = "Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx"
      author = "Arnim Rupp (https://github.com/ruppde)"
      date = "2023-07-20"
      score = 60
      reference = "https://keepass.info/help/base/security.html#secdictprotect"
      id = "b1a86e03-b3d1-5abc-9287-a4846451caff"
   strings:
      $keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
      // bytes 3-5 (after 06 08) are the number of iterations. if byte 3 is 00 the iterations are below 65536
      $below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }
   condition:
      $keepass_magic at 0 and
      $below_65536_rounds at 108
}
YARA Detection Rule: MAL_Enfal_Nov22
Repository: Neo23x0/signature-base
Detects: Detects a certain type of Enfal Malware
Author: Florian Roth (Nextron Systems)
Reference: https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal

Pattern signatures:
$xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }

      $s1 = "POWERPNT.exe" fullword ascii
      $s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
      $s3 = "%HOMEPATH%" fullword ascii
      $s4 = "Server2008" fullword ascii
      $s5 = "%ComSpec%" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 200KB and
      ( 1 of ($x*) or 3 of ($s*) )

Full rule:
rule MAL_Enfal_Nov22 { 
   meta:
      old_rule_name = "Enfal_Malware"
      description = "Detects a certain type of Enfal Malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
      date = "2015-02-10"
      modified = "2023-01-06"
      hash2 = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
      hash2 = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
      score = 75
      id = "9dcba14e-2175-5da0-8629-5b952c213f6c"
   strings:
      $xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }

      $s1 = "POWERPNT.exe" fullword ascii
      $s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
      $s3 = "%HOMEPATH%" fullword ascii
      $s4 = "Server2008" fullword ascii
      $s5 = "%ComSpec%" fullword ascii
   condition:
      uint16(0) == 0x5a4d and
      filesize < 200KB and
      ( 1 of ($x*) or 3 of ($s*) )
}
YARA Detection Rule: Enfal_Malware_Backdoor
Repository: Neo23x0/signature-base
Detects: Generic Rule to detect the Enfal Malware
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$x1 = "Micorsoft Corportation" fullword wide
		$x2 = "IM Monnitor Service" fullword wide

		$s1 = "imemonsvc.dll" fullword wide
		$s2 = "iphlpsvc.tmp" fullword

		$z1 = "urlmon" fullword
		$z2 = "Registered trademarks and service marks are the property of their respec" wide
		$z3 = "XpsUnregisterServer" fullword
		$z4 = "XpsRegisterServer" fullword
		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword

Detection condition:
uint16(0) == 0x5a4d and
		(
			1 of ($x*) or
			( all of ($s*) and all of ($z*) )
		)

Full rule:
rule Enfal_Malware_Backdoor {
	meta:
		description = "Generic Rule to detect the Enfal Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/10"
		super_rule = 1
		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
		score = 60
		id = "4631888c-e1e2-5969-a312-0f0011cd605c"
	strings:
		$x1 = "Micorsoft Corportation" fullword wide
		$x2 = "IM Monnitor Service" fullword wide

		$s1 = "imemonsvc.dll" fullword wide
		$s2 = "iphlpsvc.tmp" fullword

		$z1 = "urlmon" fullword
		$z2 = "Registered trademarks and service marks are the property of their respec" wide
		$z3 = "XpsUnregisterServer" fullword
		$z4 = "XpsRegisterServer" fullword
		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
	condition:
		uint16(0) == 0x5a4d and
		(
			1 of ($x*) or
			( all of ($s*) and all of ($z*) )
		)
}
YARA Detection Rule: CheshireCat_Sample2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/

Pattern signatures:
$s0 = "mpgvwr32.dll" fullword ascii
		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
		$s2 = "\"%s\" /e%d /p%s" fullword ascii
		$s4 = "error in params!" fullword ascii
		$s5 = "sscanf" fullword ascii
		$s6 = "<>Param : 0x%x" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)

Full rule:
rule CheshireCat_Sample2 {
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		score = 70
		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
		id = "14448138-0af3-5669-8aa3-f9e773e2a008"
	strings:
		$s0 = "mpgvwr32.dll" fullword ascii
		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
		$s2 = "\"%s\" /e%d /p%s" fullword ascii
		$s4 = "error in params!" fullword ascii
		$s5 = "sscanf" fullword ascii
		$s6 = "<>Param : 0x%x" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
}
YARA Detection Rule: CheshireCat_Gen1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/

Pattern signatures:
$x1 = "CAPESPN.DLL" fullword wide
		$x2 = "WINF.DLL" fullword wide
		$x3 = "NCFG.DLL" fullword wide
		$x4 = "msgrthlp.dll" fullword wide
		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii

		$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii

		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide

		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)

Full rule:
rule CheshireCat_Gen1 {
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		super_rule = 1
		score = 90
		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
		id = "2068feed-2101-5b12-9e36-db7b0f5cc4ec"
	strings:
		$x1 = "CAPESPN.DLL" fullword wide
		$x2 = "WINF.DLL" fullword wide
		$x3 = "NCFG.DLL" fullword wide
		$x4 = "msgrthlp.dll" fullword wide
		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii

		$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii

		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide

		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
}