deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: nstview_nstview
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file nstview.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"

Detection condition:
all of them

Full rule:
rule nstview_nstview {
	meta:
		description = "Webshells Auto-generated - file nstview.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3871888a0c1ac[PII_REDACTED]231029a56"
	strings:
		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_upload
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file upload.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<!-- PageUpload Below -->"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_upload {
	meta:
		description = "Webshells Auto-generated - file upload.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b09852bda534627949f0259828c967de"
	strings:
		$s0 = "<!-- PageUpload Below -->"
	condition:
		all of them
}
YARA Detection Rule: PasswordReminder
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file PasswordReminder.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."

Detection condition:
all of them

Full rule:
rule PasswordReminder {
	meta:
		description = "Webshells Auto-generated - file PasswordReminder.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
	strings:
		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
	condition:
		all of them
}
YARA Detection Rule: Pack_InjectT
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file InjectT.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "ail To Open Registry"
		$s4 = "32fDssignim"
		$s5 = "vide Internet S"
		$s6 = "d]Software\\M"
		$s7 = "TInject.Dll"

Detection condition:
all of them

Full rule:
rule Pack_InjectT {
	meta:
		description = "Webshells Auto-generated - file InjectT.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "983b74ccd57f6195a0584cdfb27d55e8"
	strings:
		$s3 = "ail To Open Registry"
		$s4 = "32fDssignim"
		$s5 = "vide Internet S"
		$s6 = "d]Software\\M"
		$s7 = "TInject.Dll"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_RemExp_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file RemExp.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = " Then Response.Write \""
		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"

Detection condition:
all of them

Full rule:
rule FSO_s_RemExp_2 {
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b69670ecdbb40012c73686cd22696eeb"
	strings:
		$s2 = " Then Response.Write \""
		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_c99
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file c99.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"

Detection condition:
all of them

Full rule:
rule FSO_s_c99 {
	meta:
		description = "Webshells Auto-generated - file c99.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5f9ba02eb081bba2b2434c603af454d0"
	strings:
		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
	condition:
		all of them
}
YARA Detection Rule: rknt_zip_Folder_RkNT
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file RkNT.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "PathStripPathA"
		$s1 = "`cLGet!Addr%"
		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s3 = "oQToOemBuff* <="
		$s4 = "ionCdunAsw[Us'"
		$s6 = "CreateProcessW: %S"
		$s7 = "ImageDirectoryEntryToData"

Detection condition:
all of them

Full rule:
rule rknt_zip_Folder_RkNT {
	meta:
		description = "Webshells Auto-generated - file RkNT.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "5f97386dfde148942b7584aeb6512b85"
	strings:
		$s0 = "PathStripPathA"
		$s1 = "`cLGet!Addr%"
		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s3 = "oQToOemBuff* <="
		$s4 = "ionCdunAsw[Us'"
		$s6 = "CreateProcessW: %S"
		$s7 = "ImageDirectoryEntryToData"
	condition:
		all of them
}
YARA Detection Rule: dbgntboot
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dbgntboot.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
		$s3 = "sth junk the M$ Wind0wZ retur"

Detection condition:
all of them

Full rule:
rule dbgntboot {
	meta:
		description = "Webshells Auto-generated - file dbgntboot.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "4d87543d4d7f73c1529c9f8066b475ab"
	strings:
		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
		$s3 = "sth junk the M$ Wind0wZ retur"
	condition:
		all of them
}
YARA Detection Rule: PHP_shell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file shell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"

Detection condition:
all of them

Full rule:
rule PHP_shell {
	meta:
		description = "Webshells Auto-generated - file shell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
	strings:
		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
	condition:
		all of them
}
YARA Detection Rule: hxdef100
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file hxdef100.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "RtlAnsiStringToUnicodeString"
		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"

Detection condition:
all of them

Full rule:
rule hxdef100 {
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "55cc1769cef44910bd91b7b73dee1f6c"
	strings:
		$s0 = "RtlAnsiStringToUnicodeString"
		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
	condition:
		all of them
}
YARA Detection Rule: rdrbs100
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file rdrbs100.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "Server address must be IP in A.B.C.D format."
		$s4 = " mapped ports in the list. Currently "

Detection condition:
all of them

Full rule:
rule rdrbs100 {
	meta:
		description = "Webshells Auto-generated - file rdrbs100.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "7c752bcd6da796d80a6830c61a632bff"
	strings:
		$s3 = "Server address must be IP in A.B.C.D format."
		$s4 = " mapped ports in the list. Currently "
	condition:
		all of them
}
YARA Detection Rule: Mithril_Mithril
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Mithril.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "OpenProcess error!"
		$s1 = "WriteProcessMemory error!"
		$s4 = "GetProcAddress error!"
		$s5 = "HHt`HHt\\"
		$s6 = "Cmaudi0"
		$s7 = "CreateRemoteThread error!"
		$s8 = "Kernel32"
		$s9 = "VirtualAllocEx error!"

Detection condition:
all of them

Full rule:
rule Mithril_Mithril {
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "017191562d72ab0ca551eb89256650bd"
	strings:
		$s0 = "OpenProcess error!"
		$s1 = "WriteProcessMemory error!"
		$s4 = "GetProcAddress error!"
		$s5 = "HHt`HHt\\"
		$s6 = "Cmaudi0"
		$s7 = "CreateRemoteThread error!"
		$s8 = "Kernel32"
		$s9 = "VirtualAllocEx error!"
	condition:
		all of them
}
YARA Detection Rule: hxdef100_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file hxdef100.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"

Detection condition:
all of them

Full rule:
rule hxdef100_2 {
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
	strings:
		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
	condition:
		all of them
}
YARA Detection Rule: Release_dllTest
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dllTest.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
		$s1 = "0 0&00060K0R0X0f0l0q0w0"
		$s2 = ": :$:(:,:0:4:8:D:`=d="
		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
		$s7 = "<.<I<d<h<l<p<t<x<|<"
		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="

Detection condition:
all of them

Full rule:
rule Release_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "76a59fc3242a2819307bb9d593bef2e0"
	strings:
		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
		$s1 = "0 0&00060K0R0X0f0l0q0w0"
		$s2 = ": :$:(:,:0:4:8:D:`=d="
		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
		$s7 = "<.<I<d<h<l<p<t<x<|<"
		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
	condition:
		all of them
}
YARA Detection Rule: webadmin
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file webadmin.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"

Detection condition:
all of them

Full rule:
rule webadmin {
	meta:
		description = "Webshells Auto-generated - file webadmin.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3a90de401b30e5b590362ba2dde30937"
	strings:
		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
	condition:
		all of them
}
YARA Detection Rule: commands
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file commands.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"

Detection condition:
all of them

Full rule:
rule commands {
	meta:
		description = "Webshells Auto-generated - file commands.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "174486fe844cb388e2ae3494ac2d1ec2"
	strings:
		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
	condition:
		all of them
}
YARA Detection Rule: hkdoordll
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file hkdoordll.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"

Detection condition:
all of them

Full rule:
rule hkdoordll {
	meta:
		description = "Webshells Auto-generated - file hkdoordll.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b715c009d47686c0e62d0981efce2552"
	strings:
		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
	condition:
		all of them
}
YARA Detection Rule: r57shell_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file r57shell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"

Detection condition:
all of them

Full rule:
rule r57shell_2 {
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "[PII_REDACTED]cddf8aee5dec6072ed02b5"
	strings:
		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
	condition:
		all of them
}
YARA Detection Rule: Mithril_v1_45_dllTest
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dllTest.dll
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "syspath"
		$s4 = "\\Mithril"
		$s5 = "--list the services in the computer"

Detection condition:
all of them

Full rule:
rule Mithril_v1_45_dllTest {
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
	strings:
		$s3 = "syspath"
		$s4 = "\\Mithril"
		$s5 = "--list the services in the computer"
	condition:
		all of them
}
YARA Detection Rule: dbgiis6cli
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file dbgiis6cli.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
		$s5 = "###command:(NO more than 100 bytes!)"

Detection condition:
all of them

Full rule:
rule dbgiis6cli {
	meta:
		description = "Webshells Auto-generated - file dbgiis6cli.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3044dceb632b636563f66fee3aaaf8f3"
	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
		$s5 = "###command:(NO more than 100 bytes!)"
	condition:
		all of them
}
YARA Detection Rule: remview_2003_04_22
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file remview_2003_04_22.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""

Detection condition:
all of them

Full rule:
rule remview_2003_04_22 {
	meta:
		description = "Webshells Auto-generated - file remview_2003_04_22.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "17d3e4e39fbca857344a7650f7ea55e3"
	strings:
		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
	condition:
		all of them
}
YARA Detection Rule: FSO_s_test
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file test.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "$yazi = \"test\" . \"\\r\\n\";"
		$s2 = "fwrite ($fp, \"$yazi\");"

Detection condition:
all of them

Full rule:
rule FSO_s_test {
	meta:
		description = "Webshells Auto-generated - file test.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "82cf7b48da8286e644f575b039a99c26"
	strings:
		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
		$s2 = "fwrite ($fp, \"$yazi\");"
	condition:
		all of them
}
YARA Detection Rule: Debug_cress
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file cress.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "\\Mithril "
		$s4 = "Mithril.exe"

Detection condition:
all of them

Full rule:
rule Debug_cress {
	meta:
		description = "Webshells Auto-generated - file cress.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "36a416186fe010574c9be68002a7286a"
	strings:
		$s0 = "\\Mithril "
		$s4 = "Mithril.exe"
	condition:
		all of them
}
YARA Detection Rule: webshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file webshell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "RhViRYOzz"
		$s1 = "d\\O!jWW"
		$s2 = "bc!jWW"
		$s3 = "0W[&{l"
		$s4 = "[INhQ@\\"

Detection condition:
all of them

Full rule:
rule webshell {
	meta:
		description = "Webshells Auto-generated - file webshell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "f2f8c02921f29368234bfb4d4622ad19"
	strings:
		$s0 = "RhViRYOzz"
		$s1 = "d\\O!jWW"
		$s2 = "bc!jWW"
		$s3 = "0W[&{l"
		$s4 = "[INhQ@\\"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_EFSO_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file EFSO_2.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"

Detection condition:
all of them

Full rule:
rule FSO_s_EFSO_2 {
	meta:
		description = "Webshells Auto-generated - file EFSO_2.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a341270f9ebd01320a7490c12cb2e64c"
	strings:
		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
	condition:
		all of them
}
YARA Detection Rule: thelast_index3
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file index3.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"

Detection condition:
all of them

Full rule:
rule thelast_index3 {
	meta:
		description = "Webshells Auto-generated - file index3.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cceff6dc247aaa25512bad22120a14b4"
	strings:
		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
	condition:
		all of them
}
YARA Detection Rule: adjustcr
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file adjustcr.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "$Info: This file is packed with the UPX executable packer $"
		$s2 = "$License: NRV for UPX is distributed under special license $"
		$s6 = "AdjustCR Carr"
		$s7 = "ION\\System\\FloatingPo"

Detection condition:
all of them

Full rule:
rule adjustcr {
	meta:
		description = "Webshells Auto-generated - file adjustcr.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "17037fa684ef4c90a25ec5674dac2eb6"
	strings:
		$s0 = "$Info: This file is packed with the UPX executable packer $"
		$s2 = "$License: NRV for UPX is distributed under special license $"
		$s6 = "AdjustCR Carr"
		$s7 = "ION\\System\\FloatingPo"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_xIShell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file xIShell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_xIShell {
	meta:
		description = "Webshells Auto-generated - file xIShell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "997c8437c0621b4b753a546a53a88674"
	strings:
		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
	condition:
		all of them
}
YARA Detection Rule: HYTop_AppPack_2005
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"

Detection condition:
all of them

Full rule:
rule HYTop_AppPack_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
	strings:
		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
	condition:
		all of them
}
YARA Detection Rule: xssshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file xssshell.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"

Detection condition:
all of them

Full rule:
rule xssshell {
	meta:
		description = "Webshells Auto-generated - file xssshell.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
	strings:
		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_usr
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file usr.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_usr {
	meta:
		description = "Webshells Auto-generated - file usr.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "ade[PII_REDACTED]af50c9098dc8a21a024"
	strings:
		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phpinj
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phpinj.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"

Detection condition:
all of them

Full rule:
rule FSO_s_phpinj {
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "dd39d17e9baca0363cc1c3664e608929"
	strings:
		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
	condition:
		all of them
}
YARA Detection Rule: xssshell_db
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file db.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"

Detection condition:
all of them

Full rule:
rule xssshell_db {
	meta:
		description = "Webshells Auto-generated - file db.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cb62e2ec40addd4b9930a9e270f5b318"
	strings:
		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
	condition:
		all of them
}
YARA Detection Rule: PHP_sh
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file sh.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"

Detection condition:
all of them

Full rule:
rule PHP_sh {
	meta:
		description = "Webshells Auto-generated - file sh.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1e9e879d49eb0634871e9b36f99fe528"
	strings:
		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
	condition:
		all of them
}
YARA Detection Rule: xssshell_default
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file default.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"

Detection condition:
all of them

Full rule:
rule xssshell_default {
	meta:
		description = "Webshells Auto-generated - file default.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d156782ae5e0b3724de3227b42fcaf2f"
	strings:
		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
	condition:
		all of them
}