deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_UNC1151_WindowsInstaller_Silent_InstallProduct_MacroMethod
Repository: Neo23x0/signature-base
Author: Proofpoint Threat Research
Reference: Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails

Pattern signatures:
$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
        $s1 = ".UILevel = 2"
        $s2 = "CreateObject(\"WindowsInstaller.Installer\")"
        $s3 = ".InstallProduct \"http"

Detection condition:
$doc_header at 0 and all of ($s*)

Full rule:
rule APT_UNC1151_WindowsInstaller_Silent_InstallProduct_MacroMethod {
    meta:
        author = "Proofpoint Threat Research"
        date = "2021-07-28"
        hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
        hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
        reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
        id = "9ae80d54-33b9-55d7-957f-0738243e089f"
    strings:
        $doc_header = {D0 CF 11 E0 A1 B1 1A E1}
        $s1 = ".UILevel = 2"
        $s2 = "CreateObject(\"WindowsInstaller.Installer\")"
        $s3 = ".InstallProduct \"http"
    condition:
        $doc_header at 0 and all of ($s*)
}
YARA Detection Rule: EternalRocks_taskhost
Repository: Neo23x0/signature-base
Detects: Detects EternalRocks Malware - file taskhost.exe
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/stamparm/status/[PII_REDACTED]48298242

Pattern signatures:
$x1 = "EternalRocks.exe" fullword wide

      $s1 = "sTargetIP" fullword ascii
      $s2 = "SERVER_2008R2_SP0" fullword ascii
      $s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
      $s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of ($x*) or 3 of them )

Full rule:
rule EternalRocks_taskhost {
   meta:
      description = "Detects EternalRocks Malware - file taskhost.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/stamparm/status/[PII_REDACTED]48298242"
      date = "2017-05-18"
      hash1 = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
      id = "8926cdf8-6a3c-5237-80f5-bda9efb39a32"
   strings:
      $x1 = "EternalRocks.exe" fullword wide

      $s1 = "sTargetIP" fullword ascii
      $s2 = "SERVER_2008R2_SP0" fullword ascii
      $s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
      $s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of ($x*) or 3 of them )
}
YARA Detection Rule: EternalRocks_svchost
Repository: Neo23x0/signature-base
Detects: Detects EternalRocks Malware - file taskhost.exe
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/stamparm/status/[PII_REDACTED]48298242

Pattern signatures:
$s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
      $s2 = "svchost.taskhost.exe" fullword ascii
      $s3 = "ConfuserEx v" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them )

Full rule:
rule EternalRocks_svchost {
   meta:
      description = "Detects EternalRocks Malware - file taskhost.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/stamparm/status/[PII_REDACTED]48298242"
      date = "2017-05-18"
      hash1 = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
      id = "c38d3faa-06a2-5f57-a[PII_REDACTED]1352f"
   strings:
      $s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
      $s2 = "svchost.taskhost.exe" fullword ascii
      $s3 = "ConfuserEx v" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them )
}
YARA Detection Rule: MAL_Driver_Sensecorp_42B2
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED] } /* FileDescription SenseDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]004f00520050 } /* CompanyName SenseCORP */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0035002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0035002e0030002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0032 } /* LegalCopyright CopyrightC */

Detection condition:
all of them

Full rule:
rule MAL_Driver_Sensecorp_42B2 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d[PII_REDACTED]7ba25"
		date = "2024-08-07"
		score = 70
		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED] } /* FileDescription SenseDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]004f00520050 } /* CompanyName SenseCORP */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0035002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0035002e0030002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0032 } /* LegalCopyright CopyrightC */
	condition:
		all of them
}
YARA Detection Rule: MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076 } /* InternalName mimidrv */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0028006d0069006d0069006b[PII_REDACTED]7a0029 } /* ProductName mimidrvmimikatz */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076002e[PII_REDACTED]73 } /* OriginalFilename mimidrvsys */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006e[PII_REDACTED]6c006b[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e006a0061006d0069006e[PII_REDACTED]45004c[PII_REDACTED]29 } /* LegalCopyright CopyrightcgentilkiwiBenjaminDELPY */

Detection condition:
all of them

Full rule:
rule MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce[PII_REDACTED]ab8fb33c8"
		date = "2024-08-07"
		score = 70
		id = "0160f2aa-f60f-5590-be0a-6751487eab92"
	strings:
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076 } /* InternalName mimidrv */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0028006d0069006d0069006b[PII_REDACTED]7a0029 } /* ProductName mimidrvmimikatz */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076002e[PII_REDACTED]73 } /* OriginalFilename mimidrvsys */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]65006e[PII_REDACTED]6c006b[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e006a0061006d0069006e[PII_REDACTED]45004c[PII_REDACTED]29 } /* LegalCopyright CopyrightcgentilkiwiBenjaminDELPY */
	condition:
		all of them
}
YARA Detection Rule: MAL_Driver_773B
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0031002e0031002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0031002e0031002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED]0020 } /* LegalCopyright Copyrightc */

Detection condition:
all of them

Full rule:
rule MAL_Driver_773B {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "773b4a1efb9932dd5116c93d[PII_REDACTED]9343dfe13c0858d09245bc610d5894"
		date = "2024-08-07"
		score = 70
		id = "f47ab2f1-86f6-5550-939e-4477ec1c367c"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0031002e0031002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0031002e0031002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED]0020 } /* LegalCopyright Copyrightc */
	condition:
		all of them
}
YARA Detection Rule: MAL_Driver_Sensecorp_7F45
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED] } /* FileDescription SenseDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]004f00520050 } /* CompanyName SenseCORP */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0036002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0036002e0030002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0032 } /* LegalCopyright CopyrightC */

Detection condition:
all of them

Full rule:
rule MAL_Driver_Sensecorp_7F45 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
		date = "2024-08-07"
		score = 70
		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED] } /* FileDescription SenseDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED][PII_REDACTED]004f00520050 } /* CompanyName SenseCORP */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0036002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0036002e0030002e0030 } /* ProductVersion  */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0032 } /* LegalCopyright CopyrightC */
	condition:
		all of them
}
YARA Detection Rule: MAL_LNX_CamaroDragon_Sheel_Oct23
Repository: Neo23x0/signature-base
Detects: Detects CamaroDragon's tool named sheel
Author: Florian Roth
Reference: https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/

Pattern signatures:
$x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword

      $s1 = "read_ip" ascii fullword
      $s2 = "open fail.%m" ascii fullword
      $s3 = "ri:h:p:" ascii fullword /* flags */
      $s4 = "update server list success!" ascii fullword

Detection condition:
uint16(0) == 0x457f and
      filesize < 30KB and (
         1 of ($x*)
         or 3 of them
      ) 
      or 4 of them

Full rule:
rule MAL_LNX_CamaroDragon_Sheel_Oct23 {
   meta:
      description = "Detects CamaroDragon's tool named sheel"
      author = "Florian Roth"
      reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
      date = "2023-10-06"
      score = 85
      hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
      id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"
   strings:
      $x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword

      $s1 = "read_ip" ascii fullword
      $s2 = "open fail.%m" ascii fullword
      $s3 = "ri:h:p:" ascii fullword /* flags */
      $s4 = "update server list success!" ascii fullword
   condition:
      uint16(0) == 0x457f and
      filesize < 30KB and (
         1 of ($x*)
         or 3 of them
      ) 
      or 4 of them
}
YARA Detection Rule: MAL_LNX_CamaroDragon_HorseShell_Oct23
Repository: Neo23x0/signature-base
Detects: Detects CamaroDragon's HorseShell implant for routers
Author: Florian Roth
Reference: https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/

Pattern signatures:
$x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
      $x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword

      $s1 = "m.cremessage.com" ascii fullword
      $s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
      $s3 = "wzsw_encrypt_buf" ascii fullword
      $s4 = "body:%d-%s" ascii fullword
      $s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword /* String occurs 1 times in goodware */
      $s6 = "process_http_read_events" ascii fullword

      $op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
      $op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }

Detection condition:
uint16(0) == 0x457f and
      filesize < 600KB and (
         1 of ($x*)
         or 3 of them
      )
      or 5 of them

Full rule:
rule MAL_LNX_CamaroDragon_HorseShell_Oct23 {
   meta:
      description = "Detects CamaroDragon's HorseShell implant for routers"
      author = "Florian Roth"
      reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
      date = "2023-10-06"
      score = 85
      hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
      id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"
   strings:
      $x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
      $x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword

      $s1 = "m.cremessage.com" ascii fullword
      $s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
      $s3 = "wzsw_encrypt_buf" ascii fullword
      $s4 = "body:%d-%s" ascii fullword
      $s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword /* String occurs 1 times in goodware */
      $s6 = "process_http_read_events" ascii fullword

      $op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
      $op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
   condition:
      uint16(0) == 0x457f and
      filesize < 600KB and (
         1 of ($x*)
         or 3 of them
      )
      or 5 of them
}
YARA Detection Rule: mswin_check_lm_group
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file mswin_check_lm_group.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
      $s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
      $s3 = "-D    default user Domain" fullword ascii

      $fp1 = "Panda Security S.L." ascii wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 380KB and all of ($s*)
      and not 1 of ($fp*)

Full rule:
rule mswin_check_lm_group {
   meta:
      description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
      author = "Florian Roth (Nextron Systems)"
      score = 70
      reference = "http://tools.zjqhr.com/"
      date = "2015-06-13"
      modified = "2021-03-15"
      hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
      id = "be17981a-7cbf-55ac-bc81-9330472fc814"
   strings:
      $s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
      $s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
      $s3 = "-D    default user Domain" fullword ascii

      $fp1 = "Panda Security S.L." ascii wide
   condition:
      uint16(0) == 0x5a4d and filesize < 380KB and all of ($s*)
      and not 1 of ($fp*)
}
YARA Detection Rule: WAF_Bypass
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file WAF-Bypass.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "Email: blacksplitn@gmail.com" fullword wide
		$s2 = "User-Agent:" fullword wide
		$s3 = "Send Failed.in RemoteThread" fullword ascii
		$s4 = "www.example.com" fullword wide
		$s5 = "Get Domain:%s IP Failed." fullword ascii
		$s6 = "Connect To Server Failed." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them

Full rule:
rule WAF_Bypass {
	meta:
		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
		id = "d9f40934-873b-5e73-9[PII_REDACTED]27edc"
	strings:
		$s1 = "Email: blacksplitn@gmail.com" fullword wide
		$s2 = "User-Agent:" fullword wide
		$s3 = "Send Failed.in RemoteThread" fullword ascii
		$s4 = "www.example.com" fullword wide
		$s5 = "Get Domain:%s IP Failed." fullword ascii
		$s6 = "Connect To Server Failed." fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them
}
YARA Detection Rule: Guilin_veterans_cookie_spoofing_tool
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "kernel32.dll^G" fullword ascii
		$s1 = "\\.Sus\"B" ascii
		$s4 = "u56Load3" fullword ascii
		$s11 = "O MYTMP(iM) VALUES (" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1387KB and all of them

Full rule:
rule Guilin_veterans_cookie_spoofing_tool {
	meta:
		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-27"
		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
		id = "13f78e0b-c975-5879-9af1-8c619d6c94a9"
	strings:
		$s0 = "kernel32.dll^G" fullword ascii
		$s1 = "\\.Sus\"B" ascii
		$s4 = "u56Load3" fullword ascii
		$s11 = "O MYTMP(iM) VALUES (" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1387KB and all of them
}
YARA Detection Rule: MarathonTool
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file MarathonTool.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "MarathonTool" ascii
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1040KB and all of them

Full rule:
rule MarathonTool {
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
		id = "23513361-ecac-5ddb-92b9-4dd8da12e8db"
	strings:
		$s0 = "MarathonTool" ascii
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1040KB and all of them
}
YARA Detection Rule: PLUGIN_TracKid
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file TracKid.dll
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "E-mail: cracker_prince@163.com" fullword ascii
		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
		$s2 = "Coded by prince" fullword ascii
		$s3 = "TracKid.dll" fullword ascii
		$s4 = ".\\TracKid Log" fullword ascii
		$s5 = "%08x -- %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 3 of them

Full rule:
rule PLUGIN_TracKid {
	meta:
		description = "Chinese Hacktool Set - file TracKid.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
		id = "8dd77df1-748e-5778-be40-38b794c74b97"
	strings:
		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
		$s2 = "Coded by prince" fullword ascii
		$s3 = "TracKid.dll" fullword ascii
		$s4 = ".\\TracKid Log" fullword ascii
		$s5 = "%08x -- %s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
}