deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_ME_RawDisk_Agent_Jan20_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious malware using ElRawDisk
Author: Florian Roth (Nextron Systems)
Reference: Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN

Pattern signatures:
$x1 = "\\drv\\agent.plain.pdb" ascii
      $x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii

      $s1 = ".?AVERDError@@" fullword ascii
      $s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c[PII_REDACTED]af63adf3c911e2287a4b906d47d" fullword wide
      $s3 = "\\\\?\\ElRawDisk" fullword wide
      $s4 = "\\??\\c:" wide

      $op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
      $op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule MAL_ME_RawDisk_Agent_Jan20_1 {
   meta:
      description = "Detects suspicious malware using ElRawDisk"
      author = "Florian Roth (Nextron Systems)"
      reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
      date = "2020-01-02"
      modified = "2022-12-21"
      hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
      id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"
   strings:
      $x1 = "\\drv\\agent.plain.pdb" ascii
      $x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii

      $s1 = ".?AVERDError@@" fullword ascii
      $s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c[PII_REDACTED]af63adf3c911e2287a4b906d47d" fullword wide
      $s3 = "\\\\?\\ElRawDisk" fullword wide
      $s4 = "\\??\\c:" wide

      $op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
      $op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: MAL_ME_RawDisk_Agent_Jan20_2
Repository: Neo23x0/signature-base
Detects: Detects suspicious malware using ElRawDisk
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/jfslowik/status/[PII_REDACTED]49741568?s=09

Pattern signatures:
$x1 = "\\Release\\Dustman.pdb" ascii
      $x2 = "/c agent.exe A" fullword ascii

      $s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
      $s2 = "The Magic Word!" fullword ascii
      $s3 = "Software\\Oracle\\VirtualBox" fullword wide
      $s4 = "\\assistant.sys" wide
      $s5 = "Down With Bin Salman" fullword wide

      $sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }

      $op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }

Detection condition:
uint16(0) == 0x5a4d and filesize <= 3000KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_ME_RawDisk_Agent_Jan20_2 {
   meta:
      description = "Detects suspicious malware using ElRawDisk"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/jfslowik/status/[PII_REDACTED]49741568?s=09"
      date = "2020-01-02"
      modified = "2022-12-21"
      hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
      id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
   strings:
      $x1 = "\\Release\\Dustman.pdb" ascii
      $x2 = "/c agent.exe A" fullword ascii

      $s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
      $s2 = "The Magic Word!" fullword ascii
      $s3 = "Software\\Oracle\\VirtualBox" fullword wide
      $s4 = "\\assistant.sys" wide
      $s5 = "Down With Bin Salman" fullword wide

      $sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }

      $op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
   condition:
      uint16(0) == 0x5a4d and filesize <= 3000KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: BronzeButler_Daserf_Delphi_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool sample from Bronze Butler incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses

Pattern signatures:
$s1 = "Services.exe" fullword ascii
      $s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
      $s3 = "l32.dll" fullword ascii
      $s4 = "tProcess:" fullword ascii
      $s5 = " InjectPr" ascii
      $s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
      $s7 = "on\\run /v " fullword ascii
      $s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
      $s9 = "ms1ng2d3d2.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )

Full rule:
rule BronzeButler_Daserf_Delphi_1 {
   meta:
      description = "Detects malware / hacktool sample from Bronze Butler incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
      date = "2017-10-14"
      hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
      hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
      hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
      id = "88372e62-3bba-58dc-825c-f35533e42825"
   strings:
      $s1 = "Services.exe" fullword ascii
      $s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
      $s3 = "l32.dll" fullword ascii
      $s4 = "tProcess:" fullword ascii
      $s5 = " InjectPr" ascii
      $s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
      $s7 = "on\\run /v " fullword ascii
      $s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
      $s9 = "ms1ng2d3d2.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
}
YARA Detection Rule: BronzeButler_DGet_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool sample from Bronze Butler incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses

Pattern signatures:
$s2 = "DGet Tool Made by XZ" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them )

Full rule:
rule BronzeButler_DGet_1 {
   meta:
      description = "Detects malware / hacktool sample from Bronze Butler incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
      date = "2017-10-14"
      hash1 = "bd[PII_REDACTED]9aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
      id = "d60fcc9f-0f17-5871-9e8e-71d26e2f46bc"
   strings:
      $s2 = "DGet Tool Made by XZ" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them )
}
YARA Detection Rule: BronzeButler_UACBypass_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool sample from Bronze Butler incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses

Pattern signatures:
$x1 = "\\Release\\BypassUacDll.pdb" ascii
      $x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
      $x3 = "Elevation:Administrator!new:{3ad055" fullword wide
      $x4 = "BypassUac.pdb" fullword ascii
      $x5 = "[bypassUAC] started X64" fullword wide
      $x6 = "[bypassUAC] started X86" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them )

Full rule:
rule BronzeButler_UACBypass_1 {
   meta:
      description = "Detects malware / hacktool sample from Bronze Butler incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
      date = "2017-10-14"
      hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
      id = "01853352-58fc-56a3-8c20-08405c71e251"
   strings:
      $x1 = "\\Release\\BypassUacDll.pdb" ascii
      $x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
      $x3 = "Elevation:Administrator!new:{3ad055" fullword wide
      $x4 = "BypassUac.pdb" fullword ascii
      $x5 = "[bypassUAC] started X64" fullword wide
      $x6 = "[bypassUAC] started X86" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them )
}
YARA Detection Rule: BronzeButler_xxmm_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool sample from Bronze Butler incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses

Pattern signatures:
$x1 = "\\Release\\ReflectivLoader.pdb" ascii
      $x3 = "\\Projects\\xxmm2\\Release\\" ascii
      $x5 = "http://127.0.0.1/phptunnel.php" fullword ascii

      $s1 = "xxmm2.exe" fullword ascii
      $s2 = "\\AvUpdate.exe" wide
      $s3 = "stdapi_fs_file_download" fullword ascii
      $s4 = "stdapi_syncshell_open" fullword ascii
      $s5 = "stdapi_execute_sleep" fullword ascii
      $s6 = "stdapi_syncshell_kill" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and (
         1 of ($x*) or
         4 of them
      )

Full rule:
rule BronzeButler_xxmm_1 {
   meta:
      description = "Detects malware / hacktool sample from Bronze Butler incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
      date = "2017-10-14"
      hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
      id = "0e413e3a-fb61-58bc-9ecb-4ef76e83a7f3"
   strings:
      $x1 = "\\Release\\ReflectivLoader.pdb" ascii
      $x3 = "\\Projects\\xxmm2\\Release\\" ascii
      $x5 = "http://127.0.0.1/phptunnel.php" fullword ascii

      $s1 = "xxmm2.exe" fullword ascii
      $s2 = "\\AvUpdate.exe" wide
      $s3 = "stdapi_fs_file_download" fullword ascii
      $s4 = "stdapi_syncshell_open" fullword ascii
      $s5 = "stdapi_execute_sleep" fullword ascii
      $s6 = "stdapi_syncshell_kill" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and (
         1 of ($x*) or
         4 of them
      )
}
YARA Detection Rule: BronzeButler_RarStar_1
Repository: Neo23x0/signature-base
Detects: Detects malware / hacktool sample from Bronze Butler incident
Author: Florian Roth (Nextron Systems)
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses

Pattern signatures:
$s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
      $s2 = "http://www.google.co.jp" fullword wide
      $s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
      $s4 = "\\*.rar" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )

Full rule:
rule BronzeButler_RarStar_1 {
   meta:
      description = "Detects malware / hacktool sample from Bronze Butler incident"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
      date = "2017-10-14"
      hash1 = "0fc1b4fdf0dc5373f98de8817da[PII_REDACTED]f775f5aa0b9b0e1a78d4b49e5f4"
      id = "770270b3-6743-5efb-84d8-b63f1df800d9"
   strings:
      $s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
      $s2 = "http://www.google.co.jp" fullword wide
      $s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
      $s4 = "\\*.rar" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
}
YARA Detection Rule: Daserf_Nov1_BronzeButler
Repository: Neo23x0/signature-base
Detects: Detects Daserf malware used by Bronze Butler
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/ffeCfd

Pattern signatures:
$x1 = "mstmp1845234.exe" fullword ascii
      /* Bronce Butler UA String - see google search */
      $x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
      $x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii

      $s1 = "Content-Type: */*" fullword ascii
      $s2 = "ProxyEnable" ascii fullword
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
      $s4 = "iexplore.exe" ascii fullword
      /* Looks random but present in many samples */
      $s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
      $s6 = "rrentVersion\\Internet Settings" fullword ascii
      $s7 = "ws\\CurrentVersion\\Inter" fullword ascii
      $s8 = "Documents an" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 5 of them )

Full rule:
rule Daserf_Nov1_BronzeButler {
   meta:
      description = "Detects Daserf malware used by Bronze Butler"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/ffeCfd"
      date = "2017-11-08"
      hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
      id = "58c4d3dc-c516-567b-8746-4e185c3cd328"
   strings:
      $x1 = "mstmp1845234.exe" fullword ascii
      /* Bronce Butler UA String - see google search */
      $x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
      $x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii

      $s1 = "Content-Type: */*" fullword ascii
      $s2 = "ProxyEnable" ascii fullword
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
      $s4 = "iexplore.exe" ascii fullword
      /* Looks random but present in many samples */
      $s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
      $s6 = "rrentVersion\\Internet Settings" fullword ascii
      $s7 = "ws\\CurrentVersion\\Inter" fullword ascii
      $s8 = "Documents an" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 5 of them )
}
YARA Detection Rule: IMPLANT_1_v1
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
         E8 ?? ?? FF FF 59}

Detection condition:
(uint16(0) == 0x5A4D) and all of them

Full rule:
rule IMPLANT_1_v1 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "eb3fc39b-08ca-51df-a9b4-7b28b107b700"
   strings:
      $STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
         E8 ?? ?? FF FF 59}
   condition:
      (uint16(0) == 0x5A4D) and all of them
}
YARA Detection Rule: IMPLANT_1_v2
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
      $STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }

Detection condition:
(uint16(0) == 0x5A4D) and any of them

Full rule:
rule IMPLANT_1_v2 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "c7beab50-8e73-5161-be7e-bc3f8351873a"
   strings:
      $STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
      $STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
   condition:
      (uint16(0) == 0x5A4D) and any of them
}
YARA Detection Rule: IMPLANT_1_v3
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them

Full rule:
rule IMPLANT_1_v3 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "517133d2-813d-5f44-84c2-a53c62d7a688"
   strings:
      $rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
   condition:
      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
YARA Detection Rule: IMPLANT_1_v4
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }

Detection condition:
(uint16(0) == 0x5A4D) and all of them

Full rule:
rule IMPLANT_1_v4 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "0362b885-de59-5715-80f2-106e5e91d1fa"
   strings:
      $XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
   condition:
      (uint16(0) == 0x5A4D) and all of them
}
YARA Detection Rule: IMPLANT_1_v5
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
      $mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them

Full rule:
rule IMPLANT_1_v5 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "ac1c6175-3a8b-524b-bb18-243c52f7dba1"
   strings:
      $drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
      $mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
   condition:
      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
}
YARA Detection Rule: IMPLANT_1_v6
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$XORopcodes_eax = { 35 (22 07 15 0e|56 d7 a7 0a) }
      $XORopcodes_others = { 81 (F1|F2|F3|F4|F5|F6|F7) (22 07 15 0E|56 D7 A7 0A) }

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025) and any of them

Full rule:
rule IMPLANT_1_v6 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
   strings:
      $XORopcodes_eax = { 35 (22 07 15 0e|56 d7 a7 0a) }
      $XORopcodes_others = { 81 (F1|F2|F3|F4|F5|F6|F7) (22 07 15 0E|56 D7 A7 0A) }
   condition:
      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025) and any of them
}
YARA Detection Rule: IMPLANT_1_v7
Repository: Neo23x0/signature-base
Detects: Downrage Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }

Detection condition:
(uint16(0) == 0x5A4D) and all of them

Full rule:
rule IMPLANT_1_v7 {
   meta:
      description = "Downrage Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "2a28273f-d9a1-5e80-bef1-b488eb0326bd"
   strings:
      $XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
   condition:
      (uint16(0) == 0x5A4D) and all of them
}
YARA Detection Rule: IMPLANT_2_v1
Repository: Neo23x0/signature-base
Detects: CORESHELL/SOURFACE Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}

Detection condition:
(uint16(0) == 0x5A4D) and all of them

Full rule:
rule IMPLANT_2_v1 {
   meta:
      description = "CORESHELL/SOURFACE Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "058266d4-8dc5-5a26-9bc6-4c55ac646e9b"
   strings:
      $STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
   condition:
      (uint16(0) == 0x5A4D) and all of them
}
YARA Detection Rule: IMPLANT_2_v3
Repository: Neo23x0/signature-base
Detects: CORESHELL/SOURFACE Implant by APT28
Author: US CERT
Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE

Pattern signatures:
$STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
      $STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
      $STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
         ?? ?? 8D ?? ?? FE }

Detection condition:
(uint16(0) == 0x5A4D) and any of them

Full rule:
rule IMPLANT_2_v3 {
   meta:
      description = "CORESHELL/SOURFACE Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "747e4f76-b9c4-5988-90ae-b450548b1b82"
   strings:
      $STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
      $STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
      $STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
         ?? ?? 8D ?? ?? FE }
   condition:
      (uint16(0) == 0x5A4D) and any of them
}