deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cachedump
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
      $s2 = "Unable to open LSASS.EXE process" fullword ascii
      $s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
      $s4 = "CacheDump service successfully installed." fullword ascii
      $s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
      $s6 = "cacheDump [-v | -vv | -K]" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 500KB and 1 of them) or (3 of them)

Full rule:
rule cachedump {
   meta:
      description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      super_rule = 1
      hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
      hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
      id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"
   strings:
      $s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
      $s2 = "Unable to open LSASS.EXE process" fullword ascii
      $s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
      $s4 = "CacheDump service successfully installed." fullword ascii
      $s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
      $s6 = "cacheDump [-v | -vv | -K]" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 500KB and 1 of them) or (3 of them)
}
YARA Detection Rule: PwDump_B
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - file PwDump.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
      $x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
      $x3 = "where -x targets a 64-bit host" fullword ascii
      $x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii

      $s1 = "lsremora64.dll" fullword ascii
      $s2 = "lsremora.dll" fullword ascii
      $s3 = "servpw.exe" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($x*)) or (3 of them)

Full rule:
rule PwDump_B {
   meta:
      description = "Detects a tool used by APT groups - file PwDump.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/igxLyF"
      date = "2016-09-08"
      hash1 = "3c796092f42a948018c3954f837b[PII_REDACTED]845019fce75a6e82bc99317982"
      id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"
   strings:
      $x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
      $x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
      $x3 = "where -x targets a 64-bit host" fullword ascii
      $x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii

      $s1 = "lsremora64.dll" fullword ascii
      $s2 = "lsremora.dll" fullword ascii
      $s3 = "servpw.exe" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($x*)) or (3 of them)
}
YARA Detection Rule: MSBuild_Mimikatz_Execution_via_XML
Repository: Neo23x0/signature-base
Detects: Detects an XML that executes Mimikatz on an endpoint via MSBuild
Author: Florian Roth (Nextron Systems)
Reference: https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml

Pattern signatures:
$x1 = "<Project ToolsVersion=" ascii
      $x2 = "</SharpLauncher>" fullword ascii

      $s1 = "\"TVqQAAMAAAA" ascii
      $s2 = "System.Convert.FromBase64String(" ascii
      $s3 = ".Invoke(" ascii
      $s4 = "Assembly.Load(" ascii
      $s5 = ".CreateInstance(" ascii

Detection condition:
all of them

Full rule:
rule MSBuild_Mimikatz_Execution_via_XML {
   meta:
      description = "Detects an XML that executes Mimikatz on an endpoint via MSBuild"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
      date = "2016-10-07"
      id = "98aa68b9-6de4-5353-8d87-9e974529c044"
   strings:
      $x1 = "<Project ToolsVersion=" ascii
      $x2 = "</SharpLauncher>" fullword ascii

      $s1 = "\"TVqQAAMAAAA" ascii
      $s2 = "System.Convert.FromBase64String(" ascii
      $s3 = ".Invoke(" ascii
      $s4 = "Assembly.Load(" ascii
      $s5 = ".CreateInstance(" ascii
   condition:
      all of them
}
YARA Detection Rule: Fscan_Portscanner
Repository: Neo23x0/signature-base
Detects: Fscan port scanner scan output / strings
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/JamesHabben/status/[PII_REDACTED]70480128

Pattern signatures:
$s1 = "Time taken:" fullword ascii
      $s2 = "Scan finished at" fullword ascii
      $s3 = "Scan started at" fullword ascii

Detection condition:
filesize < 20KB and 3 of them

Full rule:
rule Fscan_Portscanner {
   meta:
      description = "Fscan port scanner scan output / strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/JamesHabben/status/[PII_REDACTED]70480128"
      date = "2017-01-06"
      id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"
   strings:
      $s1 = "Time taken:" fullword ascii
      $s2 = "Scan finished at" fullword ascii
      $s3 = "Scan started at" fullword ascii
   condition:
      filesize < 20KB and 3 of them
}
YARA Detection Rule: WPR_loader_EXE
Repository: Neo23x0/signature-base
Detects: Windows Password Recovery - file loader.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Failed to get system process ID" fullword wide
      $s2 = "gLSASS.EXE" fullword wide
      $s3 = "WriteProcessMemory failed" fullword wide
      $s4 = "wow64 process NOT created" fullword wide
      $s5 = "\\ast.exe" wide
      $s6 = "Exit code=%s, status=%d" fullword wide
      $s7 = "VirtualProtect failed" fullword wide
      $s8 = "nSeDebugPrivilege" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 100KB and 3 of them)

Full rule:
rule WPR_loader_EXE {
   meta:
      description = "Windows Password Recovery - file loader.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-15"
      hash1 = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
      id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"
   strings:
      $s1 = "Failed to get system process ID" fullword wide
      $s2 = "gLSASS.EXE" fullword wide
      $s3 = "WriteProcessMemory failed" fullword wide
      $s4 = "wow64 process NOT created" fullword wide
      $s5 = "\\ast.exe" wide
      $s6 = "Exit code=%s, status=%d" fullword wide
      $s7 = "VirtualProtect failed" fullword wide
      $s8 = "nSeDebugPrivilege" fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 100KB and 3 of them)
}
YARA Detection Rule: WPR_Passscape_Loader
Repository: Neo23x0/signature-base
Detects: Windows Password Recovery - file ast.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
      $s2 = "ast64.dll" fullword ascii
      $s3 = "\\loader64.exe" wide
      $s4 = "Passcape 64-bit Loader Service" fullword wide
      $s5 = "PasscapeLoader64" fullword wide
      $s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 2 of them)

Full rule:
rule WPR_Passscape_Loader {
   meta:
      description = "Windows Password Recovery - file ast.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-15"
      hash1 = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb[PII_REDACTED]eea56e9cb"
      id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"
   strings:
      $s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
      $s2 = "ast64.dll" fullword ascii
      $s3 = "\\loader64.exe" wide
      $s4 = "Passcape 64-bit Loader Service" fullword wide
      $s5 = "PasscapeLoader64" fullword wide
      $s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 2 of them)
}
YARA Detection Rule: WPR_Asterisk_Hook_Library
Repository: Neo23x0/signature-base
Detects: Windows Password Recovery - file ast64.dll
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "ast64.dll" fullword ascii
      $s2 = "ast.dll" fullword wide
      $s3 = "c:\\%s.lvc" fullword ascii
      $s4 = "c:\\%d.lvc" fullword ascii
      $s5 = "Asterisk Hook Library" fullword wide
      $s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
      $s7 = "Global\\{1374821A-281B-9AF4-%04X[PII_REDACTED]1234}" fullword ascii
      $s8 = "2004-2013 Passcape Software" fullword wide
      $s9 = "Global\\Passcape#6712%04X" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 300KB and 3 of them)

Full rule:
rule WPR_Asterisk_Hook_Library {
   meta:
      description = "Windows Password Recovery - file ast64.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-15"
      hash1 = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
      hash2 = "95ec84dc709af[PII_REDACTED]82d30309c42d175c40bd65cad267e6f103852a02d"
      id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"
   strings:
      $s1 = "ast64.dll" fullword ascii
      $s2 = "ast.dll" fullword wide
      $s3 = "c:\\%s.lvc" fullword ascii
      $s4 = "c:\\%d.lvc" fullword ascii
      $s5 = "Asterisk Hook Library" fullword wide
      $s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
      $s7 = "Global\\{1374821A-281B-9AF4-%04X[PII_REDACTED]1234}" fullword ascii
      $s8 = "2004-2013 Passcape Software" fullword wide
      $s9 = "Global\\Passcape#6712%04X" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 300KB and 3 of them)
}
YARA Detection Rule: WPR_WindowsPasswordRecovery_EXE
Repository: Neo23x0/signature-base
Detects: Windows Password Recovery - file wpr.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "UuPipe" fullword ascii
      $x2 = "dbadllgl" fullword ascii
      $x3 = "UkVHSVNUUlkgTU9O" fullword ascii  /* base64 encoded string 'REGISTRY MON' */
      $x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii  /* base64 encoded string 'FILE MONITOR - SY' */

      $s1 = "WPR.exe" fullword wide
      $s2 = "Windows Password Recovery" fullword wide

      $op0 = { 5f df 27 17 89 }  /* Opcode */
      $op1 = { 5f 00 00 f2 e5 cb 97 }  /* Opcode */
      $op2 = { e8 ed 00 f0 cc e4 00 a0 17 }  /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 20000KB and
      (
         1 of ($x*) or
         all of ($s*) or
         all of ($op*)
      )

Full rule:
rule WPR_WindowsPasswordRecovery_EXE {
   meta:
      description = "Windows Password Recovery - file wpr.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-15"
      hash1 = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
      id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"
   strings:
      $x1 = "UuPipe" fullword ascii
      $x2 = "dbadllgl" fullword ascii
      $x3 = "UkVHSVNUUlkgTU9O" fullword ascii  /* base64 encoded string 'REGISTRY MON' */
      $x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii  /* base64 encoded string 'FILE MONITOR - SY' */

      $s1 = "WPR.exe" fullword wide
      $s2 = "Windows Password Recovery" fullword wide

      $op0 = { 5f df 27 17 89 }  /* Opcode */
      $op1 = { 5f 00 00 f2 e5 cb 97 }  /* Opcode */
      $op2 = { e8 ed 00 f0 cc e4 00 a0 17 }  /* Opcode */
   condition:
      uint16(0) == 0x5a4d and
      filesize < 20000KB and
      (
         1 of ($x*) or
         all of ($s*) or
         all of ($op*)
      )
}
YARA Detection Rule: WPR_WindowsPasswordRecovery_EXE_64
Repository: Neo23x0/signature-base
Detects: Windows Password Recovery - file ast64.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "%B %d %Y  -  %H:%M:%S" fullword wide

      $op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 }  /* Opcode */
      $op1 = { ff 15 16 25 01 00 f7 d8 1b }  /* Opcode */
      $op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }  /* Opcode */

Detection condition:
(uint16(0) == 0x5a4d and filesize < 300KB and all of them)

Full rule:
rule WPR_WindowsPasswordRecovery_EXE_64 {
   meta:
      description = "Windows Password Recovery - file ast64.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-15"
      hash1 = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
      id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"
   strings:
      $s1 = "%B %d %Y  -  %H:%M:%S" fullword wide

      $op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 }  /* Opcode */
      $op1 = { ff 15 16 25 01 00 f7 d8 1b }  /* Opcode */
      $op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }  /* Opcode */
   condition:
      (uint16(0) == 0x5a4d and filesize < 300KB and all of them)
}
YARA Detection Rule: BeyondExec_RemoteAccess_Tool
Repository: Neo23x0/signature-base
Detects: Detects BeyondExec Remote Access Tool - file rexesvr.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/BvYurS

Pattern signatures:
$x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
      $x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
      $x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii

      $op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 }  /* Opcode */
      $op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }  /* Opcode */

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and (1 of ($x*) or all of ($op*))) or (3 of them)

Full rule:
rule BeyondExec_RemoteAccess_Tool {
   meta:
      description = "Detects BeyondExec Remote Access Tool - file rexesvr.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/BvYurS"
      date = "2017-03-17"
      hash1 = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b[PII_REDACTED]7032c"
      id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"
   strings:
      $x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
      $x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
      $x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii

      $op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 }  /* Opcode */
      $op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }  /* Opcode */
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and (1 of ($x*) or all of ($op*))) or (3 of them)
}
YARA Detection Rule: Mimikatz_Gen_Strings
Repository: Neo23x0/signature-base
Detects: Detects Mimikatz by using some special strings
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "[*] '%s' service already started" fullword wide
      $s2 = "** Security Callback! **" fullword wide
      $s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
      $s4 = "enterpriseadmin" fullword wide
      $s5 = "Ask debug privilege" fullword wide
      $s6 = "Injected =)" fullword wide
      $s7 = "** SAM ACCOUNT **" fullword wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them)

Full rule:
rule Mimikatz_Gen_Strings {
   meta:
      description = "Detects Mimikatz by using some special strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-06-19"
      super_rule = 1
      hash1 = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
      hash2 = "eefd4c038afa0e80cf6521c69644e286df08c0883f[PII_REDACTED]3f50feac0f85"
      hash3 = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
      id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"
   strings:
      $s1 = "[*] '%s' service already started" fullword wide
      $s2 = "** Security Callback! **" fullword wide
      $s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
      $s4 = "enterpriseadmin" fullword wide
      $s5 = "Ask debug privilege" fullword wide
      $s6 = "Injected =)" fullword wide
      $s7 = "** SAM ACCOUNT **" fullword wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them)
}
YARA Detection Rule: Disclosed_0day_POCs_lpe
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
      $x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
      $x3 = "\\payload.msi /quiet" ascii
      $x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
      $x5 = "\\payload2" wide
      $x6 = "\\payload" wide
      $x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 70KB and 1 of them)

Full rule:
rule Disclosed_0day_POCs_lpe {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      hash1 = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
      hash2 = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
      hash3 = "5b701a5b5bbef[PII_REDACTED]cef2755e57984bfdff569fe99efec14a552d8ee43"
      id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"
   strings:
      $x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
      $x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
      $x3 = "\\payload.msi /quiet" ascii
      $x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
      $x5 = "\\payload2" wide
      $x6 = "\\payload" wide
      $x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 70KB and 1 of them)
}
YARA Detection Rule: Disclosed_0day_POCs_exploit
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$x1 = "\\Release\\exploit.pdb" ascii
      $x2 = "\\favorites\\stolendata.txt" wide

Detection condition:
(uint16(0) == 0x5a4d and filesize < 200KB and 1 of them)

Full rule:
rule Disclosed_0day_POCs_exploit {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      hash1 = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
      id = "72b8aafd-d79a-5812-90fd-5d5aca109254"
   strings:
      $x1 = "\\Release\\exploit.pdb" ascii
      $x2 = "\\favorites\\stolendata.txt" wide
   condition:
      (uint16(0) == 0x5a4d and filesize < 200KB and 1 of them)
}
YARA Detection Rule: Disclosed_0day_POCs_InjectDll
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$x1 = "\\Release\\InjectDll.pdb" ascii
      $x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
      $x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
      $x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
      $x5 = "Error adjusting privilege %d" fullword ascii

Detection condition:
(uint16(0) == 0x5a4d and filesize < 300KB and 1 of them)

Full rule:
rule Disclosed_0day_POCs_InjectDll {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      modified = "2022-12-21"
      hash1 = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
      id = "90a4dca0-4f12-5946-9d5d-0b93bb5a3c5d"
   strings:
      $x1 = "\\Release\\InjectDll.pdb" ascii
      $x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
      $x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
      $x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
      $x5 = "Error adjusting privilege %d" fullword ascii
   condition:
      (uint16(0) == 0x5a4d and filesize < 300KB and 1 of them)
}
YARA Detection Rule: Disclosed_0day_POCs_payload_MSI
Repository: Neo23x0/signature-base
Detects: Detects POC code from disclosed 0day hacktool set
Author: Florian Roth (Nextron Systems)
Reference: Disclosed 0day Repos

Pattern signatures:
$s1 = "WShell32.dll" fullword wide
      $s2 = "Target empty, so account name translation begins on the local system." fullword wide
      $s3 = "\\custact\\x86\\AICustAct.pdb" ascii

Detection condition:
(uint16(0) == 0xcfd0 and filesize < 1000KB and all of them)

Full rule:
rule Disclosed_0day_POCs_payload_MSI {
   meta:
      description = "Detects POC code from disclosed 0day hacktool set"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Disclosed 0day Repos"
      date = "2017-07-07"
      modified = "2022-12-21"
      hash1 = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
      id = "fe32af56-d5a1-5246-a7df-395b9cd02faf"
   strings:
      $s1 = "WShell32.dll" fullword wide
      $s2 = "Target empty, so account name translation begins on the local system." fullword wide
      $s3 = "\\custact\\x86\\AICustAct.pdb" ascii
   condition:
      (uint16(0) == 0xcfd0 and filesize < 1000KB and all of them)
}