deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26
Repository: Neo23x0/signature-base
Detects: Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx
Author: Moritz Oettle
Reference: https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell

Pattern signatures:
$x1 = "!BDN"  /* PST file header */

      $g1 = "Page language=" ascii
      $g2 = "<%@ Page" ascii
      $g3 = "Request.Item[" ascii
      $g4 = "\"unsafe\");" ascii
      $g5 = "<%eval(" ascii
      $g6 = "script language=" ascii
      $g7 = "Request[" ascii

      $s1 = "gold8899" ascii  /* HTTP Request Parameter */
      $s2 = "exec_code" ascii  /* HTTP Request Parameter */
      $s3 = "orangenb" ascii  /* HTTP Request Parameter */

Detection condition:
filesize < 500KB and
      $x1 at 0 and
      (1 of ($s*) or 3 of ($g*))

Full rule:
rule WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26 {
   meta:
      description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
      author = "Moritz Oettle"
      reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
      date = "2021-09-04"
      score = 85
      id = "6aea414f-d27c-5202-84f8-b8620782fc90"
   strings:
      $x1 = "!BDN"  /* PST file header */

      $g1 = "Page language=" ascii
      $g2 = "<%@ Page" ascii
      $g3 = "Request.Item[" ascii
      $g4 = "\"unsafe\");" ascii
      $g5 = "<%eval(" ascii
      $g6 = "script language=" ascii
      $g7 = "Request[" ascii

      $s1 = "gold8899" ascii  /* HTTP Request Parameter */
      $s2 = "exec_code" ascii  /* HTTP Request Parameter */
      $s3 = "orangenb" ascii  /* HTTP Request Parameter */
   condition:
      filesize < 500KB and
      $x1 at 0 and
      (1 of ($s*) or 3 of ($g*))
}
YARA Detection Rule: SUSP_IIS_Config_ProxyShell_Artifacts
Repository: Neo23x0/signature-base
Detects: Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)
Author: Florian Roth (Nextron Systems)
Reference: https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit

Pattern signatures:
$a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $s1 = " physicalPath=\"C:\\ProgramData\\" ascii

Detection condition:
filesize < 500KB and all of ($a*) and 1 of ($s*)

Full rule:
rule SUSP_IIS_Config_ProxyShell_Artifacts {
   meta:
      description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
      date = "2021-08-25"
      score = 70
      id = "bde65d9e-b17d-5746-8d29-8419363d0511"
   strings:
      $a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $s1 = " physicalPath=\"C:\\ProgramData\\" ascii
   condition:
      filesize < 500KB and all of ($a*) and 1 of ($s*)
}
YARA Detection Rule: SUSP_IIS_Config_VirtualDir
Repository: Neo23x0/signature-base
Detects: Detects suspicious virtual directory configured in IIS pointing to a User folder
Author: Florian Roth (Nextron Systems)
Reference: https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit

Pattern signatures:
$a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $s2 = " physicalPath=\"C:\\Users\\" ascii

      $fp1 = "Microsoft.Web.Administration" wide
      $fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"

Detection condition:
filesize < 500KB and all of ($a*) and 1 of ($s*)
      and not 1 of ($fp*)

Full rule:
rule SUSP_IIS_Config_VirtualDir {
   meta:
      description = "Detects suspicious virtual directory configured in IIS pointing to a User folder"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
      date = "2021-08-25"
      modified = "2022-09-17"
      score = 60
      id = "cfe5ca5e-a0cc-5f60-84d2-1b0538e999c7"
   strings:
      $a1 = "<site name=" ascii  /* marker used to select IIS configs */
      $a2 = "<sectionGroup name=\"system.webServer\">" ascii

      $s2 = " physicalPath=\"C:\\Users\\" ascii

      $fp1 = "Microsoft.Web.Administration" wide
      $fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"
   condition:
      filesize < 500KB and all of ($a*) and 1 of ($s*)
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_ASPX_PossibleDropperArtifact_Aug21
Repository: Neo23x0/signature-base
Detects: Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques
Author: Max Altgelt
Reference: Internal Research

Pattern signatures:
$s1 = "Page Language=" ascii nocase

      $fp1 = "Page Language=\"java\"" ascii nocase

Detection condition:
filesize < 500KB
      and not uint16(0) == 0x4B50 and not uint16(0) == 0x6152 and not uint16(0) == 0x8b1f  // Exclude ZIP / RAR / GZIP files (can cause FPs when uncompressed)
      and not uint16(0) == 0x5A4D  // PE
      and not uint16(0) == 0xCFD0  // OLE
      and not uint16(0) == 0xC3D4  // PCA

Full rule:
rule SUSP_ASPX_PossibleDropperArtifact_Aug21 {
   meta:
      description = "Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques"
      reference = "Internal Research"
      author = "Max Altgelt"
      date = "2021-08-23"
      score = 60
      id = "52016598-74a1-53d6-812a-40b078ba0bb9"
   strings:
      $s1 = "Page Language=" ascii nocase

      $fp1 = "Page Language=\"java\"" ascii nocase
   condition:
      filesize < 500KB
      and not uint16(0) == 0x4B50 and not uint16(0) == 0x6152 and not uint16(0) == 0x8b1f  // Exclude ZIP / RAR / GZIP files (can cause FPs when uncompressed)
      and not uint16(0) == 0x5A4D  // PE
      and not uint16(0) == 0xCFD0  // OLE
      and not uint16(0) == 0xC3D4  // PCAP
      and not uint16(0) == 0x534D  // CAB
      and all of ($s*) and not 1 of ($fp*) and
      (
         ((uint8(0) < 0x20 or uint8(0) > 0x7E  /*non-ASCII*/ ) and uint8(0) != 0x9  /* tab */ and uint8(0) != 0x0D  /* carriage return */ and uint8(0) != 0x0A  /* new line */ and uint8(0) != 0xEF  /* BOM UTF-8 */ )
         or ((uint8(1) < 0x20 or uint8(1) > 0x7E  /*non-ASCII*/ ) and uint8(1) != 0x9  /* tab */ and uint8(1) != 0x0D  /* carriage return */ and uint8(1) != 0x0A  /* new line */ and uint8(1) != 0xBB  /* BOM UTF-8 */ )
         or ((uint8(2) < 0x20 or uint8(2) > 0x7E  /*non-ASCII*/ ) and uint8(2) != 0x9  /* tab */ and uint8(2) != 0x0D  /* carriage return */ and uint8(2) != 0x0A  /* new line */ and uint8(2) != 0xBF  /* BOM UTF-8 */ )
         or ((uint8(3) < 0x20 or uint8(3) > 0x7E  /*non-ASCII*/ ) and uint8(3) != 0x9  /* tab */ and uint8(3) != 0x0D  /* carriage return */ and uint8(3) != 0x0A  /* new line */ )
         or ((uint8(4) < 0x20 or uint8(4) > 0x7E  /*non-ASCII*/ ) and uint8(4) != 0x9  /* tab */ and uint8(4) != 0x0D  /* carriage return */ and uint8(4) != 0x0A  /* new line */ )
         or ((uint8(5) < 0x20 or uint8(5) > 0x7E  /*non-ASCII*/ ) and uint8(5) != 0x9  /* tab */ and uint8(5) != 0x0D  /* carriage ret
YARA Detection Rule: WEBSHELL_ProxyShell_Exploitation_Nov21_1
Repository: Neo23x0/signature-base
Detects: Detects webshells dropped by DropHell malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside

Pattern signatures:
$s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
      $s02 = "new System.IO.MemoryStream()" ascii wide
      $s03 = "Transform(" ascii wide

Detection condition:
all of ($s*)

Full rule:
rule WEBSHELL_ProxyShell_Exploitation_Nov21_1 {
   meta:
      description = "Detects webshells dropped by DropHell malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
      date = "2021-11-01"
      score = 85
      id = "300eaadf-db0c-5591-84fc-abdf7cdd90c1"
   strings:
      $s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
      $s02 = "new System.IO.MemoryStream()" ascii wide
      $s03 = "Transform(" ascii wide
   condition:
      all of ($s*)
}
YARA Detection Rule: ME_Campaign_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and (
        pe.imphash() == "618f76eaf4bd95c690d43e84d617efe9"
      )

Full rule:
rule ME_Campaign_Malware_1 {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      hash1 = "[PII_REDACTED]62b3bc1f401a5987dc55ae4b007367e[PII_REDACTED]8642ffbd474e"
      id = "7c844c5c-caf0-5968-ac1a-72886fcf97cf"
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and (
        pe.imphash() == "618f76eaf4bd95c690d43e84d617efe9"
      )
}
YARA Detection Rule: ME_Campaign_Malware_2
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Pattern signatures:
$s1 = "QuickAssist.exe" fullword wide
      $s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
      $s3 = "GBEWCWA" fullword ascii
      $s4 = "name=\"QuickAssist\" " fullword ascii
      $s5 = "Cimzal" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "b06055e6cc2a804111ab6964df1ca4ae" or
        4 of them
      )

Full rule:
rule ME_Campaign_Malware_2 {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
      id = "a0beec30-62ff-54c3-ab62-c54454b89f8d"
   strings:
      $s1 = "QuickAssist.exe" fullword wide
      $s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
      $s3 = "GBEWCWA" fullword ascii
      $s4 = "name=\"QuickAssist\" " fullword ascii
      $s5 = "Cimzal" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "b06055e6cc2a804111ab6964df1ca4ae" or
        4 of them
      )
}
YARA Detection Rule: ME_Campaign_Malware_3
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Pattern signatures:
$x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
      $x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
      $x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
      $s4 = "File=appData & \"\\sys.ps1\"" fullword ascii

Detection condition:
uint16(0) == 0x6553 and filesize < 400KB and 1 of them

Full rule:
rule ME_Campaign_Malware_3 {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
      id = "d8bfd426-ff42-5332-8206-67a558509494"
   strings:
      $x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
      $x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
      $x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
      $s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
   condition:
      uint16(0) == 0x6553 and filesize < 400KB and 1 of them
}
YARA Detection Rule: ME_Campaign_Malware_4
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and pe.imphash() == "fb7da233a35ac523d6059fff543627ab"

Full rule:
rule ME_Campaign_Malware_4 {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
      id = "1ff83ac6-e3f1-55e2-a811-e526b8235c78"
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and pe.imphash() == "fb7da233a35ac523d6059fff543627ab"
}
YARA Detection Rule: ME_Campaign_Malware_5
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Pattern signatures:
$s1 = "D:\\me\\do\\do\\obj\\" ascii
      $s2 = "Select * from Win32_ComputerSystem" fullword wide
      $s3 = "Get_Antivirus" fullword ascii
      $s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
      $s5 = "update software online" fullword wide
      $s6 = "time.nist.gov" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and 5 of them or all of them

Full rule:
rule ME_Campaign_Malware_5 {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      modified = "2022-08-18"
      hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
      hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
      id = "241a4236-2688-5920-87f7-eed33963ec60"
   strings:
      $s1 = "D:\\me\\do\\do\\obj\\" ascii
      $s2 = "Select * from Win32_ComputerSystem" fullword wide
      $s3 = "Get_Antivirus" fullword ascii
      $s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
      $s5 = "update software online" fullword wide
      $s6 = "time.nist.gov" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and 5 of them or all of them
}
YARA Detection Rule: DeepPanda_sl_txt_packed
Repository: Neo23x0/signature-base
Detects: Hack Deep Panda - ScanLine sl-txt-packed
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Command line port scanner" fullword wide
		$s1 = "sl.exe" fullword wide
		$s2 = "CPports.txt" fullword ascii
		$s3 = ",GET / HTTP/.}" fullword ascii
		$s4 = "Foundstone Inc." fullword wide
		$s9 = " 2002 Foundstone Inc." fullword wide
		$s15 = ", Inc. 2002" fullword ascii
		$s20 = "ICMP Time" fullword ascii

Detection condition:
all of them

Full rule:
rule DeepPanda_sl_txt_packed {
	meta:
		description = "Hack Deep Panda - ScanLine sl-txt-packed"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
		id = "7a335810-2bf9-5a0b-bef4-1bade65a0f00"
	strings:
		$s0 = "Command line port scanner" fullword wide
		$s1 = "sl.exe" fullword wide
		$s2 = "CPports.txt" fullword ascii
		$s3 = ",GET / HTTP/.}" fullword ascii
		$s4 = "Foundstone Inc." fullword wide
		$s9 = " 2002 Foundstone Inc." fullword wide
		$s15 = ", Inc. 2002" fullword ascii
		$s20 = "ICMP Time" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: DeepPanda_lot1
Repository: Neo23x0/signature-base
Detects: Hack Deep Panda - lot1.tmp-pwdump
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Unable to open target process: %d, pid %d" fullword ascii
		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
		$s2 = "Target: Failed to load SAM functions." fullword ascii
		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
		$s12 = "PwDump.exe" fullword ascii
		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
		$s16 = "dump logon session" fullword ascii
		$s17 = "Timed out waiting to get our pipe back" fullword ascii
		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
		$s20 = "%s\\%s.exe" fullword ascii

Detection condition:
10 of them

Full rule:
rule DeepPanda_lot1 {
	meta:
		description = "Hack Deep Panda - lot1.tmp-pwdump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
		id = "c72120a5-8637-580c-9856-e070dfb6df94"
	strings:
		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
		$s2 = "Target: Failed to load SAM functions." fullword ascii
		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
		$s12 = "PwDump.exe" fullword ascii
		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
		$s16 = "dump logon session" fullword ascii
		$s17 = "Timed out waiting to get our pipe back" fullword ascii
		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
		$s20 = "%s\\%s.exe" fullword ascii
	condition:
		10 of them
}
YARA Detection Rule: DeepPanda_htran_exe
Repository: Neo23x0/signature-base
Detects: Hack Deep Panda - htran-exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s2 = "\\Release\\htran.pdb" ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s8 = "======================== htran V%s =======================" fullword ascii
		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii

Detection condition:
1 of them

Full rule:
rule DeepPanda_htran_exe {
	meta:
		description = "Hack Deep Panda - htran-exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
		id = "2a551e82-aff1-5a77-bc5e-d06e49dca8bc"
	strings:
		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s2 = "\\Release\\htran.pdb" ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s8 = "======================== htran V%s =======================" fullword ascii
		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: DeepPanda_Trojan_Kakfum
Repository: Neo23x0/signature-base
Detects: Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
		$s1 = "%s\\sqlsrv32.dll" fullword ascii
		$s2 = "%s\\sqlsrv64.dll" fullword ascii
		$s3 = "%s\\%d.tmp" fullword ascii
		$s4 = "ServiceMaix" fullword ascii
		$s15 = "sqlserver" fullword ascii

Detection condition:
all of them

Full rule:
rule DeepPanda_Trojan_Kakfum {
	meta:
		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
		id = "a204f9cb-65f8-53ea-a4eb-d[PII_REDACTED]3"
	strings:
		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
		$s1 = "%s\\sqlsrv32.dll" fullword ascii
		$s2 = "%s\\sqlsrv64.dll" fullword ascii
		$s3 = "%s\\%d.tmp" fullword ascii
		$s4 = "ServiceMaix" fullword ascii
		$s15 = "sqlserver" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: remsec_executable_blob_32
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }

Detection condition:
all of them

Full rule:
rule remsec_executable_blob_32 {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "d7a7e57a-b117-5da8-a7a2-4c6351bd9072"
   strings:
      $code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
   condition:
      all of them
}
YARA Detection Rule: remsec_executable_blob_64
Repository: Neo23x0/signature-base
Detects: Detects malware from Symantec's Strider APT report
Reference: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets

Pattern signatures:
$code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }

Detection condition:
all of them

Full rule:
rule remsec_executable_blob_64 {
   meta:
      copyright = "Symantec"
      description = "Detects malware from Symantec's Strider APT report"
      score = 80
      date = "2016/08/08"
      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
      id = "22345f40-3dae-5d5b-acc6-c[PII_REDACTED]6"
   strings:
      $code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
   condition:
      all of them
}