deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Fake_AMSI_DLL_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes
Author: Florian Roth
Reference: https://twitter.com/eversinc33/status/[PII_REDACTED]92581633?s=20

Pattern signatures:
$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
      $a2 = "Amsi.pdb" ascii fullword
      $a3 = "api-ms-win-core-sysinfo-" ascii
      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
      $a5 = "AmsiAntimalware@" ascii
      $a6 = "AMSI UAC Scan" ascii

      $fp1 = "Wine builtin DLL"

Detection condition:
uint16(0) == 0x5a4d 
      // AMSI.DLL exports
      and (
         pe.exports("AmsiInitialize")
         and pe.exports("AmsiScanString")
      )
      // and now the anomalies
      and (
         filesize > 200KB     // files bigger than 100kB
         or filesize < 35KB   // files smaller than 3

Full rule:
rule SUSP_Fake_AMSI_DLL_Jun23_1 {
   meta:
      description = "Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes"
      author = "Florian Roth"
      reference = "https://twitter.com/eversinc33/status/[PII_REDACTED]92581633?s=20"
      date = "2023-06-07"
      modified = "2023-06-12"
      score = 65
      id = "b12df9de-ecfb-562b-b599-87fa786a33bc"
   strings:
      $a1 = "Microsoft.Antimalware.Scan.Interface" ascii
      $a2 = "Amsi.pdb" ascii fullword
      $a3 = "api-ms-win-core-sysinfo-" ascii
      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
      $a5 = "AmsiAntimalware@" ascii
      $a6 = "AMSI UAC Scan" ascii

      $fp1 = "Wine builtin DLL"
   condition:
      uint16(0) == 0x5a4d 
      // AMSI.DLL exports
      and (
         pe.exports("AmsiInitialize")
         and pe.exports("AmsiScanString")
      )
      // and now the anomalies
      and (
         filesize > 200KB     // files bigger than 100kB
         or filesize < 35KB   // files smaller than 35kB 
         or not 4 of ($a*)  // files that don't contain the expected strings
      )
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_Fake_AMSI_DLL_Jun23_2
Repository: Neo23x0/signature-base
Detects: Detects an amsi.dll that has very different contents or file sizes than the legitimate
Author: Florian Roth
Reference: https://twitter.com/eversinc33/status/[PII_REDACTED]92581633?s=20

Pattern signatures:
$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
      $a2 = "Amsi.pdb" ascii fullword
      $a3 = "api-ms-win-core-sysinfo-" ascii
      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
      $a5 = "AmsiAntimalware@" ascii
      $a6 = "AMSI UAC Scan" ascii

      $fp1 = "Wine builtin DLL"

Detection condition:
uint16(0) == 0x5a4d 
      // AMSI.DLL
      and filename == "amsi.dll"
      // and now the anomalies
      and (
         filesize > 200KB     // files bigger than 100kB
         or filesize < 35KB   // files smaller than 35kB 
         or not 4 of ($a*)  // files that don't contain the expected s

Full rule:
rule SUSP_Fake_AMSI_DLL_Jun23_2 {
   meta:
      description = "Detects an amsi.dll that has very different contents or file sizes than the legitimate"
      author = "Florian Roth"
      reference = "https://twitter.com/eversinc33/status/[PII_REDACTED]92581633?s=20"
      date = "2023-06-07"
      modified = "2023-06-14"
      score = 65
      id = "adec9525-6299-52d5-8f4e-a83366d3dcfd"
   strings:
      $a1 = "Microsoft.Antimalware.Scan.Interface" ascii
      $a2 = "Amsi.pdb" ascii fullword
      $a3 = "api-ms-win-core-sysinfo-" ascii
      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
      $a5 = "AmsiAntimalware@" ascii
      $a6 = "AMSI UAC Scan" ascii

      $fp1 = "Wine builtin DLL"
   condition:
      uint16(0) == 0x5a4d 
      // AMSI.DLL
      and filename == "amsi.dll"
      // and now the anomalies
      and (
         filesize > 200KB     // files bigger than 100kB
         or filesize < 35KB   // files smaller than 35kB 
         or not 4 of ($a*)  // files that don't contain the expected strings
      )
      and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_CVE_2021_31166_Accept_Encoding_May21_1
Repository: Neo23x0/signature-base
Detects: Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/0vercl0k/CVE-2021-31166

Pattern signatures:
$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/

Detection condition:
1 of them

Full rule:
rule EXPL_CVE_2021_31166_Accept_Encoding_May21_1 {
   meta:
      description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/0vercl0k/CVE-2021-31166"
      date = "2021-05-21"
      score = 70
      id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
   strings:
      $xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
   condition:
      1 of them
}
YARA Detection Rule: Lazarus_Dec_17_1
Repository: Neo23x0/signature-base
Detects: Detects Lazarus malware from incident in Dec 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8U6fY2

Pattern signatures:
$s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
      $s2 = "HHA Version 4." ascii
      $s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
      $s4 = "bUEeYE" fullword ascii

Detection condition:
uint16(0) == 0x5449 and filesize < 4000KB and all of them

Full rule:
rule Lazarus_Dec_17_1 {
   meta:
      description = "Detects Lazarus malware from incident in Dec 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8U6fY2"
      date = "2017-12-20"
      hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
      id = "f195ebf0-d7af-58e8-a544-769a0c8b628b"
   strings:
      $s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
      $s2 = "HHA Version 4." ascii
      $s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
      $s4 = "bUEeYE" fullword ascii
   condition:
      uint16(0) == 0x5449 and filesize < 4000KB and all of them
}
YARA Detection Rule: Lazarus_Dec_17_2
Repository: Neo23x0/signature-base
Detects: Detects Lazarus malware from incident in Dec 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8U6fY2

Pattern signatures:
$s1 = "SkypeSetup.exe" fullword wide
      $s2 = "%s\\SkypeSetup.exe" fullword ascii
      $s3 = "Skype Technologies S.A." fullword wide

      $a1 = "Microsoft Code Signing PCA" ascii wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 7000KB and (
        all of ($s*) and not $a1
      )

Full rule:
rule Lazarus_Dec_17_2 {
   meta:
      description = "Detects Lazarus malware from incident in Dec 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8U6fY2"
      date = "2017-12-20"
      hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
      hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
      id = "45127fb5-0f70-5140-acd9-46147d365dfe"
   strings:
      $s1 = "SkypeSetup.exe" fullword wide
      $s2 = "%s\\SkypeSetup.exe" fullword ascii
      $s3 = "Skype Technologies S.A." fullword wide

      $a1 = "Microsoft Code Signing PCA" ascii wide
   condition:
      uint16(0) == 0x5a4d and filesize < 7000KB and (
        all of ($s*) and not $a1
      )
}
YARA Detection Rule: Lazarus_Dec_17_4
Repository: Neo23x0/signature-base
Detects: Detects Lazarus malware from incident in Dec 2017ithumb.js
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8U6fY2

Pattern signatures:
$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii

Detection condition:
filesize < 9KB and 1 of them

Full rule:
rule Lazarus_Dec_17_4 {
   meta:
      description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8U6fY2"
      date = "2017-12-20"
      hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
      hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
      id = "fbdc6287-c177-53b5-83dd-979936f65192"
   strings:
      $s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
   condition:
      filesize < 9KB and 1 of them
}
YARA Detection Rule: Lazarus_Dec_17_5
Repository: Neo23x0/signature-base
Detects: Detects Lazarus malware from incident in Dec 2017
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8U6fY2

Pattern signatures:
$x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
      $x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
      $x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
      $x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
      $x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
      $x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
      $x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
      $x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii

Detection condition:
filesize < 500KB and 1 of them

Full rule:
rule Lazarus_Dec_17_5 {
   meta:
      description = "Detects Lazarus malware from incident in Dec 2017"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8U6fY2"
      date = "2017-12-20"
      hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
      id = "33bd8c08-123e-5a8e-b5dc-02af7291addc"
   strings:
      $x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
      $x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
      $x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
      $x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
      $x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
      $x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
      $x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
      $x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
   condition:
      filesize < 500KB and 1 of them
}
YARA Detection Rule: EnigmaPacker_Rare
Repository: Neo23x0/signature-base
Detects: Detects an ENIGMA packed executable
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "P.rel$oc$" fullword ascii
      $s2 = "ENIGMA" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )

Full rule:
rule EnigmaPacker_Rare {
   meta:
      description = "Detects an ENIGMA packed executable"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-04-27"
      score = 60
      hash1 = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
      id = "748bc74c-e83f-5740-8ff7-f1371fc22802"
   strings:
      $s1 = "P.rel$oc$" fullword ascii
      $s2 = "ENIGMA" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )
}
YARA Detection Rule: Enigma_Protected_Malware_May17_RhxFiles
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file RhxFiles.dll
Author: Florian Roth (Nextron Systems) with the help of binar.ly
Reference: Internal Research

Pattern signatures:
$op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
      $op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
      $op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )

Full rule:
rule Enigma_Protected_Malware_May17_RhxFiles {
   meta:
      description = "Auto-generated rule - file RhxFiles.dll"
      author = "Florian Roth (Nextron Systems) with the help of binar.ly"
      reference = "Internal Research"
      date = "2017-05-02"
      hash1 = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
      id = "d701d591-4283-5645-8768-a5ab7df0f37a"
   strings:
      $op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
      $op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
      $op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )
}
YARA Detection Rule: Enigma_Protected_Malware
Repository: Neo23x0/signature-base
Detects: Detects samples packed by Enigma Protector
Author: Florian Roth (Nextron Systems) with the help of binar.ly
Reference: https://goo.gl/OEVQ9w

Pattern signatures:
$s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
      $s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
      $s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Enigma_Protected_Malware {
   meta:
      description = "Detects samples packed by Enigma Protector"
      author = "Florian Roth (Nextron Systems) with the help of binar.ly"
      reference = "https://goo.gl/OEVQ9w"
      date = "2017-02-03"
      hash1 = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
      id = "d701d591-4283-5645-8768-a5ab7df0f37a"
   strings:
      $s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
      $s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
      $s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: PrikormkaDropper
Repository: Neo23x0/signature-base

Pattern signatures:
$kd1 = "KDSTORAGE" wide
        $kd2 = "KDSTORAGE_64" wide
        $kd3 = "KDRUNDRV32" wide
        $kd4 = "KDRAR" wide

        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}

        $inj1 = "?AVCinj2008Dlg@@" ascii
        $inj2 = "?AVCinj2008App@@" ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))

Full rule:
private rule PrikormkaDropper
{
    strings:
        $kd1 = "KDSTORAGE" wide
        $kd2 = "KDSTORAGE_64" wide
        $kd3 = "KDRUNDRV32" wide
        $kd4 = "KDRAR" wide

        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}

        $inj1 = "?AVCinj2008Dlg@@" ascii
        $inj2 = "?AVCinj2008App@@" ascii
    condition:
        uint16(0) == 0x5a4d and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
}
YARA Detection Rule: PrikormkaModule
Repository: Neo23x0/signature-base

Pattern signatures:
// binary
        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}

        // encrypted
        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}

        // mutex
        $str13 = "ZxWinDeffContex" ascii wide
        $str14 = "Paramore756Contex43" wide
        $str15 = "Zw_&one@ldrCon

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
private rule PrikormkaModule
{
    strings:
        // binary
        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}

        // encrypted
        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}

        // mutex
        $str13 = "ZxWinDeffContex" ascii wide
        $str14 = "Paramore756Contex43" wide
        $str15 = "Zw_&one@ldrContext43" wide

        // other
        $str16 = "A95BL765MNG2GPRS"

        // dll names
        $str17 = "helpldr.dll" wide fullword
        $str18 = "swma.dll" wide fullword
        $str19 = "iomus.dll" wide fullword
        $str20 = "atiml.dll"  wide fullword
        $str21 = "hlpuctf.dll" wide fullword
        $str22 = "hauthuid.dll" ascii wide fullword

        // rbcon
        $str23 = "[roboconid][%s]" ascii fullword
        $str24 = "[objectset][%s]" ascii fullword
        $str25 = "rbcon.ini" wide fullword

        // files and logs
        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword

        // pdb strings
        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
        $str29 = "\\PZZ\\RMO\\" ascii
        $str30 = ":\\work\\PZZ" ascii
        $str31 = "C:\\Users\\mlk\\" ascii
        $str32 = ":\\W o r k S p a c e\\" ascii
        $str33
YARA Detection Rule: PrikormkaEarlyVersion
Repository: Neo23x0/signature-base

Pattern signatures:
$str1 = "IntelRestore" ascii fullword
        $str2 = "Resent" wide fullword
        $str3 = "ocp8.1" wide fullword
        $str4 = "rsfvxd.dat" ascii fullword
        $str5 = "tsb386.dat" ascii fullword
        $str6 = "frmmlg.dat" ascii fullword
        $str7 = "smdhost.dll" ascii fullword
        $str8 = "KDLLCFX" wide fullword
        $str9 = "KDLLRUNDRV" wide fullword

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
private rule PrikormkaEarlyVersion
{
    strings:
        $str1 = "IntelRestore" ascii fullword
        $str2 = "Resent" wide fullword
        $str3 = "ocp8.1" wide fullword
        $str4 = "rsfvxd.dat" ascii fullword
        $str5 = "tsb386.dat" ascii fullword
        $str6 = "frmmlg.dat" ascii fullword
        $str7 = "smdhost.dll" ascii fullword
        $str8 = "KDLLCFX" wide fullword
        $str9 = "KDLLRUNDRV" wide fullword
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: Prikormka
Repository: Neo23x0/signature-base
Detects: Operation Groundbait
Author: Anton Cherepanov

Detection condition:
PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion

Full rule:
rule Prikormka
{
    meta:
        Author      = "Anton Cherepanov"
        Date        = "2016/05/10"
        Description = "Operation Groundbait"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "threatintel@eset.com"
        License = "BSD 2-Clause"
        id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
    condition:
        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
}
YARA Detection Rule: SUSP_Unsigned_OSPPSVC
Repository: Neo23x0/signature-base
Detects: Detects a suspicious unsigned office software protection platform service binary
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/

Pattern signatures:
/* FileDescription Microsoft Office Software Protection Platform Service */
      $sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
               00 65 00 72 00 76 00 69 00 63 00 65 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 8000KB and $sc1 and pe.number_of_signatures < 1

Full rule:
rule SUSP_Unsigned_OSPPSVC {
   meta:
      description = "Detects a suspicious unsigned office software protection platform service binary"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
      date = "2019-09-26"
      hash1 = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
      id = "0e312237-0c82-59da-b62d-56065c6075f0"
   strings:
      /* FileDescription Microsoft Office Software Protection Platform Service */
      $sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
               00 65 00 72 00 76 00 69 00 63 00 65 }
   condition:
      uint16(0) == 0x5a4d and filesize < 8000KB and $sc1 and pe.number_of_signatures < 1
}