deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20120
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20120.xml
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20120.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20120 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20120.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
		id = "503c71de-1bc5-5690-944c-a60917a4da09"
	strings:
		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20120.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20121_cmdDef
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20121_cmdDef.xml
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
		$s1 = "<message>Failed to get File Time</message>" fullword ascii
		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
		$s3 = "<message>Failed to set File Time</message>" fullword ascii
		$s4 = "</commands>" fullword ascii
		$s5 = "<commands>" fullword ascii
		$s6 = "</version>" fullword ascii
		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
		$s9 = "</error>" fullword ascii
		$s10 = "<message>Invalid File Size</message>" fullword ascii
		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
		$s12 = "<message>File Size Mismatch</message>" fullword ascii
		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
		$s16 = "<pluginname>E_QwertyIM</plug

Detection condition:
12 of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
	meta:
		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
		id = "2deb73f7-372e-5d29-a077-431ab1967d93"
	strings:
		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
		$s1 = "<message>Failed to get File Time</message>" fullword ascii
		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
		$s3 = "<message>Failed to set File Time</message>" fullword ascii
		$s4 = "</commands>" fullword ascii
		$s5 = "<commands>" fullword ascii
		$s6 = "</version>" fullword ascii
		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
		$s9 = "</error>" fullword ascii
		$s10 = "<message>Invalid File Size</message>" fullword ascii
		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
		$s12 = "<message>File Size Mismatch</message>" fullword ascii
		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
		$s18 = "<minorType>0</minorType>" fullword ascii
		$s19 = "<code>00001002</code>" fullword ascii
		$s20 = "<code>00001001</code>" fullword ascii
	condition:
		12 of them
}
YARA Detection Rule: mal_babbleloader_win_jan24
Repository: Neo23x0/signature-base
Detects: This rule detects intrinsic patterns of BabbleLoader.
Author: 0x0d4y
Reference: https://0x0d4y.blog/babbleloader-technical-malware-analysis/

Pattern signatures:
$str_decryption_algorithm = { 48 63 44 24 ?? 48 8b 4c 24 ?? 0f b6 04 ?? 33 44 ?? ?? 0f b6 4c ?? ?? d2 c8 48 63 4c ?? ?? 48 8b 54 ?? ?? 88 04 0a 6b 44 24 ?? ?? 89 44 ?? ?? 8b 44 24 ?? ff c0 89 44 24 }
    $hashing_algorithm = { 48 8b 44 24 ?? 0f be ?? 89 44 24 ?? 8b 44 24 ?? 89 44 24 ?? 48 8b 44 24 ?? 48 ff c0 48 89 44 24 ?? 83 7c 24 08 ?? ?? ?? 8b 44 24 ?? 8b 0c ?? 03 c8 8b c1 89 04 24 8b 44 24 ?? 05 ?? ?? ?? ?? 8b 0c 24 0f af c8 8b c1 89 04 }
    $halos_gate = { 48 8b 44 24 ?? 0f b6 ?? 83 f8 4c 0f ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 ?? ?? 3d 8b ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d d1 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d b8 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85 c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 88 44 ?? ?? 48 8b 44 24 ?? 0f b6 40 ?? 88 44 ?? ?? 0f b6 44 ?? ?? c1 e0 08 0f b6 4c ?? ?? 0b c1 48 8b 8c ?? ?? ?? ?? ?? 89 01 ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 00 3d e9 }

    $get_syscall_offset = { 4d 33 db 4c 8b d9 c3 }
    $jum

Detection condition:
uint16(0) == 0x5a4d and
        $str_decryption_algorithm and $hashing_algorithm and (1 of ($halos_gate, $get_syscall_offset, $jump_syscall_offset))

Full rule:
rule mal_babbleloader_win_jan24 {
  meta:
      author = "0x0d4y"
      description = "This rule detects intrinsic patterns of BabbleLoader."
      date = "2025-01-27"
      score = 100
      reference = "https://0x0d4y.blog/babbleloader-technical-malware-analysis/"
      hash = "fa3d03c319a7597712eeff1338dabf92"

      uuid = "b2f18ab3-b4df-4e2f-aa23-de8694beb221"
      license = "CC BY 4.0"
      rule_matching_tlp = "TLP:WHITE"
      rule_sharing_tlp = "TLP:WHITE"
    strings:
    $str_decryption_algorithm = { 48 63 44 24 ?? 48 8b 4c 24 ?? 0f b6 04 ?? 33 44 ?? ?? 0f b6 4c ?? ?? d2 c8 48 63 4c ?? ?? 48 8b 54 ?? ?? 88 04 0a 6b 44 24 ?? ?? 89 44 ?? ?? 8b 44 24 ?? ff c0 89 44 24 }
    $hashing_algorithm = { 48 8b 44 24 ?? 0f be ?? 89 44 24 ?? 8b 44 24 ?? 89 44 24 ?? 48 8b 44 24 ?? 48 ff c0 48 89 44 24 ?? 83 7c 24 08 ?? ?? ?? 8b 44 24 ?? 8b 0c ?? 03 c8 8b c1 89 04 24 8b 44 24 ?? 05 ?? ?? ?? ?? 8b 0c 24 0f af c8 8b c1 89 04 }
    $halos_gate = { 48 8b 44 24 ?? 0f b6 ?? 83 f8 4c 0f ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 ?? ?? 3d 8b ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d d1 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d b8 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85 c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 88 44 ?? ?? 48 8b 44 24 ?? 0f b6 40 ?? 88 44 ?? ?? 0f b6 44 ?? ?? c1 e0 08 0f b6 4c ?? ?? 0b c1 48 8b 8c ?? ?? ?? ?? ?? 89 01 ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 00 3d e9 }

    $get_syscall_offset = { 4d 33 db 4c 8b d9 c3 }
    $jump_syscall_offset = { 4c 8b d1 41 8b 03 41 ff 63 ?? }
    condition:
        uint16(0) == 0x5a4d and
        $str_decryption_algorithm and $hashing_algorithm and (1 of ($halos_gate, $get_syscall_offset, $jump_syscall_offset))
}
YARA Detection Rule: MAL_APT_NK_Andariel_ScheduledTask_Loader
Repository: Neo23x0/signature-base
Detects: Detects a scheduled task loader used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
      $obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
      $obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 

Detection condition:
uint16(0) == 0x5A4D
      and $obfuscation1 and $obfuscation2 and $obfuscation3

Full rule:
rule MAL_APT_NK_Andariel_ScheduledTask_Loader {
   meta:
      author = "CISA.gov"
      description = "Detects a scheduled task loader used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "0c32758b-480c-5784-b28f-cee85d038850"
   strings:
      $obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
      $obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
      $obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
   condition:
      uint16(0) == 0x5A4D
      and $obfuscation1 and $obfuscation2 and $obfuscation3
}
YARA Detection Rule: MAL_APT_NK_Andariel_KaosRAT_Yamabot
Repository: Neo23x0/signature-base
Detects: Detects the KaosRAT variant
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$str1 = "/kaos/"
      $str2 = "Abstand ["
      $str3 = "] anwenden"
      $str4 = "cmVjYXB0Y2hh"
      $str5 = "/bin/sh"
      $str6 = "utilities.CIpaddress"
      $str7 = "engine.NewEgg"
      $str8 = "%s%04x%s%s%s"
      $str9 = "Y2FwdGNoYV9zZXNzaW9u"
      $str10 = "utilities.EierKochen"
      $str11 = "kandidatKaufhaus"

Detection condition:
3 of them

Full rule:
rule MAL_APT_NK_Andariel_KaosRAT_Yamabot {
   meta:
      author = "CISA.gov"
      description = "Detects the KaosRAT variant"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 70
      id = "cdde69cd-1b38-52f5-8552-cef2cf4ad69c"
   strings:
      $str1 = "/kaos/"
      $str2 = "Abstand ["
      $str3 = "] anwenden"
      $str4 = "cmVjYXB0Y2hh"
      $str5 = "/bin/sh"
      $str6 = "utilities.CIpaddress"
      $str7 = "engine.NewEgg"
      $str8 = "%s%04x%s%s%s"
      $str9 = "Y2FwdGNoYV9zZXNzaW9u"
      $str10 = "utilities.EierKochen"
      $str11 = "kandidatKaufhaus"
   condition:
      3 of them
}
YARA Detection Rule: MAL_APT_NK_TriFaux_EasyRAT_JUPITER
Repository: Neo23x0/signature-base
Detects: Detects a variant of the EasyRAT malware family
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$InitOnce = "InitOnceExecuteOnce"
      $BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
      $Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide

Detection condition:
uint16(0) == 0x5a4d
      and all of them

Full rule:
rule MAL_APT_NK_TriFaux_EasyRAT_JUPITER {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the EasyRAT malware family"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "8bd72287-59da-53cf-9[PII_REDACTED]3e59f"
   strings:
      $InitOnce = "InitOnceExecuteOnce"
      $BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
      $Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide
   condition:
      uint16(0) == 0x5a4d
      and all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_CutieDrop_MagicRAT
Repository: Neo23x0/signature-base
Detects: Detects the MagicRAT variant used by Andariel
Author: CISA.gov (modified by Florian Roth, Nextron Systems)
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
// I removed the 'wide' from the strings because the samples don't contain the strings
      // UTF-16 formatted and there's no indication that they ever will be, F.R.

      $config_os_w = "os/windows" ascii
      $config_os_l = "os/linux" ascii
      $config_os_m = "os/mac" ascii
      $config_comp_msft = "company/microsoft" ascii
      $config_comp_orcl = "company/oracle" ascii
      $POST_field_1 = "session=" ascii
      $POST_field_2 = "type=" ascii
      // $POST_field_3 = "id=" ascii wide  // disabled this string because it's too short
      $command_misspelled = "renmae" ascii

Detection condition:
uint16(0) == 0x5a4d
      and 7 of them

Full rule:
rule MAL_APT_NK_Andariel_CutieDrop_MagicRAT {
   meta:
      author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
      description = "Detects the MagicRAT variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "104244de-83fb-5112-a2b6-e20d38a6ced6"
   strings:
      // I removed the 'wide' from the strings because the samples don't contain the strings
      // UTF-16 formatted and there's no indication that they ever will be, F.R.

      $config_os_w = "os/windows" ascii
      $config_os_l = "os/linux" ascii
      $config_os_m = "os/mac" ascii
      $config_comp_msft = "company/microsoft" ascii
      $config_comp_orcl = "company/oracle" ascii
      $POST_field_1 = "session=" ascii
      $POST_field_2 = "type=" ascii
      // $POST_field_3 = "id=" ascii wide  // disabled this string because it's too short
      $command_misspelled = "renmae" ascii
   condition:
      uint16(0) == 0x5a4d
      and 7 of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_Atharvan_3RAT
Repository: Neo23x0/signature-base
Detects: Detects a variant of the Atharvan 3RAT malware family
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$3RAT = "D:\\rang\\TOOL\\3RAT"
      $atharvan = "Atharvan_dll.pdb"

Detection condition:
uint16(0) == 0x5a4d
      and 1 of them

Full rule:
rule MAL_APT_NK_Andariel_Atharvan_3RAT {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the Atharvan 3RAT malware family"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "9ff6998a-a2dd-5671-bd3f-ee69561f71ef"
   strings:
      $3RAT = "D:\\rang\\TOOL\\3RAT"
      $atharvan = "Atharvan_dll.pdb"
   condition:
      uint16(0) == 0x5a4d
      and 1 of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_LilithRAT_Variant
Repository: Neo23x0/signature-base
Detects: Detects a variant of the Lilith RAT malware family
Author: CISA.gov (modified by Florian Roth, Nextron Systems)
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
// I removed the 'wide' from the strings because the samples don't contain the strings
      // UTF-16 formatted and there's no indication that they ever will be, F.R.

      // The following are strings seen in the open source version of Lilith
      $lilith_1 = "Initiate a CMD session first." ascii
      $lilith_2 = "CMD is not open" ascii
      $lilith_3 = "Couldn't write command" ascii
      $lilith_4 = "Couldn't write to CMD: CMD not open" ascii

      // The following are strings that appear to be unique to the Unnamed Trojan based on Lilith
      $unique_1 = "Upload Error!" ascii
      $unique_2 = "ERROR: Downloading is already running!" ascii
      $unique_3 = "ERROR: Unable to open file:" ascii
      $unique_4 = "General error" ascii
      $unique_5 = "CMD error" ascii
      $unique_6 = "killing self" ascii

Detection condition:
// I refactored the condition to make it more generic, F.R.
      uint16(0) == 0x5a4d
      and filesize < 150KB
      and (
         all of ($lilith_*)
         or 4 of ($unique_*)
         or 1 of ($lilith_4, $unique_2)  // both strings are very specific - let's use them as a unique indicator, F.R

Full rule:
rule MAL_APT_NK_Andariel_LilithRAT_Variant {
   meta:
      author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
      description = "Detects a variant of the Lilith RAT malware family"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2024-07-26"
      score = 80
      id = "916a289b-db7b-5f09-9d3e-589c3f09101d"
   strings:
      // I removed the 'wide' from the strings because the samples don't contain the strings
      // UTF-16 formatted and there's no indication that they ever will be, F.R.

      // The following are strings seen in the open source version of Lilith
      $lilith_1 = "Initiate a CMD session first." ascii
      $lilith_2 = "CMD is not open" ascii
      $lilith_3 = "Couldn't write command" ascii
      $lilith_4 = "Couldn't write to CMD: CMD not open" ascii

      // The following are strings that appear to be unique to the Unnamed Trojan based on Lilith
      $unique_1 = "Upload Error!" ascii
      $unique_2 = "ERROR: Downloading is already running!" ascii
      $unique_3 = "ERROR: Unable to open file:" ascii
      $unique_4 = "General error" ascii
      $unique_5 = "CMD error" ascii
      $unique_6 = "killing self" ascii
   condition:
      // I refactored the condition to make it more generic, F.R.
      uint16(0) == 0x5a4d
      and filesize < 150KB
      and (
         all of ($lilith_*)
         or 4 of ($unique_*)
         or 1 of ($lilith_4, $unique_2)  // both strings are very specific - let's use them as a unique indicator, F.R.
      )
}
YARA Detection Rule: MAL_APT_NK_Andariel_SocksTroy_Strings_OpCodes
Repository: Neo23x0/signature-base
Detects: Detects a variant of the SocksTroy malware family
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$strHost = "-host" wide
      $strAuth = "-auth" wide
      $SocksTroy = "SocksTroy"
      $cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }

Detection condition:
uint16(0) == 0x5a4d and (
         1 of ($str*)
         and all of ($c*)
         or all of ($Socks*)
      )

Full rule:
rule MAL_APT_NK_Andariel_SocksTroy_Strings_OpCodes {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the SocksTroy malware family"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "9e7fb6ba-771e-5cae-a0d5-c0b95ee6d4e9"
   strings:
      $strHost = "-host" wide
      $strAuth = "-auth" wide
      $SocksTroy = "SocksTroy"
      $cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
   condition:
      uint16(0) == 0x5a4d and (
         1 of ($str*)
         and all of ($c*)
         or all of ($Socks*)
      )
}
YARA Detection Rule: MAL_APT_NK_Andariel_Agni
Repository: Neo23x0/signature-base
Detects: Detects samples of the Agni malware family
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
      $stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }

Detection condition:
uint16(0) == 0x5a4d
      and #xor > 100
      and #stackstrings > 5

Full rule:
rule MAL_APT_NK_Andariel_Agni {
   meta:
      author = "CISA.gov"
      description = "Detects samples of the Agni malware family"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "ffe3f427-c10a-5ad4-ab29-c0d9b576c30f"
   strings:
      $xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
      $stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }
   condition:
      uint16(0) == 0x5a4d
      and #xor > 100
      and #stackstrings > 5
}
YARA Detection Rule: MAL_APT_NK_Andariel_GoLang_Validalpha_Handshake
Repository: Neo23x0/signature-base
Detects: Detects a variant of the GoLang Validalpha malware
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 }

Detection condition:
all of them

Full rule:
rule MAL_APT_NK_Andariel_GoLang_Validalpha_Handshake {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the GoLang Validalpha malware"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 75
      id = "51dafa43-9da0-569a-9123-7e[PII_REDACTED]"
   strings:
      $ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 }
   condition:
      all of them
}
YARA Detection Rule: MAL_APT_NK_Andariel_GoLang_Validalpha_Tasks
Repository: Neo23x0/signature-base
Detects: Detects a variant of the GoLang Validalpha malware
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$ = "main.ScreenMonitThread"
      $ = "main.CmdShell"
      $ = "main.GetAllFoldersAndFiles"
      $ = "main.SelfDelete"

Detection condition:
all of them

Full rule:
rule MAL_APT_NK_Andariel_GoLang_Validalpha_Tasks {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the GoLang Validalpha malware"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 80
      id = "caa67a79-3ea6-5910-971c-f311722570ff"
   strings:
      $ = "main.ScreenMonitThread"
      $ = "main.CmdShell"
      $ = "main.GetAllFoldersAndFiles"
      $ = "main.SelfDelete"
   condition:
      all of them
}