ACE_Containing_EXE;Looks for ACE Archives containing an exe/scr file;-;2015-09-09 00:00:00;50;Florian Roth - based on Nick Hoffman' rule - Morphick Inc;FILE;25e3ffe70795c56ef869c65149c41c71
ALFA_SHELL;Detects web shell often used by Iranian APT groups;Internal Research - APT33;2017-09-21 00:00:00;75;Florian Roth;APT,WEBSHELL;469453dad2fbae30d38aafa5fc8ad6a7
APT28_CHOPSTICK;Detects a malware that behaves like CHOPSTICK mentioned in APT28 report;https://goo.gl/v3ebal;2015-06-02 00:00:00;60;Florian Roth;APT,EXE,FILE,RUSSIA;7cce8362c5381282c0df3eb6c3eb9156
APT28_SourFace_Malware1;Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.;https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html;2015-06-01 00:00:00;60;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;02aedce037d2125858f8e19dd988556d
APT28_SourFace_Malware2;Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.;https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html;2015-06-01 00:00:00;60;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;05b146ef78dc991baee4121b4c702c3b
APT28_SourFace_Malware3;Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server.;https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html;2015-06-01 00:00:00;60;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;178a2c12a1bac4d04c92fae9f90f159c
APT30_Generic_2;FireEye APT30 Report Sample - from many files;https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf;2015-04-13 00:00:00;75;Florian Roth;APT,FILE,GEN;5da8fa4357c3fd250ce879b543b61a28
APT6_Malware_Sample_Gen;Rule written for 2 malware samples that communicated to APT6 C2 servers;https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/;2016-04-09 00:00:00;80;Florian Roth;APT,EXE,FILE,GEN,MAL;a0fb19cb9984d92bc59db250ce6ed255
APTGroupX_PlugXTrojanLoader_StringDecode;Rule to detect PlugX Malware;https://t.co/4xQ8G2mNap;1970-01-01 01:00:00;80;Jay DiMartino;MAL;f9300e67d61b85f3be3f9161b362d1ad
APT_APT10_Malware_Imphash_Dec18_1;Detects APT10 malware based on ImpHashes;AlienVault OTX IOCs - statistical sample analysis;2018-12-28 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,MAL;6e2087b6abb48da2f67d25c43a8d95b1
APT_APT28_Cannon_Trojan_Nov18_1;Detects Cannon Trojan used by Sofacy;https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/;2018-11-20 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;874b39ec14a7d1f15a0b6095ed66f33a
APT_Area1_SSF_GoogleSend_Strings;Detects send tool used in phishing campaign reported by Area 1 in December 2018;https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf;2018-12-19 00:00:00;75;Area 1 (modified by Florian Roth);APT,EXE,FILE;0a23b99fcbf29d6e0e24d8b0487f0f93
APT_Area1_SSF_PlugX;Detects send tool used in phishing campaign reported by Area 1 in December 2018;https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf;2018-12-19 00:00:00;75;Area 1;APT;fdf36018ac3dac89649c94a139ed1539
APT_Cloaked_PsExec;Looks like a cloaked PsExec. May be APT group activity.;-;2014-07-18 00:00:00;60;Florian Roth;APT,EXE,EXTVAR,FILE;0443bf568d17de127ae3eaaa789a156b
APT_Cloaked_ScanLine;Looks like a cloaked ScanLine Port Scanner. May be APT group activity.;-;2014-07-18 00:00:00;50;Florian Roth;APT,EXE,EXTVAR,FILE,HKTL;a2b258e6701a526d5afb3850fd52083d
APT_Cloaked_SuperScan;Looks like a cloaked SuperScan Port Scanner. May be APT group activity.;-;2014-07-18 00:00:00;50;Florian Roth;APT,EXE,EXTVAR,FILE,HKTL;907a9e92a733e7a9d8df45fb93a0d023
APT_DarkHydrus_Jul18_1;Detects strings found in malware samples in APT report in DarkHydrus;https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/;2018-07-28 00:00:00;75;Florian Roth;APT,EXE,FILE,MIDDLE_EAST;b651d033ca15b5028ad57c7886f5a343
APT_DarkHydrus_Jul18_2;Detects strings found in malware samples in APT report in DarkHydrus;https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/;2018-07-28 00:00:00;75;Florian Roth;APT,EXE,FILE,MIDDLE_EAST;f84af612bfe4e856885feaaa6c911b08
APT_DarkHydrus_Jul18_3;Detects strings found in malware samples in APT report in DarkHydrus;https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/;2018-07-28 00:00:00;75;Florian Roth;APT,EXE,FILE,MIDDLE_EAST;69b866acc6899c583919db3e7e09ebda
APT_DarkHydrus_Jul18_4;Detects strings found in malware samples in APT report in DarkHydrus;https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/;2018-07-28 00:00:00;75;Florian Roth;APT,EXE,FILE,MIDDLE_EAST;9c57a24ada5685d6e6b93ab4bfea7637
APT_DarkHydrus_Jul18_5;Detects strings found in malware samples in APT report in DarkHydrus;https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/;2018-07-28 00:00:00;75;Florian Roth;APT,EXE,FILE,MIDDLE_EAST;e84e68b7618884588bd6f776c6b0d689
APT_DonotTeam_YTYframework;Modular malware framework with similarities to EHDevel;arbornetworks.com/blog/asert/don;2018-08-03 00:00:00;75;James E.C, ProofPoint;APT,FILE;136f2bdeeda5a19363961d060331947c
APT_FIN7_EXE_Sample_Aug18_10;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;c5db62ea6f8b5e4576258bea857020fd
APT_FIN7_EXE_Sample_Aug18_1;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;aa76e34953d18a24728d0f4217c6586f
APT_FIN7_EXE_Sample_Aug18_2;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;9a953dcd27e95bca8e8c062e5a748ce1
APT_FIN7_EXE_Sample_Aug18_3;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;9a4375419e88fa4ddba9fec09d42af1f
APT_FIN7_EXE_Sample_Aug18_4;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;ebeb4eed696df08f224dad1dbb039677
APT_FIN7_EXE_Sample_Aug18_5;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;0d28c3976fdbe57bbfd0e494374d4fe9
APT_FIN7_EXE_Sample_Aug18_6;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;aa3c712d6085d59a241c5b25604692d0
APT_FIN7_EXE_Sample_Aug18_7;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;8bb7bd379468c65dba3fd69188de4527
APT_FIN7_EXE_Sample_Aug18_8;Detects sample from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;cc7341764212bef3c1e1ccb7c6ab66bb
APT_FIN7_MalDoc_Aug18_1;Detects malicious Doc from FIN7 campaign;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,RUSSIA;b867d4a326ef36a400372e4e76462760
APT_FIN7_Sample_Aug18_1;Detects FIN7 samples mentioned in FireEye report;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,FILE,RUSSIA;c2acdcf6f4989a335e0fa5dd4b31e8e0
APT_FIN7_Strings_Aug18_1;Detects strings from FIN7 report in August 2018;https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html;2018-08-01 00:00:00;75;Florian Roth;APT,RUSSIA;130d7a4b3d12d94331598ae75184f512
APT_GreyEnergy_Malware_Oct18_1;Detects samples from Grey Energy report;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;417bb04c18efa14ede7f2187a5e81ab1
APT_GreyEnergy_Malware_Oct18_2;Detects samples from Grey Energy report;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;25494921f5c155770a1ed4d19850e2d4
APT_GreyEnergy_Malware_Oct18_3;Detects samples from Grey Energy report;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;a2fb0917d72762344f9526d6e7c27417
APT_GreyEnergy_Malware_Oct18_4;Detects samples from Grey Energy report;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;713a4f65c36c19c4ebe7d523fe29f5ac
APT_GreyEnergy_Malware_Oct18_5;Detects samples from Grey Energy report;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;b7e2162f7eb8bd8aba59a91e2ac7fb43
APT_MAL_DNS_Hijacking_Campaign_AA19_024A;Detects malware used in DNS Hijackign campaign;https://www.us-cert.gov/ncas/alerts/AA19-024A;2019-01-25 00:00:00;75;Florian Roth;APT,EXE,FILE;74a54b611b333f749e264b527b244c1a
APT_ME_BigBang_Gen_Jul18_1;Detects malware from Big Bang campaign against Palestinian authorities;https://research.checkpoint.com/apt-attack-middle-east-big-bang/;2018-07-09 00:00:00;75;Florian Roth;APT,EXE,FILE,GEN;f1e013ec5b8f6aeec6fc98391bc694cc
APT_ME_BigBang_Mal_Jul18_1;Detects malware from Big Bang report;https://research.checkpoint.com/apt-attack-middle-east-big-bang/;2018-07-09 00:00:00;75;Florian Roth;APT,EXE,FILE;5d7a2550cfecbb2e6fa07d9509252b4b
APT_MagicHound_MalMacro;Detects malicious macro / powershell in Office document;https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations;2017-02-17 00:00:00;75;Florian Roth;APT,FILE,OFFICE;768633d484dd36908416bffe638c1647
APT_Malware_PutterPanda_Gen4;Detects Malware related to PutterPanda;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;4602e2bbe8b06d4adb03123a5db0a1eb
APT_Malware_PutterPanda_MsUpdater_1;Detects Malware related to PutterPanda - MSUpdater;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;62f69d46210e12fe401e56f901fdb5af
APT_Malware_PutterPanda_MsUpdater_2;Detects Malware related to PutterPanda - MSUpdater;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;87e2474c8bf0220c02a57dd0f01c5c3a
APT_Malware_PutterPanda_MsUpdater_3;Detects Malware related to PutterPanda - MSUpdater;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;aa99b02760344bafd1edc132a8e809ec
APT_Malware_PutterPanda_PSAPI;Detects a malware related to Putter Panda;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;756ceadee9087abddcefa10d379fe73e
APT_Malware_PutterPanda_Rel;Detects an APT malware related to PutterPanda;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;83c7029886bc572d4d3152499d7b9b4f
APT_Malware_PutterPanda_Rel_2;APT Malware related to PutterPanda Group;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,EXE,FILE,MAL;d8aac4d61260f18f1cf2f45b16458a37
APT_Malware_PutterPanda_WUAUCLT;Detects a malware related to Putter Panda;VT Analysis;2015-06-03 00:00:00;70;Florian Roth;APT,CHINA,MAL;036c84b599ab24a61b602c9435f936db
APT_NK_AR18_165A_1;Detects APT malware from AR18-165A report by US CERT;https://www.us-cert.gov/ncas/analysis-reports/AR18-165A;2018-06-15 00:00:00;75;Florian Roth;APT,EXE,FILE;32b90b0c9c4fc974b03b0ec757a23457
APT_NK_AR18_165A_HiddenCobra_import_deob;Hidden Cobra - Detects installed proxy module as a service;https://www.us-cert.gov/ncas/analysis-reports/AR18-165A;2018-04-12 00:00:00;75;NCCIC trusted 3rd party - Edit: Tobias Michalski;APT,FILE,NK;c4200d68bb1633295b87464cb797bffb
APT_Project_Sauron_Custom_M1;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;4e91d0b33284ea30079ce886bdcb212a
APT_Project_Sauron_Custom_M2;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;dad36d29819639821437138975f2caa2
APT_Project_Sauron_Custom_M3;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;00e18a86832995ec47774c3ed39687b2
APT_Project_Sauron_Custom_M4;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;6a363a45bbf20c1dc10cc2d00ee9e495
APT_Project_Sauron_Custom_M6;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;7c3291cd11ef684d0ff6386d80963046
APT_Project_Sauron_Custom_M7;Detects malware from Project Sauron APT;https://goo.gl/eFoP4A;2016-08-09 00:00:00;75;Florian Roth;APT,EXE,FILE;9b63e16a3ed9a07bb2abb39b063e0e1c
APT_Project_Sauron_Scripts;Detects scripts (mostly LUA) from Project Sauron report by Kaspersky;https://goo.gl/eFoP4A;2016-08-08 00:00:00;75;Florian Roth;APT;91a9845d427b6228911040f8038da40a
APT_Project_Sauron_arping_module;Detects strings from arping module - Project Sauron report by Kaspersky;https://goo.gl/eFoP4A;2016-08-08 00:00:00;75;Florian Roth;APT;f03f1968bc51e724055967fb4a046a14
APT_Project_Sauron_basex_module;Detects strings from basex module - Project Sauron report by Kaspersky;https://goo.gl/eFoP4A;2016-08-08 00:00:00;75;Florian Roth;APT;16cf8f05aa3907e85ec798fc096479e0
APT_Project_Sauron_dext_module;Detects strings from dext module - Project Sauron report by Kaspersky;https://goo.gl/eFoP4A;2016-08-08 00:00:00;75;Florian Roth;APT;da2b1be9edaa32bd0aa2efaf52f7f418
APT_Project_Sauron_kblogi_module;Detects strings from kblogi module - Project Sauron report by Kaspersky;https://goo.gl/eFoP4A;2016-08-08 00:00:00;75;Florian Roth;APT;ec07e689a011e6a31d319b3999da0bb3
APT_Script_AUS_4;Detetcs a script involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT;bbab688544d15089b70b810eed4f42ce
APT_TA18_149A_Joanap_Sample1;Detects malware from TA18-149A report by US-CERT;https://www.us-cert.gov/ncas/alerts/TA18-149A;2018-05-30 00:00:00;75;Florian Roth;APT,EXE,FILE;22854bce2a4cb9668af7560676ef3f5b
APT_TA18_149A_Joanap_Sample2;Detects malware from TA18-149A report by US-CERT;https://www.us-cert.gov/ncas/alerts/TA18-149A;2018-05-30 00:00:00;75;Florian Roth;APT,EXE,FILE;825dcfc720d736eb38b391ac567b8ac7
APT_TA18_149A_Joanap_Sample3;Detects malware from TA18-149A report by US-CERT;https://www.us-cert.gov/ncas/alerts/TA18-149A;2018-05-30 00:00:00;75;Florian Roth;APT,EXE,FILE;41361f529408f78752ef4dafa298f688
APT_Thrip_Sample_Jun18_10;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;5505225b0656a48ae0080f2505d5b125
APT_Thrip_Sample_Jun18_11;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;68fbc87a090b4657e9320f4c1fdeee0c
APT_Thrip_Sample_Jun18_12;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;310659f9e5facfca8b57015698c845f2
APT_Thrip_Sample_Jun18_13;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;97686ef26597255211b1f013a1769fa7
APT_Thrip_Sample_Jun18_14;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;b3229a509922511aa17d441bcf60bd9c
APT_Thrip_Sample_Jun18_15;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;4eafdd297e00ce45c3bda4f9fecc4ec5
APT_Thrip_Sample_Jun18_16;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;6624479e657a33b7d8b4b9f5551e66df
APT_Thrip_Sample_Jun18_17;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;48e6e9e05e9fd58b3e0244976ee9b947
APT_Thrip_Sample_Jun18_18;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;f82008ea0e930ee78eebf40fe7b06a4b
APT_Thrip_Sample_Jun18_1;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;bd85d955f29d90efa1892523481d92f9
APT_Thrip_Sample_Jun18_2;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;072da4a7c4a18fed64e26f24b80e4ab8
APT_Thrip_Sample_Jun18_3;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;681acf80e792f90a6a57a6760ab13cb0
APT_Thrip_Sample_Jun18_4;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;d6f4818c1ca83ffcf25ad91bffb1a41f
APT_Thrip_Sample_Jun18_5;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;59d58dd876e31e1f0a48f76b81af0ebc
APT_Thrip_Sample_Jun18_6;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;885b0ef5472feabc36e6adab633f2c12
APT_Thrip_Sample_Jun18_7;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;aa6534d29321a7604e7002e67f0c399b
APT_Thrip_Sample_Jun18_8;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT;5e0c7a650501521d8f076b6a19948892
APT_Thrip_Sample_Jun18_9;Detects sample found in Thrip report by Symantec ;https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets ;2018-06-21 00:00:00;75;Florian Roth;APT,EXE,FILE;76cb7ecfbd2b761cfaabae73666adcc0
APT_Tick_HomamDownloader_Jun18;Detects HomamDownloader from Tick group incident - Weaponized USB;https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/;2018-06-23 00:00:00;75;Florian Roth;APT,EXE,FILE;aaf3cf99c4ad24675325ad060e4abfe2
APT_Tick_Sysmon_Loader_Jun18;Detects Sysmon Loader from Tick group incident - Weaponized USB;https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/;2018-06-23 00:00:00;75;Florian Roth;APT,EXE,FILE;2eee100ad35b654d3ba0795089b42612
APT_WebShell_AUS_4;Detetcs a webshell involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT,FILE;b917ec27375f65f4d5456997b9908c85
APT_WebShell_AUS_5;Detetcs a webshell involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT,FILE;c7da99b5ca7eaea74482829f77f3774d
APT_WebShell_AUS_JScript_3;Detetcs a webshell involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT,FILE;f2f38cd4ee8bcf9bfc9850b3149e7d96
APT_WebShell_AUS_Tiny_2;Detetcs a tiny webshell involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT,FILE;e8372bb28854117dc39430efa0b534f2
APT_WebShell_Tiny_1;Detetcs a tiny webshell involved in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;APT,FILE;5290299f5b4360e6da135e2a1ee34fb7
Acrotray_Anomaly;Detects an acrotray.exe that does not contain the usual strings;-;1970-01-01 01:00:00;75;Florian Roth;EXE,EXTVAR,FILE;bffe62c85ccfa49006d6bbe06d9baf84
Ammyy_Admin_AA_v3;Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe;http://goo.gl/gkAg2E;2014-12-22 00:00:00;55;Florian Roth;APT,HKTL;d420ca5201d66d9d520a658a4dbe421f
Apolmy_Privesc_Trojan;Apolmy Privilege Escalation Trojan used in APT Terracotta;https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/;2015-08-04 00:00:00;80;Florian Roth;APT,EXE,FILE,MAL;6b74ccbc60c1398e63ef6a08a5e74924
AppInitHook;AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll;https://goo.gl/Z292v6;2015-07-15 00:00:00;70;Florian Roth;EXE,FILE,HKTL;d1019ac2912b8dc185a884d738c56031
Asmodeus_v0_1_pl;Semi-Auto-generated - file Asmodeus v0.1.pl.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;e2a204a3975937fc43b7f0a264677bf0
Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html;Semi-Auto-generated - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.html.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;d3b0d31d04723d2407bc273d51288458
BTC_Miner_lsass1_chrome_2;Detects a Bitcoin Miner;Internal Research - CN Actor;2017-06-22 00:00:00;60;Florian Roth;EXE,FILE;f7838095e37a2ad5a410e418e87e214c
Backdoor_Naikon_APT_Sample1;Detects backdoors related to the Naikon APT;https://goo.gl/7vHyvh;2015-05-14 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;22e277065a8ea627431a93c28ea6bdc4
Backdoor_Nitol_Jun17;Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader;https://goo.gl/OOB3mH;2017-06-04 00:00:00;75;Florian Roth;EXE,FILE,MAL;5d207e77c56ebc6b53574b09bd29c83b
Beastdoor_Backdoor;Detects the backdoor Beastdoor;-;1970-01-01 01:00:00;55;Florian Roth;HKTL,MAL;b8047562af97b679d7737b840eea7423
BeepService_Hacktool;Detects BeepService Hacktool used by Chinese APT groups;https://goo.gl/p32Ozf;2016-05-12 00:00:00;85;Florian Roth;APT,CHINA,EXE,FILE,HKTL;eee10cf930f59c6d6c602cd8f5ead919
BergSilva_Malware;Detects a malware from the same author as the Indetectables RAT;-;2015-10-01 00:00:00;75;Florian Roth;EXE,FILE,MAL;8a14ff87bf0cee341fbd91e26ec1018d
BlackEnergy_BackdoorPass_DropBear_SSH;Detects the password of the backdoored DropBear SSH Server - BlackEnergy;http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/;2016-01-03 00:00:00;75;Florian Roth;EXE,FILE,MAL,RUSSIA;9006c661b82b57c4b78be4d572bd23cc
BlackEnergy_Driver_AMDIDE;Black Energy Malware;http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/;2016-01-04 00:00:00;75;Florian Roth;EXE,FILE,MAL;66749239f5e86e51ba5642ffcc860ace
BlackEnergy_Driver_USBMDM;Black Energy Driver;http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/;2016-01-04 00:00:00;75;Florian Roth;EXE,FILE;8105b175ff7021c6bfd299865035b4b8
Buckeye_Osinfo;Detects OSinfo tool used by the Buckeye APT group;http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong;2016-09-05 00:00:00;75;Florian Roth;APT,EXE,FILE;2878db44d4806f50798dc3b3efbe5f31
CHAOS_Payload;Detects a CHAOS back connect payload;https://github.com/tiagorlampert/CHAOS;2017-07-15 00:00:00;80;Florian Roth;EXE,FILE;0c72ad990063eb233e99e87093e91aff
CN_Hacktool_1433_Scanner;Detects a chinese MSSQL scanner;-;2014-12-10 00:00:00;40;Florian Roth;EXE,FILE,HKTL;7f59ccb8b168f9e0a3ef2cbf00092fe0
CN_Hacktool_1433_Scanner_Comp2;Detects a chinese MSSQL scanner - component 2;-;2014-12-10 00:00:00;40;Florian Roth;EXE,FILE,HKTL;0e12d0e502789cf30f84daae14f2c811
CN_Hacktool_BAT_PortsOpen;Detects a chinese BAT hacktool for local port evaluation;-;2014-12-10 00:00:00;60;Florian Roth;HKTL;8ef582b067a26e9cdf7519d0852087e2
CN_Hacktool_MilkT_BAT;Detects a chinese Portscanner named MilkT - shipped BAT;-;2014-12-10 00:00:00;70;Florian Roth;HKTL;08ed5dd7133b3dd666844d7a828eda3c
CN_Hacktool_MilkT_Scanner;Detects a chinese Portscanner named MilkT;-;2014-12-10 00:00:00;60;Florian Roth;HKTL;6a2b71583c732208457e1a8459e433e4
CN_Hacktool_SSPort_Portscanner;Detects a chinese Portscanner named SSPort;-;2014-12-10 00:00:00;70;Florian Roth;HKTL;eaec49fce24482fc8a60b22e4adcc3d1
CN_Hacktool_S_EXE_Portscanner;Detects a chinese Portscanner named s.exe;-;2014-12-10 00:00:00;70;Florian Roth;HKTL;ca871abc82d2d9db972ab9f1b0669fce
CN_Hacktool_ScanPort_Portscanner;Detects a chinese Portscanner named ScanPort;-;2014-12-10 00:00:00;70;Florian Roth;HKTL;2ad0de002a7d863790547c239bea9359
CN_Toolset_LScanPortss_2;Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe;http://qiannao.com/ls/905300366/33834c0c/;2015-03-30 00:00:00;70;Florian Roth;CHINA,HKTL;0ddc973cf63fc297a209e287dae9d459
CN_Toolset_NTscan_PipeCmd;Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe;http://qiannao.com/ls/905300366/33834c0c/;2015-03-30 00:00:00;70;Florian Roth;CHINA,HKTL;4df9c32d374e9b326b7c84136ce1d5a8
CN_Toolset__XScanLib_XScanLib_XScanLib;Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll;http://qiannao.com/ls/905300366/33834c0c/;2015-03-30 00:00:00;70;Florian Roth;CHINA,HKTL;49c5f68941cf3c37a02313e44d0f53cc
CN_Toolset_sig_1433_135_sqlr;Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe;http://qiannao.com/ls/905300366/33834c0c/;2015-03-30 00:00:00;70;Florian Roth;CHINA,HKTL;196fdd5c3f2190e74b80abb73fc5c9a5
COZY_FANCY_BEAR_modified_VmUpgradeHelper;Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report;https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/;2016-06-14 00:00:00;75;Florian Roth;EXE,EXTVAR,FILE,RUSSIA;7afa3db027f0568fec52ea7d757d87f4
COZY_FANCY_BEAR_pagemgr_Hunt;Detects a pagemgr.exe as mentioned in the CrowdStrike report;https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/;2016-06-14 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;60373e22d0f11c0c647932105e5f5735
CVE_2014_4076_Exploitcode;Detects an exploit code for CVE-2014-4076;https://github.com/Neo23x0/yarGen;2018-04-04 00:00:00;75;Florian Roth;EXE,EXPLOIT,FILE;00f42062a6535dee548150ea846e1904
CVE_2015_1674_CNGSYS;Detects exploits for CVE-2015-1674;http://www.binvul.com/viewthread.php?tid=508;2015-05-14 00:00:00;75;Florian Roth;EXE,EXPLOIT,FILE;e836fcc4432f2ecf8f45da76bd8f9304
CVE_2017_11882_RTF;Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882;Internal Research;2018-02-13 00:00:00;60;Florian Roth;EXPLOIT,FILE;ef27d0b93df82ef201724ade2ae2273b
CVE_2017_8759_SOAP_Excel;Detects malicious files related to CVE-2017-8759;https://twitter.com/buffaloverflow/status/908455053345869825;2017-09-15 00:00:00;60;Florian Roth;EXPLOIT,OFFICE;e31482bbeea9488a2661118446a35eb8
Casper_Included_Strings;Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo;http://goo.gl/VRJNLo;2015-03-06 00:00:00;50;Florian Roth;EXE,FILE,MAL;508b869f2e152518fb5d439b8a4b20a2
Casper_SystemInformation_Output;Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo;http://goo.gl/VRJNLo;2015-03-06 00:00:00;70;Florian Roth;MAL;fc27fd8f4cc505734516241907b065b2
Chafer_Exploit_Copyright_2017;Detects Oilrig Internet Server Extension with Copyright (C) 2017 Exploit;https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf;2018-03-22 00:00:00;75;Markus Neis;EXE,FILE,MIDDLE_EAST;a8e4b99feb76c0df7a72b3b748679c5a
Chafer_Mimikatz_Custom;Detects Custom Mimikatz Version;https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf;2018-03-22 00:00:00;75;Florian Roth / Markus Neis;EXE,FILE,MIDDLE_EAST;166ac77cb3969436b74d66d7f8b97c70
Chafer_Packed_Mimikatz;Detects Oilrig Packed Mimikatz also detected as Chafer_WSC_x64 by FR;https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf;2018-03-22 00:00:00;75;Florian Roth / Markus Neis;EXE,FILE,MIDDLE_EAST;a7db6463555c66249169c9de91d77e13
Chafer_Portscanner;Detects Custom Portscanner used by Oilrig;https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf;2018-03-22 00:00:00;75;Markus Neis;EXE,FILE,MIDDLE_EAST;9a3b7aac5d412481c090713f894ac069
ChromePass;Detects a tool used by APT groups - file ChromePass.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE;0058dc2c95cd61621ae7587c74518982
Cloaked_as_JPG;Detects a cloaked file as JPG;-;2015-02-28 00:00:00;40;Florian Roth (eval section from Didier Stevens);EXTVAR,FILE;90d470799467e72c928763273235d079
CmdAsp_asp;Semi-Auto-generated - file CmdAsp.asp.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;b407964cce301d5b119c24db06a2acb2
CmdShell64;Chinese Hacktool Set - file CmdShell64.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;37efdfc1d967c7ca77311447873612c9
Cmdshell32;Chinese Hacktool Set - file Cmdshell32.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;f5fa9d17853739cc4f6e74041ea4e4f8
CobaltGang_Malware_Aug17_1;Detects a Cobalt Gang malware;https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c;2017-08-09 00:00:00;75;Florian Roth;EXE,FILE,MAL;b2b8fe82b87faa1d62c290ca18422c8a
CobaltGang_Malware_Aug17_2;Detects a Cobalt Gang malware;https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c;2017-08-09 00:00:00;75;Florian Roth;EXE,FILE,MAL;d36380a856a0ab9616fec8184cc90c66
CobaltStrike_CN_Group_BeaconDropper_Aug17;Detects Script Dropper of Cobalt Gang used in August 2017;Internal Research;2017-08-09 00:00:00;75;Florian Roth;MAL;4b85986fe24cde65221cff42ad3f7694
Cobaltgang_PDF_Metadata_Rev_A;Find documents saved from the same potential Cobalt Gang PDF template;https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/;2018-10-25 00:00:00;75;Palo Alto Networks Unit 42;;d771a9e6ba5d11e23c565b52cfe785e5
CoinMiner_Strings;Detects mining pool protocol string in Executable;https://minergate.com/faq/what-pool-address;2018-01-04 00:00:00;50;Florian Roth;;0376a5f767eae520701d2f90d49a36f7
CoreImpact_sysdll_exe;Detects a malware sysdll.exe from the Rocket Kitten APT;-;2014-12-27 00:00:00;70;Florian Roth;APT,MIDDLE_EAST;e758e0de0674ded55ae4e035dc4a1641
CredentialStealer_Generic_Backdoor;Detects credential stealer byed on many strings that indicate password store access;Internal Research;2017-06-07 00:00:00;75;Florian Roth;EXE,FILE,GEN,MAL;8783d298ba001abc08aa5dc32383f3ee
Customize;Chinese Hacktool Set - file Customize.aspx;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;00e8c27ceb39d9d30d176fa274657d30
Customize_2;Chinese Hacktool Set - file Customize.jsp;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;332988e785373430636837524c1e80c7
DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;7955b61923d939e26295faebf5f08997
DarkComet_Keylogger_File;Looks like a keylogger file created by DarkComet Malware;-;2014-07-25 00:00:00;50;Florian Roth;FILE,HKTL,MAL;02e873f4adf37c54594a9e34c65b3f91
DarkEYEv3_Cryptor;Rule to detect DarkEYEv3 encrypted executables (often malware);http://darkeyev3.blogspot.fi/;2015-05-24 00:00:00;55;Florian Roth;EXE,FILE;0dbe69f1711caa056c04ea022a2f94d8
DarkSecurityTeam_Webshell;Dark Security Team Webshell;-;1970-01-01 01:00:00;50;Florian Roth;WEBSHELL;287d0d9b079e437164326890200251bb
Daserf_Nov1_BronzeButler;Detects Daserf malware used by Bronze Butler;https://goo.gl/ffeCfd;2017-11-08 00:00:00;75;Florian Roth;EXE,FILE;1a2e59a16103002c417ebd9405777a79
DeepPanda_Trojan_Kakfum;Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll;-;2015-02-08 00:00:00;75;Florian Roth;CHINA,MAL;4dcd758d4ec3ae58da77ba1b594db1f0
DeepPanda_htran_exe;Hack Deep Panda - htran-exe;-;2015-02-08 00:00:00;75;Florian Roth;CHINA;b945cd4ac408326375d2788d5a10b76f
DeepPanda_lot1;Hack Deep Panda - lot1.tmp-pwdump;-;2015-02-08 00:00:00;75;Florian Roth;CHINA;81138d1ebad2ed4de9c93f6196797858
DeepPanda_sl_txt_packed;Hack Deep Panda - ScanLine sl-txt-packed;-;2015-02-08 00:00:00;75;Florian Roth;CHINA;fc53e2d0d744abfe0b47fe0c02e96892
DefaceKeeper_0_2_php;Semi-Auto-generated - file DefaceKeeper_0.2.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;e381cba4bbf69722a703222f6e19c9ca
Derusbi_Backdoor_Mar17_1;Detects a variant of the Derusbi backdoor;Internal Research;2017-03-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;840583059cdfc5e3f0d1885e40a9cb2f
Derusbi_Code_Signing_Cert;Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious;http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family;2015-12-15 00:00:00;60;Florian Roth;EXE,FILE,MAL;6825d00a1f11e7fdaab6f6b4f9a49ae9
DeviceGuard_WDS_Evasion;Detects WDS file used to circumvent Device Guard;http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html;1970-01-01 01:00:00;80;Florian Roth;OBFUS;cb4573bc612bc3be444cb037b0dabb1d
Dexter_Malware;Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b;http://goo.gl/oBvy8b;2015-02-10 00:00:00;70;Florian Roth;MAL;d2dfa50d329079da20d64cdf9e7201be
Dive_Shell_1_0___Emperor_Hacking_Team_php;Semi-Auto-generated - file Dive Shell 1.0 - Emperor Hacking Team.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;9fb8c63b434029f4c253afae5d136503
DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;5725a6161ef6ab41f3415acd28bbe171
Dll_LoadEx;Chinese Hacktool Set - file Dll_LoadEx.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;e350443a78dbea2e37af1c0eed6155cf
Docm_in_PDF;Detects an embedded DOCM in PDF combined with OpenAction;Internal Research;2017-05-15 00:00:00;75;Florian Roth;FILE;8591203da3bb272c29e9b084e9db1b4b
DomainScanV1_0;Auto-generated rule on file DomainScanV1_0.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;db400263a64c6890331b1ac664ab41df
Dos_1;Chinese Hacktool Set - file 1.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d0725a81879d3308ac7518179bfd1f0b
Dos_Down32;Chinese Hacktool Set - file Down32.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;736febecdb790c495ceb24d188b0750a
Dos_Down64;Chinese Hacktool Set - file Down64.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;7bee9f6409898b7e6cb32f4f89432771
Dos_GetPass;Chinese Hacktool Set - file GetPass.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;aa6e1d90f2e7aed657b99e383b323f85
Dos_NtGod;Chinese Hacktool Set - file NtGod.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;2e5533b6c0e50cd56016e5132146ee79
Dos_c;Chinese Hacktool Set - file c.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;b16928f4f2a406788a99e90b933afae5
Dos_ch;Chinese Hacktool Set - file ch.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d42a9077eb29661a2680863348992d45
Dos_fp;Chinese Hacktool Set - file fp.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;1f88d629ef127a20298070ae85d16902
Dos_iis7;Chinese Hacktool Set - file iis7.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;573a12eb9749981f13f13e44f5251747
Dos_iis;Chinese Hacktool Set - file iis.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;1bf9342b909fb80fe5efe5c0391c1f87
Dos_lcx;Chinese Hacktool Set - file lcx.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;60f1c514beeda7798fe7b94a80881cc6
Dos_look;Chinese Hacktool Set - file look.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;b42d4ad1d0136cbaf5ee1e0f9e211ccd
Dos_netstat;Chinese Hacktool Set - file netstat.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;84a38f46dc22c0feb0fe7bae1a5ed5ba
Dos_sys;Chinese Hacktool Set - file sys.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d83d40b264e8f142eced140de3777737
DragonFly_APT_Sep17_1;Detects malware from DrqgonFly APT report;https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group;2017-09-12 00:00:00;75;Florian Roth;APT,EXE,FILE;041389263d30bea7f856e6489fa72aae
DragonFly_APT_Sep17_2;Detects malware from DrqgonFly APT report;https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group;2017-09-12 00:00:00;75;Florian Roth;APT,EXE,FILE;2bf6250527b5d68ad5a5d96a9cf751ca
DragonFly_APT_Sep17_3;Detects malware from DrqgonFly APT report;https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group;2017-09-12 00:00:00;75;Florian Roth;APT,EXE,FILE;f1d6e70129f7341627c6d1b688214034
DragonFly_APT_Sep17_4;Detects malware from DrqgonFly APT report;https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group;2017-09-12 00:00:00;75;Florian Roth;APT,EXE,FILE;8884eaf6d00828032e2b42941b94f937
Dridex_Trojan_XML;Dridex Malware in XML Document;https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503;2015-03-08 00:00:00;75;Florian Roth @4nc4p;MAL;5a60b02253161fcb1335f0cc4674fc14
DropBear_SSH_Server;Detects DropBear SSH Server (not a threat but used to maintain access);http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/;2016-01-03 00:00:00;50;Florian Roth;EXE,FILE,RUSSIA;c5d92dd2239d05b6ab8544cfa0f093f8
Dropper_DeploysMalwareViaSideLoading;Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX;https://www.us-cert.gov/ncas/alerts/TA17-117A;1970-01-01 01:00:00;75;USG;MAL;14a3885d08ca41b61841483ee4bd92cc
Dubnium_Sample_1;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;cc337bbc7abd167e2e3e34a439a51847
Dubnium_Sample_2;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;96e4ba0245bbb1298ca68e102a38556c
Dubnium_Sample_3;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;8470ed9aaa85e62ec098196f89f20a70
Dubnium_Sample_5;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;2ec97c979ec36f70de8602f425272178
Dubnium_Sample_6;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;8b4afa47172c15876d2a122c47469fad
Dubnium_Sample_7;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;d842e5cd26af008835fcbd4c12b56749
Dubnium_Sample_SSHOpenSSL;Detects sample mentioned in the Dubnium Report;https://goo.gl/AW9Cuu;2016-06-10 00:00:00;75;Florian Roth;EXE,FILE;a56308d4ac87c8e82ac8c55864b5dbfd
Duqu2_UAs;Detects Duqu2 Executable based on the specific UAs in the file;https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/;2016-07-02 00:00:00;80;Florian Roth;EXE,FILE;71c00df0e48e2f62ee4667642347c535
EldoS_RawDisk;EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0);https://goo.gl/jKIfGB;2016-12-01 00:00:00;50;Florian Roth (with Binar.ly);EXE,FILE,MIDDLE_EAST;ce1afeb11c3dfbc0d48b5820678fece6
Embedded_EXE_Cloaking;Detects an embedded executable in a non-executable file;-;2015-02-27 00:00:00;65;Florian Roth;EXTVAR;5d0c8c79c9da3ffe4c788b52d30e605e
Empire_invoke_wmi;Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py;https://github.com/PowerShellEmpire/Empire;2015-08-06 00:00:00;70;Florian Roth;SCRIPT;fae411c5405ca0609834ac83cc74f497
Empire_lib_modules_credentials_mimikatz_pth;Empire - a pure PowerShell post-exploitation agent - file pth.py;https://github.com/PowerShellEmpire/Empire;2015-08-06 00:00:00;70;Florian Roth;SCRIPT;c5e17daffaf8721d2fd0460251b0eede
Empire_lib_modules_trollsploit_message;Empire - a pure PowerShell post-exploitation agent - file message.py;https://github.com/PowerShellEmpire/Empire;2015-08-06 00:00:00;70;Florian Roth;SCRIPT;c67c8a7679e2a9f0eebc00d6c9655201
Empire_portscan;Empire - a pure PowerShell post-exploitation agent - file portscan.py;https://github.com/PowerShellEmpire/Empire;2015-08-06 00:00:00;70;Florian Roth;SCRIPT;18a34460b5845afbdce198aed2fc0c73
Empire_skeleton_key;Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py;https://github.com/PowerShellEmpire/Empire;2015-08-06 00:00:00;70;Florian Roth;SCRIPT;36fc680ade21f8fa5f57e972b31f9900
Enfal_Malware;Detects a certain type of Enfal Malware;not set;2015-02-10 00:00:00;60;Florian Roth;MAL;e8d78d2acb0206721d19546f7a5538af
Enfal_Malware_Backdoor;Generic Rule to detect the Enfal Malware;-;2015-02-10 00:00:00;60;Florian Roth;EXE,FILE,GEN,MAL;44ad0725968b589df4d9b83461acc663
EnigmaPacker_Rare;Detects an ENIGMA packed executable;Internal Research;2017-04-27 00:00:00;60;Florian Roth;EXE,FILE;2e94cf82a091fc5a1509200400740835
Enigma_Protected_Malware;Detects samples packed by Enigma Protector;https://goo.gl/OEVQ9w;2017-02-03 00:00:00;75;Florian Roth with the help of binar.ly;EXE,FILE,MAL;e02b5b66e3b73fc6764e4db2fa3251b6
Enigma_Protected_Malware_May17_RhxFiles;Auto-generated rule - file RhxFiles.dll;Internal Research;2017-05-02 00:00:00;75;Florian Roth with the help of binar.ly;EXE,FILE,MAL;5b1a3673d318228ad17073ff9624185f
EquationDrug_MS_Identifier;Microsoft Identifier used in EquationDrug Platform;-;2015-03-11 00:00:00;75;Florian Roth @4nc4p;;0bc45170c2d4b50719cf029e07be5e8b
EquationGroup_Toolset_Apr17_ActiveDirectory_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b7356077f4eeddc1c3844d7683bdf469
EquationGroup_Toolset_Apr17_AdUser_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7aae3acc15a6c23491c3e63158b37eef
EquationGroup_Toolset_Apr17_Architouch_1_0_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;0d66c58cd7297d9f012fc3081355243e
EquationGroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;8d5c2c5362470228952334a3f48f65ad
EquationGroup_Toolset_Apr17_Banner_Implant9x;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;1de788df6dafb8e4e8cf12ee45c50ae2
EquationGroup_Toolset_Apr17_DS_ParseLogs;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;6fd565c99c208b5c8c8c9d277784a6ac
EquationGroup_Toolset_Apr17_Darkpulsar_1_1_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;4e70b464154eb8aa0582f601120773ff
EquationGroup_Toolset_Apr17_DiBa_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;388811d116e3bc51358ec962ccc06fbd
EquationGroup_Toolset_Apr17_DiBa_Target_2000;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a13982f21bc5caaaca6a4f2780399a25
EquationGroup_Toolset_Apr17_DiBa_Target_BH;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;764638e8cb406f38d281b699c08637f5
EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;0f945d32c236e1a9e5683c07f7c0c1b5
EquationGroup_Toolset_Apr17_DllLoad_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;fed04826969ed552ce691bc9965f3ef6
EquationGroup_Toolset_Apr17_DmGz_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;d5af3c268b01a9ef1d477ebf717e9314
EquationGroup_Toolset_Apr17_DmGz_Target_2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7c47a5e261a640d8aa9a4eb574342716
EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;f472de25fbfbbf9a85d0801ff6568355
EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_3;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;60aed6f3ce8b1cc411db52b091c07057
EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;baa3e5ec39839d0a86f6ac420f586c02
EquationGroup_Toolset_Apr17_Dsz_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;33fe8c54b266ef283a636c231048ae65
EquationGroup_Toolset_Apr17_EXPA;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;0956888b708845615394ca4ae2ebe386
EquationGroup_Toolset_Apr17_Easybee_1_0_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;05bd44b7d8917b450651b5e3e557712e
EquationGroup_Toolset_Apr17_Easypi_Explodingcan;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;9c3b95dfb6c87110a7f2bf2d4cdb6b74
EquationGroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;989424ce05f45b34d068c771a0f96343
EquationGroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;e68d37e990243af13593cf57e700c914
EquationGroup_Toolset_Apr17_Educatedscholar_1_0_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;37642ca2f3a08356a290c25963e7ca16
EquationGroup_Toolset_Apr17_Educatedscholartouch_1_0_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a2b1afc92775f381dd8876cb1e6bc98c
EquationGroup_Toolset_Apr17_Englishmansdentist_1_2_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;706d7309640198c1a123fd2cbaa9013b
EquationGroup_Toolset_Apr17_EpWrapper;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;bb7e38b9f22b8de85ddb98b2ab043755
EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;dc21bc344241e61b993940a99572f060
EquationGroup_Toolset_Apr17_Erraticgophertouch_1_0_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;28a533e088ad9660e9ad27c405f3377a
EquationGroup_Toolset_Apr17_Esteemaudit_2_1_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;6c3379a686592c46d9ef8d135d9382ce
EquationGroup_Toolset_Apr17_Esteemaudittouch_2_1_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;27abad7eb8ac03eb4e7cde100fbba10b
EquationGroup_Toolset_Apr17_Eternalromance;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;857cc98a711449837051ff218e9d25e4
EquationGroup_Toolset_Apr17_Eternalromance_2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;0ec496b73b856ffdf3a4bfb720e5f306
EquationGroup_Toolset_Apr17_Explodingcantouch_1_2_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b1a3c4c0992cdd90212a6cfcdf3c00d9
EquationGroup_Toolset_Apr17_GangsterThief_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;9b4b7de2904a4d6b60b79324aa2ca5c7
EquationGroup_Toolset_Apr17_Gen1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;9aa747526894fd276fa6f2247eaa34e5
EquationGroup_Toolset_Apr17_Gen2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;df4f2e422261cb8e4a3a9b6e9bb4da13
EquationGroup_Toolset_Apr17_Gen3;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;2b7322579100e04f0e0c39d74c43b42a
EquationGroup_Toolset_Apr17_Gen4;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b33c0b85651708e85d11c38c56f69966
EquationGroup_Toolset_Apr17_GenKey;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;6ec81a655a6e62bd302756f166ffbdad
EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;9bd47bd45ed7033c0a9aebf804b409a0
EquationGroup_Toolset_Apr17_GrDo_FileScanner_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b77ca3111c19898e498e8381f7e6b983
EquationGroup_Toolset_Apr17_Ifconfig_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7e945b244da98a32790028bdad19134a
EquationGroup_Toolset_Apr17_Iistouch_1_2_2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;6e3ae16ccf3d5e64d0e2c6afb2e99e17
EquationGroup_Toolset_Apr17_KisuComms_Target_2000;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b015209967f7d7ae3077ca810d5dc016
EquationGroup_Toolset_Apr17_Mcl_NtMemory_Std;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;9b64f40a57355e2545a7520a1c15e7ef
EquationGroup_Toolset_Apr17_Mofconfig_1_0_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;28f3226fa0204beeeb5b335f4ab8998c
EquationGroup_Toolset_Apr17_Namedpipetouch_2_0_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;010975a4b2d365a5c894764457bc4249
EquationGroup_Toolset_Apr17_Oracle_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;80b9953a2587b208a68e230ccece1381
EquationGroup_Toolset_Apr17_PC_Exploit;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;3a702857e3d6479039d8792f2bdb27f4
EquationGroup_Toolset_Apr17_PC_LP;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;eed646975c6cf416cdcf8aae889514d3
EquationGroup_Toolset_Apr17_PC_Legacy_dll;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;5d8e944d2992831ebc44ae2a4dc7b67e
EquationGroup_Toolset_Apr17_PC_Level3_Gen;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE,GEN;2612e5cdac71ef211e2e06eb3945ca50
EquationGroup_Toolset_Apr17_PC_Level3_http_exe;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;84847a051c02ae52697ea0625157af2a
EquationGroup_Toolset_Apr17_PC_Level_Generic;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE,GEN;89d8ff71af2b2d375f68dbcbaa378fef
EquationGroup_Toolset_Apr17_PacketScan_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;3258463f0e6f998f42b0dabe1ea64d41
EquationGroup_Toolset_Apr17_ParseCapture;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;d16137f74862ae0220ad505ebc51e1be
EquationGroup_Toolset_Apr17_Processes_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;cba8dba96720baeda15c13f9f376f822
EquationGroup_Toolset_Apr17_Regread_1_1_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;01ed91dcb5fabca7f3dff5ab656426b3
EquationGroup_Toolset_Apr17_RemoteCommand_Lp;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;971974f470269497d978fa01d8411c14
EquationGroup_Toolset_Apr17_RemoteExecute_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;27425e42b9ac9cd66b1ee6a3853a64f9
EquationGroup_Toolset_Apr17_RemoteExecute_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;ccfa14b55a7791e19a2df499e0a6e78f
EquationGroup_Toolset_Apr17_Rpctouch_2_1_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;22603ee6c4b4beb068f00ee0c6dc178c
EquationGroup_Toolset_Apr17_SendPKTrigger;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;68fdaccc15bcec1f88d619d44a2a623b
EquationGroup_Toolset_Apr17_SetCallback;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;5cc99f9bdfbd95d664aba8793575aa3a
EquationGroup_Toolset_Apr17_SetCallbackPorts;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;575c52463c41796f536bc56801024429
EquationGroup_Toolset_Apr17_SetOurAddr;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;1ec865afd0e5a21004a41a29484ca53a
EquationGroup_Toolset_Apr17_SetPorts;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7c38753c72ef92406543ca60a84dfa25
EquationGroup_Toolset_Apr17_SetResourceName;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;379639e6ade003f097d2fcc9e93fde8a
EquationGroup_Toolset_Apr17_Shares_Target;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b04386af8b299ff04cf7e10c7b6f626d
EquationGroup_Toolset_Apr17_SlDecoder;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;8c92eda0dc3a7a4f6cc274cd2af70d08
EquationGroup_Toolset_Apr17_Smbtouch_1_1_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;13c7e9415593c1d35cf980afae13a314
EquationGroup_Toolset_Apr17_Windows_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;1178f632d2c6d8f82dbadcd590dd6ce7
EquationGroup_Toolset_Apr17__AddResource;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;abfbf765bb3dac99f5bb81d0baf57491
EquationGroup_Toolset_Apr17__DoubleFeatureReader_DoubleFeatureReader_0;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;ba22f86f5178e2050519325aaa551931
EquationGroup_Toolset_Apr17__EAFU_ecwi_ESKE_EVFR_RPC2_4;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;0bbd0cbe1e7c57baf3a2d57da1aea25d
EquationGroup_Toolset_Apr17__ELV_ESKE_13;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;4d397415f6327dd1b84896994fc65127
EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;c63aae2e1dc378552613280c5b2f6e16
EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;d12b8b4afa30981ed48601ffe5806d39
EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;586a226b96bf1cfdd61aee4d27bfaf4a
EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b896d925bd79e724281bac78b4f8620e
EquationGroup_Toolset_Apr17__ESKE_RPC2_8;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7f48440dd35d534f09eef2676d7aadc2
EquationGroup_Toolset_Apr17__ETBL_ETRE_10;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;ed72136f0914236cee8619a902bd24ae
EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;792d2698751621181755648da1501c48
EquationGroup_Toolset_Apr17__Emphasismine;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;515fb76bb78d2f7fdd538d206f811cf0
EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;199bfc46ffcde4d131c89c4eaf7aad43
EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;444337a634db7cbdb2c185b71f789daa
EquationGroup_Toolset_Apr17__SendCFTrigger_SendPKTrigger_6;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;05c62adbbcf90da8e53317889129d85f
EquationGroup_Toolset_Apr17__ecwi_ESKE_EVFR_RPC2_2;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;15087343cbc48daf3a85154a22f05f05
EquationGroup_Toolset_Apr17__vtuner_vtuner_1;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b0dae39138eca8d21cfa93cf9ca86143
EquationGroup_Toolset_Apr17_clocksvc;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;fc0a309581335db0d4793bef652a4ad3
EquationGroup_Toolset_Apr17_drivers_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;efa68f1e327141c8d9bb6c51fec034d9
EquationGroup_Toolset_Apr17_greatdoc_dll_config;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;464158b540f16b8b1b7689e619323d2f
EquationGroup_Toolset_Apr17_lp_mstcp;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a6455048c9a5419b15e3d76596456bfb
EquationGroup_Toolset_Apr17_msgkd_msslu64_msgki_mssld;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;4dd2318780233dcbbc581c7c22f61cce
EquationGroup_Toolset_Apr17_msgks_mskgu;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;7bc5b0809dcce5a3f137ee77fae3a444
EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;fbdb5b7e19e22b2d37125dbe73126301
EquationGroup_Toolset_Apr17_ntevt;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a6a0d65030e5649d839fd735fb2f1073
EquationGroup_Toolset_Apr17_ntfltmgr;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;660989497995efb8c531e686713e0b7c
EquationGroup_Toolset_Apr17_promiscdetect_safe;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;47d6fa8a3b0cb849f41d37931edc1249
EquationGroup_Toolset_Apr17_put_Implant9x;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;ca9cae6d1e1f329bbcedd38eb64fd763
EquationGroup_Toolset_Apr17_pwd_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;221b93c5d228c3a7592c398120b805c1
EquationGroup_Toolset_Apr17_rc5;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;41d121343b7d73773dea874878e3c34c
EquationGroup_Toolset_Apr17_regprobe;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;2c8aa954e58c7099e90430698d21d430
EquationGroup_Toolset_Apr17_renamer;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;106a6ee3d141eed69ebad41faac22b2c
EquationGroup_Toolset_Apr17_scanner;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;b4729cd00720fd4f6d0ce01484012b04
EquationGroup_Toolset_Apr17_st_lp;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;4fb31bbcd5d00936c88852c0272ca08f
EquationGroup_Toolset_Apr17_svctouch;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;567618e015415d759aae51d26b450875
EquationGroup_Toolset_Apr17_tacothief;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a830db478b5e1904ef1906d3b9ace7fb
EquationGroup_Toolset_Apr17_wmi_Implant;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;a400e12ff31c97f6be02a289e79a3735
EquationGroup_Toolset_Apr17_xxxRIDEAREA;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;6472cc3a38af094eeaf66811e6757cb3
EquationGroup_Toolset_Apr17_yak;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;e3cd27eacf597e496ba46ff0123db4ba
EquationGroup_Toolset_Apr17_yak_min_install;Detects EquationGroup Tool - April Leak;https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation;2017-04-15 00:00:00;75;Florian Roth;EXE,FILE;2f6453ea63d03b4b0a63708b17fad7ed
EquationGroup__ftshell;Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;f88e054eb2f98b07227534fda5d33a3b
EquationGroup__ftshell_ftshell_v3_10_3_0;Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;e27684c1b964de88273525328e05eede
EquationGroup__funnelout_v4_1_0_1;Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;d8f05177e79ccbb0b24b76da425429bf
EquationGroup__ghost_sparc_ghost_x86_3;Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;185ff0e54027b5a22293763ccc427a9c
EquationGroup__jparsescan_parsescan_5;Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;50a686d09c2e759360c6cd02321d7e9f
EquationGroup__magicjack_v1_1_0_0_client;Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;73341b040a293c76e7ad301d3b34371c
EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4;Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;aed6ef9aa0b36f9c67ca60fb0013c438
EquationGroup__scanner_scanner_v2_1_2;Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;7b6e303c108264a88cfd1a660fa01de9
EquationGroup_calserver;Equation Group hack tool leaked by ShadowBrokers- file calserver;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;662083f8caf6dc4e63a260d8b5c0aa7e
EquationGroup_charm_saver_win2k_v_2_0_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;337cf049bfed0384e624dffbcdc81eaf
EquationGroup_cmsd;Equation Group hack tool leaked by ShadowBrokers- file cmsd;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;82aff8b3fb6fa34eaaaac7f147cc9e73
EquationGroup_cmsex;Equation Group hack tool leaked by ShadowBrokers- file cmsex;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;84c5b6d19ae2b7a7816cd839b7cc182b
EquationGroup_cryptTool;Equation Group hack tool leaked by ShadowBrokers- file cryptTool;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;21d4db180fdedfbb898763f10a9385d3
EquationGroup_curseflower_mswin32_v_1_0_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;f6115a74ada4c081b30d897cba74fee0
EquationGroup_cursehappy_win2k_v_6_1_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;2340eca6c15849bc662a84918b2019fa
EquationGroup_cursehelper_win2k_i686_v_2_2_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;ff4c0083ead631aedde343b1bfc37034
EquationGroup_curseroot_win2k_v_2_1_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;02abf0e8135cb95419905d16e5679979
EquationGroup_cursesleepy_mswin32_v_1_0_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;8c5ba6f57696417ee0d74db26ef7ff39
EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;aaf262f720218a8cb5363f36344728cb
EquationGroup_cursewham_curserazor_cursezinger_curseroot_win2k;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;115ad255134fcdaf2710431c348d9560
EquationGroup_curseyo_win2k_v_1_0_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;EXE,FILE;40a532a12356e2b7f6bfe0b64d516b57
EquationGroup_cursezinger_linuxrh7_3_v_2_0_0;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;FILE;c56b59b03c5c664e6dbbd3d1c214afe0
EquationGroup_dumppoppy;Equation Group hack tool leaked by ShadowBrokers- file dumppoppy;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;52adab9be80a11a52403f199adc81616
EquationGroup_ebbisland;Equation Group hack tool leaked by ShadowBrokers- file ebbisland;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;5751dfff8e03cb21ac4ffc4743c244ed
EquationGroup_ebbshave;Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;8c9e67e3bdb36bfaa21ed0441bbfdd49
EquationGroup_eggbasket;Equation Group hack tool leaked by ShadowBrokers- file eggbasket;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;a1543c0579cb2aff126c59301669dfe8
EquationGroup_eh_1_1_0;Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;72a1cdb31bf653d236c3174253ae81f4
EquationGroup_elatedmonkey_1_0_1_1;Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;2d0226c0d1bbeca40f7541acc78de960
EquationGroup_electricslide;Equation Group hack tool leaked by ShadowBrokers- file electricslide;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;bb7f7662d4e40c35f49cfd26bfaf8bcb
EquationGroup_elgingamble;Equation Group hack tool leaked by ShadowBrokers- file elgingamble;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;ef5b6d9324e86e442e489e9d85e3a308
EquationGroup_emptycriss;Equation Group hack tool leaked by ShadowBrokers- file emptycriss;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;432be1a50b4db57f3f58c49df26b1d54
EquationGroup_envisioncollision;Equation Group hack tool leaked by ShadowBrokers- file envisioncollision;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;8ef60df99720313bcee319e943059d66
EquationGroup_envoytomato;Equation Group hack tool leaked by ShadowBrokers- file envoytomato;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;9ce659d819e264cf98bec9d5d13358a7
EquationGroup_epoxyresin_v1_0_0;Equation Group hack tool leaked by ShadowBrokers- file epoxyresin.v1.0.0.1;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;8900a6adb1521fe33f1589f5eb10b15a
EquationGroup_estesfox;Equation Group hack tool leaked by ShadowBrokers- file estesfox;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;49d1c5133034ee666c67d0a86ffeef84
EquationGroup_estopmoonlit;Equation Group hack tool leaked by ShadowBrokers- file estopmoonlit;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;e19ea12e699972247b8540855783a271
EquationGroup_evolvingstrategy_1_0_1;Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;6898e2c79fbdd39846d9c31437c59c89
EquationGroup_ewok;Equation Group hack tool leaked by ShadowBrokers- file ewok;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;699aaae8212224474d565d94c85668e8
EquationGroup_exze;Equation Group hack tool leaked by ShadowBrokers- file exze;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;250d04616bdf51ef957517803aacedc5
EquationGroup_gr;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;;26ccd5b38b31f1edd893fa066255bf17
EquationGroup_gr_dev_bin_now;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;;74cec48099854ebea1f8cf4c938ebb0b
EquationGroup_gr_dev_bin_post;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;;f92fa0540f27bfd1295bc740883e8240
EquationGroup_jackpop;Equation Group hack tool leaked by ShadowBrokers- file jackpop;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;16f9fc72ef538421918346856fe51017
EquationGroup_jparsescan;Equation Group hack tool leaked by ShadowBrokers- file jparsescan;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;12e46c85667ffe8ca31955f84fa09ea6
EquationGroup_jscan;Equation Group hack tool leaked by ShadowBrokers- file jscan;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;HKTL;723d7a648ad32f79c61e36cbaeb4e370
EquationGroup_libXmexploit2;Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;cd6cf0f1d7fdbd6147ccc984d645df3b
EquationGroup_linux_exactchange;Equation Group hack tool set;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-09 00:00:00;75;Florian Roth;FILE;dd1a684c26edaa331ac29731ff5aaaf9
EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0;Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py;https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1;2017-04-08 00:00:00;75;Florian Roth;FILE,HKTL;c649212bf95d99daee81c68618f50fb9
Equation_Kaspersky_SuspiciousString;Equation Group Malware - suspicious string found in sample;http://goo.gl/ivt8EW;2015-02-17 00:00:00;60;Florian Roth;EXE,FILE,MAL;b1537463111916954a88570ba5a36974
Exe_Cloaked_as_ThumbsDb;Detects an executable cloaked as thumbs.db - Malware;-;2014-07-18 00:00:00;50;Florian Roth;EXE,EXTVAR,FILE,MAL;dabe73be07c4808e40120a4b9f8da19f
Exp_EPS_CVE20152545;Detects EPS Word Exploit CVE-2015-2545;Internal Research - ME;2017-07-19 00:00:00;70;Florian Roth;EXPLOIT,FILE,OFFICE;d8bc44ff431898d0ec449f67cc7898d1
FE_LEGALSTRIKE_MACRO;This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7.;-;2017-06-02 00:00:00;75;Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth;;20f49f718a4278bd6d36a7ef6a22a3c4
FE_LEGALSTRIKE_RTF;Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom;-;2017-06-02 00:00:00;75;joshua.kim@FireEye. - modified by Florian Roth;EXPLOIT,FILE;1db43b0047aac1cdf88a6cc5b26b9e30
FIN7_Backdoor_Aug17;Detects Word Dropper from Proofpoint FIN7 Report;https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor;2017-08-04 00:00:00;75;Florian Roth;EXE,FILE,MAL,OFFICE,RUSSIA;4b2fa16e5bc451e352ad5fefa8110582
FIN7_Dropper_Aug17;Detects Word Dropper from Proofpoint FIN7 Report;https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor;2017-08-04 00:00:00;75;Florian Roth;FILE,MAL,OFFICE,RUSSIA;83a4f7075ee7380a1fee40157a6e8e20
FVEY_ShadowBroker_Auct_Dez16_Strings;String from the ShodowBroker Files Screenshots - Dec 2016;https://bit.no.com:43110/theshadowbrokers.bit/post/message6/;2016-12-17 00:00:00;60;Florian Roth;EXE,FILE,HKTL;873bbc7ffaa10f1f0b507a88b242868b
FVEY_ShadowBrokers_Jan17_Screen_Strings;Detects strings derived from the ShadowBroker's leak of Windows tools/exploits;https://bit.no.com:43110/theshadowbrokers.bit/post/message7/;2017-01-08 00:00:00;75;Florian Roth;EXE,FILE,HKTL;eb06a505f5765d49cff6dc089d791416
Fake_AdobeReader_EXE;Detects an fake AdobeReader executable based on filesize OR missing strings in file;-;2014-09-11 00:00:00;50;Florian Roth;EXE,EXTVAR,FILE;6ed223a9a34e0217ffb36a9d7d63b2f1
Fake_FlashPlayerUpdaterService_EXE;Detects an fake AdobeReader executable based on filesize OR missing strings in file;-;2014-09-11 00:00:00;50;Florian Roth;EXE,EXTVAR,FILE;0a573e3600f055dfa5d50e550058e9c1
Fareit_Trojan_Oct15;Detects Fareit Trojan from Sep/Oct 2015 Wave;http://goo.gl/5VYtlU;2015-10-18 00:00:00;80;Florian Roth;EXE,FILE,MAL;861bf95fc9b7db9ce2b2783f4e106bac
FeliksPack3___Scanners_ipscan;Auto-generated rule on file ipscan.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;3824246c1082abffdff1b7d35554448e
Fidelis_Advisory_Purchase_Order_pps;Detects a string found in a malicious document named Purchase_Order.pps;http://goo.gl/ZjJyti;2015-06-09 00:00:00;75;Florian Roth;;2e1c8fee28e77bdb5f6065f0e2d5337c
Fidelis_Advisory_cedt370;Detects a string found in memory of malware cedt370r(3).exe;http://goo.gl/ZjJyti;2015-06-09 00:00:00;75;Florian Roth;;561913875b4d8d530d2f4e2ea5595f7e
Fierce2;This signature detects the Fierce2 domain scanner;-;2014-07-06 00:00:00;60;Florian Roth;HKTL;8b025f1c2147c7c14e93a0c3c280879f
Gen_Base64_EXE;Detects Base64 encoded Executable in Executable;Internal Research;2017-04-21 00:00:00;75;Florian Roth;EXE,FILE,GEN;4c430038702234a1c17c4c632c4942f7
Gen_Net_LocalGroup_Administrators_Add_Command;Detects an executable that contains a command to add a user account to the local administrators group;Internal Research;2017-07-08 00:00:00;75;Florian Roth;EXE,FILE,GEN;06a366ba8169c06fe9434f20e760146a
GoldDragon_Aux_File;Detects export from Gold Dragon - February 2018;https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/;2018-02-03 00:00:00;90;Florian Roth;CHINA;27f7bccaf84780a16ab91ccc4037fbfd
GoldDragon_Ghost419_RAT;Detects Ghost419 RAT from Gold Dragon report;https://goo.gl/rW1yvZ;2018-02-03 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;b8dc2e479c7716472fd03d13ca14d7f6
GoldDragon_RunnignRAT;Detects Running RAT malware from Gold Dragon report;https://goo.gl/rW1yvZ;2018-02-03 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;a40682a7cd679c5b38e6293375905607
GoldDragon_RunningRAT;Detects Running RAT from Gold Dragon report;https://goo.gl/rW1yvZ;2018-02-03 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;8ed341d9704cab0e0a449968c46e5609
GoogleBot_UserAgent;Detects the GoogleBot UserAgent String in an Executable;Internal Research;2017-01-27 00:00:00;65;Florian Roth;EXE,FILE;162919fdd9d00538d2c1eb00422ddc9a
Groups_cpassword;Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P;http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/;2015-09-08 00:00:00;50;Florian Roth;FILE;194d4a8f6d5d460aca5ab08db6274cc9
Gsecdump_password_dump_file;Detects a gsecdump output file;https://t.co/OLIj1yVJ4m;2018-03-06 00:00:00;65;Florian Roth;FILE;fe3173f05892024b04af1dd50a629a5d
HKTL_EmbeddedPDF;Detects Embedded PDFs which can start malicious content;https://twitter.com/infosecn1nja/status/1021399595899731968?s=12;2018-07-25 00:00:00;75;Tobias Michalski;FILE,HKTL;9595397ef6713b499df35a9cc1530720
HKTL_Lazagne_PasswordDumper_Dec18_1;Detects password dumper Lazagne often used by middle eastern threat groups;https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group;2018-12-11 00:00:00;85;Florian Roth;EXE,FILE,HKTL;19b29fa95bc6375a6ae34c98bec99215
HKTL_LazyCat_LogEraser;Detetcs a tool used in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;HKTL;4d2ea6ce77f3c01620a0c4cfb8a5f388
HKTL_PowerKatz_Feb19_1;Detetcs a tool used in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;HKTL;9dad892eb3185948cd94185fab356fa0
HKTL_PowerSploit;Detects default strings used by PowerSploit to establish persistence;https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100;2018-06-23 00:00:00;75;Markus Neis;HKTL;8e67b87f506dbd2236a14dfd6105859b
HKTL_Unknown_Feb19_1;Detetcs a tool used in the Australian Parliament House network compromise;https://twitter.com/cyb3rops/status/1097423665472376832;2019-02-18 00:00:00;75;Florian Roth;HKTL;72f3da6804f056fb52a5eaf0ccae6f0c
HKTL_beRootexe;Detects beRoot.exe which checks common Windows missconfigurations;https://github.com/AlessandroZ/BeRoot/tree/master/Windows;2018-07-25 00:00:00;75;yarGen Rule Generator;EXE,FILE,HKTL;faf3b3b4c281fa1a35f00eba5b1215d1
HKTL_beRootexe_output;Detects the output of beRoot.exe;https://github.com/AlessandroZ/BeRoot/tree/master/Windows;2018-07-25 00:00:00;75;Tobias Michalski;HKTL;f91e861d691e7bbb698cfd3f5c9acbc7
HKTL_htran_go;Detects go based htran variant;-;2019-01-09 00:00:00;75;Jeff Beley;EXE,FILE,HKTL;6cb106df30b2d99863218849c73c4e2a
Hacktool_This_Cruft;Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report;https://goo.gl/eFoP4A;2016-08-08 00:00:00;60;Florian Roth;EXE,FILE,HKTL;6c84bc98b3fdf8f6b28acb59b6f2d734
Hacktools_CN_445_cmd;Disclosed hacktool set - file cmd.bat;-;2014-11-17 00:00:00;60;Florian Roth;FILE,HKTL;76ecaec2e7d5176644cca8e7f646958f
Hacktools_CN_Burst_Blast;Disclosed hacktool set - file Blast.bat;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;a0f3f5373501db261a16e37614900070
Hacktools_CN_Burst_Clear;Disclosed hacktool set - file Clear.bat;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;884a3f6e94f08dd236009b7923878df6
Hacktools_CN_Burst_Start;Disclosed hacktool set - file Start.bat - DoS tool;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;99da0cf9327036ccf2b660aaa3613657
Hacktools_CN_Burst_Thecard;Disclosed hacktool set - file Thecard.bat;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;9766cdea682cce09fad700844716291f
Hacktools_CN_Burst_pass;Disclosed hacktool set - file pass.txt;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;3f8d389905d458d1561199db8a3c47f8
Hacktools_CN_Burst_sql;Disclosed hacktool set - file sql.exe;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;8ed9596e0ea59e7312c7545349bccf20
Hacktools_CN_GOGOGO_Bat;Disclosed hacktool set - file GOGOGO.bat;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;8fd012883c919042404c3a76a688d2c0
Hacktools_CN_Http;Disclosed hacktool set - file Http.exe;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;bcb41e6687608e9529ec19ce9a9d1901
Hacktools_CN_JoHor_Posts_Killer;Disclosed hacktool set - file JoHor_Posts_Killer.exe;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;8153098a93d05ded4a2fe1f0c579a742
Hacktools_CN_Panda_445;Disclosed hacktool set - file 445.rar;-;2014-11-17 00:00:00;60;Florian Roth;CHINA,HKTL;b32cf7bc389ff0184f5474078059bfcc
Hacktools_CN_Panda_445TOOL;Disclosed hacktool set - file 445TOOL.rar;-;2014-11-17 00:00:00;60;Florian Roth;CHINA,HKTL;1e70e1870931db4e79da096edd296a47
Hacktools_CN_Panda_Burst;Disclosed hacktool set - file Burst.rar;-;2014-11-17 00:00:00;60;Florian Roth;CHINA,HKTL;d8b36a6f75992cfdd272877952a9dae8
Hacktools_CN_Panda_tasksvr;Disclosed hacktool set - file tasksvr.exe;-;2014-11-17 00:00:00;60;Florian Roth;CHINA,HKTL;6aeb6b7378e79b09ff0c3714096bffc2
Hacktools_CN_Panda_tesksd;Disclosed hacktool set - file tesksd.jpg;-;2014-11-17 00:00:00;60;Florian Roth;CHINA,HKTL;9ed360c83601611c077c544e7d694761
Hacktools_CN_Scan_BAT;Disclosed hacktool set - file scan.bat;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;229cf2ee3796b8550ce6d515bcc05379
Hacktools_CN_WinEggDrop;Disclosed hacktool set - file s.exe;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;19b36981cee7c13dd393bb4cb6426557
HawkEye_Keylogger_Feb18_1;Detects HawkEye keylogger variante observed in February 2018;https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9;2018-02-12 00:00:00;75;Florian Roth;EXE,FILE,HKTL;71cd95d98cd9b233bd6a88a9362ff61f
Hermes2_1;Detects Hermes Ransomware as used in BAE report on FEIB;https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html;2017-10-11 00:00:00;75;BAE;CRIME,EXE,FILE,MAL,RANSOM;937be2f1171c37c98c6255f5762bc9ff
IMPLANT_4_v4;BlackEnergy / Voodoo Bear Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;6544c4cf536807978a5949ddfcfae9d8
IMPLANT_4_v5;BlackEnergy / Voodoo Bear Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;0e6c1fee2847ec224c36eaf1a53495e3
IMPLANT_4_v7;BlackEnergy / Voodoo Bear Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;b5b64ef96be5b89c6814beaeac56b1f8
IMPLANT_4_v8;BlackEnergy / Voodoo Bear Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;0b3ce34ba581c01c9940847bc516ae8f
IMPLANT_4_v9;BlackEnergy / Voodoo Bear Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;0ebf1d5bead715d9b832e475bf58e0f0
IMPLANT_5_v1;XTunnel Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;ca13bf4063f2c823ab5b25ac1f05aaa4
IMPLANT_5_v2;XTunnel Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;39eb6b3c5972083b00b6402d9dd6e67d
IMPLANT_5_v3;XTunnel Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;626e936bfee7340a2150ffbc1344f34a
IMPLANT_5_v4;XTunnel Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,RUSSIA;d4678bab3784b7664a62636b38fec8df
IMPLANT_6_v1;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;4392fa953a93a065748803b75e4048af
IMPLANT_6_v2;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;339cbebc51fb082776d5971fd1bd76b4
IMPLANT_6_v3;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;c0b0b74701f290319007ddf8554aeefa
IMPLANT_6_v4;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;50a431669aa2212f8b5b0aba5d809697
IMPLANT_6_v5;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;7c34bc08460d4ff9c0063146f609b8ba
IMPLANT_6_v6;Sednit / EVILTOSS Implant by APT28;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;b80e253e49cc11187824310baae04cd7
IMPLANT_7_v1;Implant 7 by APT29;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;c7819d6781fc33bda36fab02c5458f7a
IMPLANT_8_v1;HAMMERTOSS / HammerDuke Implant by APT29;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;65;US CERT;APT,FILE,RUSSIA;b5dfb5adc530f1271fa783bff7275b2f
IMPLANT_9_v1;Onion Duke Implant by APT29;https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE;2017-02-10 00:00:00;85;US CERT;APT,FILE,RUSSIA;c7e3a4122634e9a7f6bdf0b5c2b14cbe
IP_Stealing_Utilities;Auto-generated rule on file IP Stealing Utilities.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;367b0b4c66b040c6f45215ea17045e90
Impacket_Keyword;Detects Impacket Keyword in Executable;Internal Research;2017-08-04 00:00:00;60;Florian Roth;EXE,FILE,HKTL;4cba52d46a6c9b618a814217084659cc
Impacket_Lateral_Movement;Detects Impacket Network Aktivity for Lateral Movement;https://github.com/CoreSecurity/impacket;2018-03-22 00:00:00;60;Markus Neis;EXE,FILE;3c01b9435d3d523d1a0c3810225c9d5d
Imphash_Malware_2_TA17_293A;Detects malware based on Imphash of malware used in TA17-293A;https://www.us-cert.gov/ncas/alerts/TA17-293A;2017-10-21 00:00:00;75;Florian Roth;EXE,FILE,MAL;16fbc1efbb567029ac6c5d41a6e1b7b0
Imphash_UPX_Packed_Malware_1_TA17_293A;Detects malware based on Imphash of malware used in TA17-293A;https://www.us-cert.gov/ncas/alerts/TA17-293A;2017-10-21 00:00:00;75;Florian Roth;EXE,FILE,MAL;f46a879344bf8363971337532a15b20c
Indetectables_RAT;Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux;http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/;2015-10-01 00:00:00;75;Florian Roth;EXE,FILE,MAL;38e427f07be5fb2a53844f0b6de008e9
Industroyer_Malware_1;Detects Industroyer related malware;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;EXE,FILE,MAL;3966d7bde9684b2e7f9545d6f419f55b
Industroyer_Malware_2;Detects Industroyer related malware;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;EXE,FILE,MAL;6149b4f102b3e49c8c09b1548cbc97fd
Industroyer_Malware_4;Detects Industroyer related malware;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;EXE,FILE,MAL;de708439171fb45cddb5e3eeef7d373a
Industroyer_Malware_5;Detects Industroyer related malware;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;EXE,FILE,MAL;29d80ef09b2ed59741953462e6f50a90
Industroyer_Portscan_3;Detects Industroyer related custom port scaner;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;EXE,FILE;ce1b1e4b41117d92ba4e449478a45b82
Industroyer_Portscan_3_Output;Detects Industroyer related custom port scaner output file;https://goo.gl/x81cSy;2017-06-13 00:00:00;75;Florian Roth;;71a54e0dd41891a6722de498635e35b2
InjectionParameters;Chinese Hacktool Set - file InjectionParameters.vb;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;26a053e1abd98fb72563cdd675624229
Invoke_PSImage;Detects a command to execute PowerShell from String;https://github.com/peewpw/Invoke-PSImage;2017-12-16 00:00:00;75;Florian Roth;SCRIPT;fa87ad2742d0232286d64da0b74c8371
Invoke_SMBExec;Detects Invoke-WmiExec or Invoke-SmbExec;https://github.com/Kevin-Robertson/Invoke-TheHash;2017-06-14 00:00:00;75;Florian Roth;;a2e4a70fd04d68b87334e43737e46318
Invoke_SMBExec_Invoke_WMIExec_1;Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1;https://github.com/Kevin-Robertson/Invoke-TheHash;2017-06-14 00:00:00;75;Florian Roth;;029645dc82fd3fae36789635e19def06
IronGate_PyInstaller_update_EXE;Detects a PyInstaller file named update.exe as mentioned in the IronGate APT;https://goo.gl/Mr6M2J;2016-06-04 00:00:00;60;Florian Roth;APT,EXE,FILE;8667f454f4c05442ab6e5a122f650b1a
IronPanda_DNSTunClient;Iron Panda malware DnsTunClient - file named.exe;https://goo.gl/E4qia9;2015-09-16 00:00:00;80;Florian Roth;CHINA,EXE,FILE;08b505078c843ba1db1837e0f25c410a
IronPanda_Malware1;Iron Panda Malware;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;11de9f582ba4d3d6694c5ca9555194b7
IronPanda_Malware2;Iron Panda Malware;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;478523e2ee451a9a7344f36da5341f4b
IronPanda_Malware3;Iron Panda Malware;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;bfa3859a2f065f646a5f15a603204572
IronPanda_Malware4;Iron Panda Malware;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;8673cb97d8ab4266fec94f56deb2025c
IronPanda_Malware_Htran;Iron Panda Malware Htran;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;b38b00ef7f406bb84097167a2512cdd1
IronPanda_Webshell_JSP;Iron Panda Malware JSP;https://goo.gl/E4qia9;2015-09-16 00:00:00;75;Florian Roth;CHINA,MAL,WEBSHELL;5b4b7c61818bc8ad0b7ee6d4cd4a7f7f
IronTiger_ASPXSpy;ASPXSpy detection. It might be used by other fraudsters;http://goo.gl/T5fSJC;1970-01-01 01:00:00;75;Cyber Safety Solutions, Trend Micro;;567f1e4f0656f6a944a1176bc28df52a
IronTiger_Gh0stRAT_variant;This is a detection for a s.exe variant seen in Op. Iron Tiger;http://goo.gl/T5fSJC;1970-01-01 01:00:00;75;Cyber Safety Solutions, Trend Micro;EXE,EXTVAR,FILE,INDIA;62bb6185fe78522f126be78226b78add
IronTiger_dnstunnel;This rule detects a dns tunnel tool used in Operation Iron Tiger;http://goo.gl/T5fSJC;1970-01-01 01:00:00;75;Cyber Safety Solutions, Trend Micro;EXE,FILE,INDIA;a9e32c5e0e5806de9dc374dfaeb4698c
JSP_Browser_APT_webshell;VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a;-;2014-10-10 00:00:00;60;Florian Roth;APT,WEBSHELL;97c14840d47a91ac80bcb5dbd6f82dee
JSP_jfigueiredo_APT_webshell;JSP Browser used as web shell by APT groups - author: jfigueiredo;http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp;2014-12-10 00:00:00;60;Florian Roth;APT,WEBSHELL;6996bd4798b7bda37d584339f2c5597a
JSP_jfigueiredo_APT_webshell_2;JSP Browser used as web shell by APT groups - author: jfigueiredo;http://ceso.googlecode.com/svn/web/bko/filemanager/;2014-12-10 00:00:00;60;Florian Roth;APT,WEBSHELL;2b0f1798ac5409b6a4a997e7a24ac11d
JavaScript_Run_Suspicious;Detects a suspicious Javascript Run command;https://twitter.com/craiu/status/900314063560998912;2017-08-23 00:00:00;60;Florian Roth;SCRIPT;d05dcd536febf6738cf028f84fa59284
KHRAT_Malware;Detects an Imphash of KHRAT malware;https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/;2017-08-31 00:00:00;75;Florian Roth;EXE,FILE,MAL;d38075a1976cb952026e204015620408
KINS_dropper;Match protocol, process injects and windows exploit present in KINS dropper;http://goo.gl/arPhm3;1970-01-01 01:00:00;75;AlienVault Labs aortega@alienvault.com;;ad9d4d7c38f4ec21fe75b95fa16f106e
KR_Target_Malware_Aug17;Detects malware that targeted South Korea in Aug 2017 - file MRDqsbuEqGxrgqtbXU.exe;https://twitter.com/eyalsela/status/900250203097354240;2017-08-23 00:00:00;75;Florian Roth;EXE,FILE,MAL;39fd33487a3106781f0a7858ba15dbad
Keylogger_CN_APT;Keylogger - generic rule for a Chinese variant;-;2016-03-07 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,HKTL;c280d93bc11d106aa6f7bb009c8f4c4d
Lazarus_Dec_17_1;Detects Lazarus malware from incident in Dec 2017;https://goo.gl/8U6fY2;2017-12-20 00:00:00;75;Florian Roth;FILE,NK;88b9ff00d315152b02486a1cc2bf6cbb
Lazarus_Dec_17_2;Detects Lazarus malware from incident in Dec 2017;https://goo.gl/8U6fY2;2017-12-20 00:00:00;75;Florian Roth;EXE,FILE,NK;565f5b81028a9aafd2cba6ae1131289b
Lazarus_Dec_17_4;Detects Lazarus malware from incident in Dec 2017ithumb.js;https://goo.gl/8U6fY2;2017-12-20 00:00:00;75;Florian Roth;NK;7b9f0eddc2f513deeef53671876616f9
Lazarus_Dec_17_5;Detects Lazarus malware from incident in Dec 2017;https://goo.gl/8U6fY2;2017-12-20 00:00:00;75;Florian Roth;NK;313deaf84e4012c6d9aef4cfcc783830
Leviathan_CobaltStrike_Sample_1;Detects Cobalt Strike sample from Leviathan report;https://goo.gl/MZ7dRg;2017-10-18 00:00:00;75;Florian Roth;EXE,FILE;fcb16c7097fd700ecbf53244e561baa4
LightFTP_Config;Detects a light FTP server - config file;https://github.com/hfiref0x/LightFTP;2015-05-14 00:00:00;75;Florian Roth;FILE;92708cf17ba51fe1329532890b470896
Linux_Portscan_Shark_1;Detects Linux Port Scanner Shark;Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35;2016-04-01 00:00:00;75;Florian Roth;FILE,HKTL,LINUX;29d6a12c0f9f85963c4e16e93176304b
Linux_Portscan_Shark_2;Detects Linux Port Scanner Shark;Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35;2016-04-01 00:00:00;75;Florian Roth;HKTL,LINUX;81d8156f2c9c785c8ab94ed5ec81404e
LiuDoor_Malware_1;Liudoor Trojan used in Terracotta APT;https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/;2015-08-04 00:00:00;70;Florian Roth;APT,EXE,FILE,MAL;4b853827f50229be8d533e1e2bcbd2b4
LiuDoor_Malware_2;Liudoor Trojan used in Terracotta APT;https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/;2015-08-04 00:00:00;70;Florian Roth;APT,EXE,FILE,MAL;8abecb543f4eb5fe0af9df843fdcf68e
Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php;Semi-Auto-generated - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;a56ad941ebd1bcd6996fe8f856e8140e
Locky_Ransomware;Detects Locky Ransomware (matches also on Win32/Kuluoz);https://goo.gl/qScSrE;2016-02-17 00:00:00;75;Florian Roth (with the help of binar.ly);CRIME,MAL,RANSOM;dc3aac29a8446becf5b60b4943fd491a
MAL_APT_Operation_ShadowHammer_MalSetup;Detects a malicious file used by BARIUM group in Operation ShadowHammer;https://securelist.com/operation-shadowhammer/89992/;2019-03-25 00:00:00;80;Florian Roth;APT,EXE,FILE;16d118342fa17f6c23faab87a32b1d3d
MAL_KHRAT_script;Rule derived from KHRAT script but can match on other malicious scripts as well;https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/;2017-08-31 00:00:00;75;Florian Roth;MAL;841f1d94ddfa2b3051ea257b62ebe105
MAL_KHRAT_scritplet;Rule derived from KHRAT scriptlet;https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/;2017-08-31 00:00:00;75;Florian Roth;FILE,MAL;7ba86301cf6f3e46c20740f3a8333ed1
MAL_Kwampirs_Apr18;Kwampirs dropper and main payload components;https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia;2018-04-23 00:00:00;75;Symantec;;49aa486e152e9680f0743294813e8679
MAL_LNX_SSHDOOR_Triton;Signature detecting ;https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf;2018-12-05 00:00:00;75;Marc-Etienne M.Leveille, modified by Florian Roth;FILE,LINUX;956fded15ceb060dc3ecc659afdd9de0
MAL_Metasploit_Framework_UA;Detects User Agent used in Metasploit Framework;https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7;2018-08-16 00:00:00;65;Florian Roth;EXE,FILE,METASPLOIT;71d7054c6f564e1de62cfc38f42f8460
MAL_MuddyWater_DroppedTask_Jun18_1;Detects a dropped Windows task as used by MudyWater in June 2018;https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb;2018-06-12 00:00:00;75;Florian Roth;FILE;db7175839835bc2e29e54302454f21fb
MAL_OSX_FancyBear_Agent_Jul18_1;Detects FancyBear Agent for OSX;https://twitter.com/DrunkBinary/status/1018448895054098432;2018-07-15 00:00:00;75;Florian Roth;FILE,MACOS,RUSSIA;92f1b3d05e41b9dd965ea61bfe645e20
MAL_PE_Type_BabyShark_Loader;Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks;https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/;2019-02-24 00:00:00;75;Florian Roth;EXE,EXTVAR,FILE;2e0971cffdf5e336ae6fdb789d120e0f
MAL_RTF_Embedded_OLE_PE;Detects a suspicious string often used in PE files in a hex encoded object stream;https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/;2018-01-22 00:00:00;75;Florian Roth;FILE;589f28952cd825e33d7ff1d1c1772eb4
MAL_Ryuk_Ransomware;Detects strings known from Ryuk Ransomware;https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/;2018-12-31 00:00:00;75;Florian Roth;CRIME,EXE,FILE,MAL,RANSOM;98701b4936d6ae65267b023e00bdb632
MAL_Sednit_DelphiDownloader_Apr18_2;Detects malware from Sednit Delphi Downloader report;https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/;2018-04-24 00:00:00;75;Florian Roth;;2ab1a68fe94fd35dacc9f58542381fd1
MAL_Sednit_DelphiDownloader_Apr18_3;Detects malware from Sednit Delphi Downloader report;https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/;2018-04-24 00:00:00;75;Florian Roth;EXE,FILE;4ad0bced1f4e34cc8e8f9ea2de2753cc
MAL_Unknown_PWDumper_Apr18_3;Detects sample from unknown sample set - IL origin;Internal Research;2018-04-06 00:00:00;75;Florian Roth;EXE,FILE,HKTL;6509d5231679ceeb1222a264a95f6093
MAL_Visel_Sample_May18_1;Detects Visel malware sample from Burning Umbrella report;https://401trg.pw/burning-umbrella/;2018-05-04 00:00:00;75;Florian Roth;EXE,FILE;3df895c601e021b54890e18c8707549c
MSBuild_Mimikatz_Execution_via_XML;Detects an XML that executes Mimikatz on an endpoint via MSBuild;https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml;2016-10-07 00:00:00;75;Florian Roth;HKTL;d4c5affa1be7d808bc30775b3baa0125
MSSqlPass;Chinese Hacktool Set - file MSSqlPass.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;c7ad5dbde500ec1c2961ba2f217ff6b4
Mal_Dropper_httpEXE_from_CAB;Detects a dropper from a CAB file mentioned in the article;https://goo.gl/13Wgy1;2016-05-25 00:00:00;60;Florian Roth;EXE,FILE,MAL;3493b2b3d6eb9886c1f28b7f60935d68
Mal_PotPlayer_DLL;Detects a malicious PotPlayer.dll;https://goo.gl/13Wgy1;2016-05-25 00:00:00;70;Florian Roth;EXE,FILE;ed81a39d085b61d1a2ec6ff8dbb03c60
Mal_http_EXE;Detects trojan from APT report named http.exe;https://goo.gl/13Wgy1;2016-05-25 00:00:00;80;Florian Roth;APT,EXE,FILE;e9d09cae1326861c54399c3893e87ba6
Malicious_BAT_Strings;Detects a string also used in Netwire RAT auxilliary;https://pastebin.com/8qaiyPxs;2018-01-05 00:00:00;60;Florian Roth;MAL;6d73f24f709bda8388f8972fdd3a196f
Malware_MsUpdater_String_in_EXE;MSUpdater String in Executable;VT Analysis;2015-06-03 00:00:00;50;Florian Roth;EXE,FILE,MAL;66f32a4600929b84ebcfffc8a06d1f2d
Malware_QA_1177;VT Research QA uploaded malware - file 1177.vbs;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;FILE,MAL;26deb049d1fff4920697923d81970553
Malware_QA_get_The_FucKinG_IP;VT Research QA uploaded malware - file get The FucKinG IP.exe;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,FILE,MAL;64d9ad3382c32ecfa570297dd6609fd2
Malware_QA_not_copy;VT Research QA uploaded malware - file not copy.exe;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,FILE,MAL;6d288671603d06b96c868787895533f1
Malware_QA_tls;VT Research QA uploaded malware - file tls.exe;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,FILE,MAL;d1a91cac10548e7a6cc189137ae584ad
Malware_QA_update;VT Research QA uploaded malware - file update.exe;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,FILE,MAL;44e4e17251d3eabbb5c7c8265ecaf65d
Malware_QA_update_test;VT Research QA uploaded malware - file update_.exe;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,EXTVAR,FILE,MAL;d1abdc9a8641e7ef123090d3312c7834
Malware_QA_vqgk;VT Research QA uploaded malware - file vqgk.dll;VT Research QA;2016-08-29 00:00:00;80;Florian Roth;EXE,FILE,MAL;9f2b5b9bb991f4d5bdbb4ab8229627ce
MarathonTool;Chinese Hacktool Set - file MarathonTool.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;3e74d8fbab426bbbc6aa0f101865f7bd
MarathonTool_2;Chinese Hacktool Set - file MarathonTool.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;37cd7001e0a4b6f496edbbfaa67ce64b
Metasploit_Loader_RSMudge;Detects a Metasploit Loader by RSMudge - file loader.exe;https://github.com/rsmudge/metasploit-loader;2016-04-20 00:00:00;75;Florian Roth;EXE,FILE,METASPLOIT;7fd97b5f0691841e958b7c484768cad5
Methodology_Artificial_UserAgent_IE_Win7;Looking for hard-coded User-Agent string that has been present in *several* APT37 and suspected APT37 malware families. Lots of DPRK activity. Someone is re-using code, or perhaps some mal dev has a favorite. This will also catch a boatload of other stuff.;-;1970-01-01 01:00:00;75;Steve Miller aka @stvemillertime;APT,FILE;48b45a2303731a0e1b8fbb39882ecc55
Microcin_Sample_1;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;ddb59d0e95372a286d4f0a90a2977b0e
Microcin_Sample_2;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;769582e6a23cbd98bbb5dcd2cee02886
Microcin_Sample_3;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;8b1ed923e2af62b48d9a1f125b3ba6d6
Microcin_Sample_4;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;209d1ef4592bbd03d1a00b3027bde864
Microcin_Sample_5;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;c484413923079b10b50bd7468b051582
Microcin_Sample_6;Malware sample mentioned in Microcin technical report by Kaspersky;https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf;2017-09-26 00:00:00;75;Florian Roth;EXE,FILE,MAL;4cf718c5de310c200208af11294f0486
Mimikatz_Gen_Strings;Detects Mimikatz by using some special strings;Internal Research;2017-06-19 00:00:00;75;Florian Roth;EXE,FILE,GEN,HKTL;6d80063795e5abedb4128385bd79657b
MiniRAT_Gen_1;Detects Mini RAT malware;https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news;2018-01-22 00:00:00;75;Florian Roth;EXE,FILE,GEN,MAL;10c17d5bd8b17f889a95d1f820379e60
Mithozhan_Trojan;Mitozhan Trojan used in APT Terracotta;https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/;2015-08-04 00:00:00;70;Florian Roth;APT,EXE,FILE,MAL;a95ab8a8d33cb65a1e2d95eb0d085c61
Molerats_Jul17_Sample_1;Detects Molerats sample - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;EXE,FILE;3117cbf745781fbe3c26bbfdf53cbf98
Molerats_Jul17_Sample_2;Detects Molerats sample - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;EXE,FILE;16a2418c27160a53343f97099d256e4a
Molerats_Jul17_Sample_3;Detects Molerats sample - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;EXE,FILE;b5747f67d12cbcb2a2a045682b624f9d
Molerats_Jul17_Sample_4;Detects Molerats sample - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;;b4dbd8f8f1b0eb0219e0e9ae65b3c358
Molerats_Jul17_Sample_5;Detects Molerats sample - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;;385465559106ad34b2972f6a51e161fc
Molerats_Jul17_Sample_Dropper;Detects Molerats sample dropper SFX - July 2017;https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html;2017-07-07 00:00:00;75;Florian Roth;EXE,FILE,MAL;ad1a843dde919afb56a7c4661b62651f
Monsoon_APT_Malware_1;Detects malware from Monsoon APT;http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2;2017-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;b5f04265fadfca8e6c1fe8bbfa43a8fd
Monsoon_APT_Malware_2;Detects malware from Monsoon APT;http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2;2017-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL;a1e08ce4a31a1b6cf48df08f261611b8
MooreR_Port_Scanner;Auto-generated rule on file MooreR Port Scanner.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;e8a0331b3bcf64192e0fdc7db45b1cbb
Moroccan_Spamers_Ma_EditioN_By_GhOsT_php;Semi-Auto-generated - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;12dc695f065eb9f1299976585e7ef5ce
Ms_Viru_racle;Chinese Hacktool Set - file racle.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;7dbcaf614f7d01a4122dba7248ce5d4d
Ms_Viru_v;Chinese Hacktool Set - file v.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;bb8eba7b37c2c8d4e3e81d4fa5cdc640
MuddyWater_Mal_Doc_Feb18_1;Detects malicious document used by MuddyWater;Internal Research - TI2T;2018-02-26 00:00:00;75;Florian Roth;FILE,MIDDLE_EAST;65b44ffc1dd6af4c8e33554c92f3e976
MuddyWater_Mal_Doc_Feb18_2;Detects malicious document used by MuddyWater;Internal Research - TI2T;2018-02-26 00:00:00;75;Florian Roth;FILE,MIDDLE_EAST;a7ca4dcae7f011a0b66df15815fc0db1
MySQL_Web_Interface_Version_0_8_php;Semi-Auto-generated - file MySQL Web Interface Version 0.8.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;977b02aa1312a21c3cadbb2ee55f6b50
MyWScript_CompiledScript;Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124);Internal Research;2017-07-27 00:00:00;65;Florian Roth;EXE,FILE;adab66b1a9b5bd9f71e48373e73d0725
NK_Miner_Malware_Jan18_1;Detects Noth Korean Monero Miner mentioned in AlienVault report;https://goo.gl/PChE1z;2018-01-09 00:00:00;75;Florian Roth (original rule by Chris Doman);EXE,FILE,MAL;94faaf399c450181bfb25b5d9b3a1876
NT_Addy_asp;Semi-Auto-generated - file NT Addy.asp.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;4f5a456f4dc71d4cdc97d23dc5700e2d
Nanocore_RAT_Feb18_1;Detects Nanocore RAT;Internal Research - T2T;2018-02-19 00:00:00;75;Florian Roth;EXE,FILE,MAL;8a0692ead01eb2443c63e8f9465fb41d
Nanocore_RAT_Feb18_2;Detects Nanocore RAT;Internal Research - T2T;2018-02-19 00:00:00;75;Florian Roth;EXE,FILE,MAL;ec22f3fcb9f9df23bee3964998dba62d
Nanocore_RAT_Gen_1;Detetcs the Nanocore RAT and similar malware;https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/;2016-04-22 00:00:00;70;Florian Roth;EXE,FILE,GEN,MAL;1d44bd69611502109445fdb9cccc8efb
Nanocore_RAT_Gen_2;Detetcs the Nanocore RAT;https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/;2016-04-22 00:00:00;100;Florian Roth;EXE,FILE,GEN,MAL;8b5b2a28922b321f712b16b015e7ddcc
Nanocore_RAT_Sample_1;Detetcs a certain Nanocore RAT sample;https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/;2016-04-22 00:00:00;75;Florian Roth;EXE,FILE,MAL;270c2c31cd35fd6398cd09e2dabbc237
Nanocore_RAT_Sample_2;Detetcs a certain Nanocore RAT sample;https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/;2016-04-22 00:00:00;75;Florian Roth;EXE,FILE,MAL;62a7f1be90637b5b379c15b38bb89b52
Nautilus_common_strings;Rule for detection of Nautilus based on common plaintext strings;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;75;NCSC UK;FILE;a508ff2539b80ebad58525c1945250fa
Nautilus_forensic_artificats;Rule for detection of Nautilus related strings;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;60;NCSC UK / Florian Roth;;ce79b8fda4014dbfd77365db92bd3593
Nautilus_modified_rc4_loop;Rule for detection of Nautilus based on assembly code for a modified RC4 loop;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;75;NCSC UK;FILE;4a75739d13de9bb72831e3de77aa4eec
Nautilus_rc4_key;Rule for detection of Nautilus based on a hardcoded RC4 key;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;75;NCSC UK;FILE;e52d35afefd614943bb9a52766b04edf
Ncrack;This signature detects the Ncrack brute force tool;-;2014-07-06 00:00:00;60;Florian Roth;HKTL;04c1aa622882a460c8dbc8b58180f540
NetBIOS_Name_Scanner;Auto-generated rule on file NetBIOS Name Scanner.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;47b535d5740e272c7324152bb91a361b
Netview_Hacktool;Network domain enumeration tool - often used by attackers - file Nv.exe;https://github.com/mubix/netview;2016-03-07 00:00:00;60;Florian Roth;EXE,FILE,HKTL;eb916b9ac4ed7885cf74f06a032b5a7f
Netview_Hacktool_Output;Network domain enumeration tool output - often used by attackers - file filename.txt;https://github.com/mubix/netview;2016-03-07 00:00:00;60;Florian Roth;HKTL;405ac58333a54ffe4cc8096f59324875
Neuron_common_strings;Rule for detection of Neuron based on commonly used strings;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;75;NCSC UK;FILE;588116fce379be192335fab5ce1437af
Neuron_standalone_signature;Rule for detection of Neuron based on a standalone signature from .NET metadata;https://www.ncsc.gov.uk/alerts/turla-group-malware;2017-11-23 00:00:00;75;NCSC UK;FILE;0c145e722abc8359ef460d0dd6456959
Nirsoft_NetResView;Detects NirSoft NetResView - utility that displays the list of all network resources;https://goo.gl/Mr6M2J;2016-06-04 00:00:00;40;Florian Roth;EXE,FILE;aaef31c5a2b2ac01bee6baff3b4a32c5
Nishang_Webshell;Detects a ASPX web shell;https://github.com/samratashok/nishang;2016-09-11 00:00:00;75;Florian Roth;FILE,WEBSHELL;fef1549a4535398f6d462156d8145681
No_PowerShell;Detects an C# executable used to circumvent PowerShell detection - file nps.exe;https://github.com/Ben0xA/nps;2016-05-21 00:00:00;80;Florian Roth;EXE,FILE,SCRIPT;7c5f8a8641ec50d3b18f5d1c8a26cf7c
NotPetya_Ransomware_Jun17;Detects new NotPetya Ransomware variant from June 2017;https://goo.gl/h6iaGj;2017-06-27 00:00:00;75;Florian Roth;CRIME,EXE,FILE,MAL,RANSOM;56e424166ceac048d264f950d1ecf6ac
Nshell__1__php_php;Semi-Auto-generated - file Nshell (1).php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;0e7abfec3b95f99de72767fb87180fc8
NtGodMode;Chinese Hacktool Set - file NtGodMode.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;245d5fe8bfa6e3f206861182b9557aa2
ONHAT_Proxy_Hacktool;Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups;https://goo.gl/p32Ozf;2016-05-12 00:00:00;100;Florian Roth;APT,CHINA,EXE,FILE,HKTL;c72f98f56c4f3ccff76f40884458872c
OPCLEAVER_BackDoorLogger;Keylogger used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;HKTL;5961272363f70a3a905feeca3d33b27c
OPCLEAVER_CCProxy_Config;CCProxy config known from Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Florian Roth;HKTL;70e7f408a1fe6d4601704818a46b7acc
OPCLEAVER_Jasus;ARP cache poisoner used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;65037b109409c58451e8319b8188870f
OPCLEAVER_LoggerModule;Keylogger used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;HKTL;5555aeb091bb68ed60d0565c83161a26
OPCLEAVER_NetC;Net Crawler used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;f282e4874ce9f2036926ca195300dc58
OPCLEAVER_Parviz_Developer;Parviz developer known from Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Florian Roth;;d698b18bd3ecd3a53b2248580d6d22a7
OPCLEAVER_ShellCreator2;Shell Creator used by attackers in Operation Cleaver to create ASPX web shells;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;444ab20d3c11df6405dd3e20f3b1d64f
OPCLEAVER_SmartCopy2;Malware or hack tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;MAL;2c6609c9413ee5d0bcc3146b54688153
OPCLEAVER_SynFlooder;Malware or hack tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;MAL;330ca286e142bd7cb13207d4f1b18c16
OPCLEAVER_TinyZBot;Tiny Bot used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;986083a8f488dbbf494ce94cea1bd75f
OPCLEAVER_ZhoupinExploitCrew;Keywords used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;8f6c4dd0eb69874f9e43f439904f46e7
OPCLEAVER_antivirusdetector;Hack tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;d9e971817d28aea965f47ee79a921ac3
OPCLEAVER_csext;Backdoor used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;MAL;35e7d940d93c8945bc8d1b17b92ee830
OPCLEAVER_kagent;Backdoor used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;MAL;a5599868ea28b2ad37173040dcb0ded6
OPCLEAVER_mimikatzWrapper;Mimikatz Wrapper used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;61253dc40a7c86a26c13f2e8ac9236ce
OPCLEAVER_pvz_in;Parviz tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;891595a159c750da8c769cc307430147
OPCLEAVER_pvz_out;Parviz tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;6f777926a5ddc320034e2ae8f8bbeab8
OPCLEAVER_wndTest;Backdoor used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;MAL;74c34f0c3a6adfaee5ffe51988306e19
OPCLEAVER_zhCat;Network tool used by Iranian hackers and used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;370656ef831cd7dd769d802b52de585c
OPCLEAVER_zhLookUp;Hack tool used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;73bd56ad6be5a8f3a307b642e27adf15
OPCLEAVER_zhmimikatz;Mimikatz wrapper used by attackers in Operation Cleaver;http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf;2014-12-02 00:00:00;70;Cylance Inc.;;7a7be9c298ac0d131c15ba0d4e969bee
Office_AutoOpen_Macro;Detects an Microsoft Office file that contains the AutoOpen Macro function;-;2015-05-28 00:00:00;40;Florian Roth;FILE,OFFICE;13819a16fa65389b83765def5d6c1cc4
Office_OLE_DDE;Detects DDE in MS Office documents;https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/;2017-10-12 00:00:00;50;NVISO Labs;FILE,OFFICE;77ec120990cef678c372d1da97c271ea
Office_OLE_DDEAUTO;Detects DDE in MS Office documents;https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/;2017-10-12 00:00:00;50;NVISO Labs;FILE,OFFICE;11a3d08f3f65fc6319e534d56ad97724
Office_as_MHTML;Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158);https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/;2015-05-28 00:00:00;40;Florian Roth;EXPLOIT,FILE,OFFICE;a47ac19f2730b502def9be6d62e39efe
OilRig_Campaign_Reconnaissance;Detects Windows discovery commands - known from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;MIDDLE_EAST;f56454047e0f36c902c3042b1d4172fa
OilRig_ISMAgent_Campaign_Samples1;Detects OilRig malware from Unit 42 report in October 2017;https://goo.gl/JQVfFP;2017-10-18 00:00:00;75;Florian Roth;FILE,MIDDLE_EAST;7b036ceda3addf668d6ec6ffbf3b54b2
OilRig_ISMAgent_Campaign_Samples2;Detects OilRig malware from Unit 42 report in October 2017;https://goo.gl/JQVfFP;2017-10-18 00:00:00;75;Florian Roth;EXE,FILE,MIDDLE_EAST;266f86b0829436fd5044ab1baf2f43fe
OilRig_ISMAgent_Campaign_Samples3;Detects OilRig malware from Unit 42 report in October 2017;https://goo.gl/JQVfFP;2017-10-18 00:00:00;75;Florian Roth;EXE,FILE,MIDDLE_EAST;50424b217ff47bf5c8aeedbf608dae7d
OilRig_Malware_Campaign_Gen1;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;FILE,MAL,MIDDLE_EAST;788971385547af133d4d96ca27960542
OilRig_Malware_Campaign_Gen2;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;FILE,MAL,MIDDLE_EAST;c7f9296f17a6a0430cb8241710d087be
OilRig_Malware_Campaign_Gen3;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;FILE,MAL,MIDDLE_EAST;4bc22b3706ea97d9c7595593992d42ca
OilRig_Malware_Campaign_Mal1;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;FILE,MAL,MIDDLE_EAST;372845575cc930b00047895bb84b63b1
OilRig_Malware_Campaign_Mal2;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;FILE,MAL,MIDDLE_EAST;cc98308704253795b0e7a32beba8ddf0
OilRig_Malware_Campaign_Mal3;Detects malware from OilRig Campaign;https://goo.gl/QMRZ8K;2016-10-12 00:00:00;75;Florian Roth;MAL,MIDDLE_EAST;154c682bec6a9b548bf9620f0d4753ad
OilRig_RGDoor_Gen1;Detects RGDoor backdoor used by OilRig group;https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/;2018-01-27 00:00:00;80;Florian Roth;EXE,FILE,MAL,MIDDLE_EAST;f72630c8f1a8e723a45bae8f51d740e1
OilRig_Strings_Oct17;Detects strings from OilRig malware and malicious scripts;https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/;2017-10-18 00:00:00;75;Florian Roth;MIDDLE_EAST;079ee4f1e4bcee26ccf04e7975722404
Oilrig_PS_CnC;Powershell CnC using DNS queries;https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf;2018-03-22 00:00:00;75;Markus Neis;;48df4a66976b9a04bc0476b50f39cebe
OpCloudHopper_Cloaked_PSCP;Tool used in Operation Cloud Hopper - pscp.exe cloaked as rundll32.exe;https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf;2017-04-07 00:00:00;90;Florian Roth;EXTVAR;c885e3eabce842a35890f26466486e1f
OpCloudHopper_Dropper_1;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;FILE,MAL;66cbf1ca6034281bd4a2d41cfad77e6e
OpCloudHopper_Malware_10;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;f3e97e4cfea6022bf6bc04baf92e2c37
OpCloudHopper_Malware_11;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;3aacef22ab991eeabe19f7e942693555
OpCloudHopper_Malware_1;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;08f288ce233e219281ac8b265490a245
OpCloudHopper_Malware_2;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;79f6ff8f9b71f6233940482c6ee63e44
OpCloudHopper_Malware_3;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;64351c6dd480246e11350e2830d19786
OpCloudHopper_Malware_4;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;97d09c2ed24f2fb653d89024e236025e
OpCloudHopper_Malware_5;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;815087a5f3a5afe8fbbfddeb6cf74518
OpCloudHopper_Malware_6;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;e789ada4588167076c0e469cc060848a
OpCloudHopper_Malware_7;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;678f3f18f923ed6b3f5b95dbd7de3dbe
OpCloudHopper_Malware_8;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;a16665107e7c555f4d75a918f5d1ab9d
OpCloudHopper_Malware_9;Detects malware from Operation Cloud Hopper;https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html;2017-04-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;6ed723e16c1600f41c8d676d212b0f95
OpCloudHopper_WindowXarBot;Malware related to Operation Cloud Hopper;https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf;2017-04-07 00:00:00;75;Florian Roth;EXE,FILE,MAL;9d87d471cea4b438d4b9a25c0dddd4f4
OpCloudHopper_WmiDLL_inMemory;Malware related to Operation Cloud Hopper - Page 25;https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf;2017-04-07 00:00:00;75;Florian Roth;MAL;23943bd8750e354dd929bb361314f22b
OpCloudHopper_lockdown;Tools related to Operation Cloud Hopper;https://github.com/maaaaz/impacket-examples-windows;2017-04-07 00:00:00;75;Florian Roth;EXE,FILE;1df60a216615f2c98713ffea3bc753c4
OpHoneybee_Malware_1;Detects malware from Operation Honeybee;https://goo.gl/JAHZVL;2018-03-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;7881e4978955201f7067ebb33092360a
OpHoneybee_MaoCheng_Dropper;Detects MaoCheng dropper from Operation Honeybee;https://goo.gl/JAHZVL;2018-03-03 00:00:00;75;Florian Roth;EXE,FILE,MAL;fd9c0d962db7d2f3b5b12cbf4ce75855
OracleScan;Chinese Hacktool Set - file OracleScan.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;01fc7202c8185d8b75dcb658c4d6007d
OtherTools_servu;Chinese Hacktool Set - file svu.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,FILE,HKTL;e387f9e7347d0de0822e8fd3d156951b
OtherTools_xiaoa;Chinese Hacktool Set - file xiaoa.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;41971ab200b4fa8b5267ffebd2d0fcde
PAS_TOOL_PHP_WEB_KIT_mod;Detects PAS Tool PHP Web Kit;https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity;2016-12-29 00:00:00;75;US CERT - modified by Florian Roth due to performance reasons;FILE;d72b2590fda4c2097da981c53d5b79a6
PAS_Webshell_Encoded;Detects a PAS webshell;http://blog.talosintelligence.com/2017/07/the-medoc-connection.html;2017-07-11 00:00:00;80;Florian Roth;FILE,WEBSHELL;2f5087998fe89b4d66b7b135e331d0a3
PHISH_02Dez2015_dropped_p0o6543f_2;Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4;http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/;2015-12-03 00:00:00;75;Florian Roth;EXE,FILE;8e2911a66ed33108156beebd0b06c7c1
PHP_Backdoor_Connect_pl_php;Semi-Auto-generated - file PHP Backdoor Connect.pl.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;MAL,WEBSHELL;fbca35ed7b99876d07d33b1cd0fff20f
PHP_Cloaked_Webshell_SuperFetchExec;Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC;http://goo.gl/xFvioC;1970-01-01 01:00:00;50;Florian Roth;WEBSHELL;d9f9f957b8bce16eaaf687bd0492f572
PHP_Webshell_1_Feb17;Detects a simple cloaked PHP web shell;https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127;2017-02-28 00:00:00;75;Florian Roth;FILE,WEBSHELL;98f18922ec97f38f644303d7ee88d6b9
PLUGIN_AJunk;Chinese Hacktool Set - file AJunk.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;cbb7d3c13f165f5deb097645aee32601
PLUGIN_TracKid;Chinese Hacktool Set - file TracKid.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;07c843cd7cb3d204ec77bf685ccca9c5
PLUGX_RedLeaves;Detects specific RedLeaves and PlugX binaries;https://www.us-cert.gov/ncas/alerts/TA17-117A;2017-03-04 00:00:00;75;US-CERT Code Analysis Team;;f9312c938f41e7cd499a5dbb92bd3fdf
Pastebin_Webshell;Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs;http://goo.gl/7dbyZs;2015-01-13 00:00:00;70;Florian Roth;WEBSHELL;25f212d9622c34bc411fd0d94f0978e5
Payload_Exe2Hex;Detects payload generated by exe2hex;https://github.com/g0tmi1k/exe2hex;2016-01-15 00:00:00;70;Florian Roth;;707a426b0f3998308db999d34d06e37e
Pc_pc2015;Chinese Hacktool Set - file pc2015.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;5651cbb54fda28dab576e2de3b614255
Pc_rejoice;Chinese Hacktool Set - file rejoice.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;1690950a8c97ed0ae6fb752094c72562
Pc_xai;Chinese Hacktool Set - file xai.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d29460bb493b501c962925af4ed4e50b
Persistence_Agent_MacOS;Detects a Python agent that establishes persistence on macOS;https://ghostbin.com/paste/mz5nf;1970-01-01 01:00:00;75;John Lambert @JohnLaTwC;FILE,MACOS,SCRIPT;ca7e38e44cadc90be6a8ed2153501577
Ping_Command_in_EXE;Detects an suspicious ping command execution in an executable;Internal Research;2016-11-03 00:00:00;60;Florian Roth;EXE,FILE;a95f24ce64632b83205a8a8f97ff2fcf
PlugX_J16_Gen2;Detects PlugX Malware Samples from June 2016;VT Research;2016-06-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;83646ed9e41706f8c041b82fed34b529
PlugX_J16_Gen;Detects PlugX Malware samples from June 2016;VT Research;2016-06-08 00:00:00;75;Florian Roth;EXE,FILE,GEN,MAL;094d34874121d556cb002e6a43907346
PoisonIvy_Generic_3;PoisonIvy RAT Generic Rule;-;2015-05-14 00:00:00;75;Florian Roth;EXE,FILE,GEN,MAL;d328e9cfec40ad7165205c45f75f6a98
PoisonIvy_RAT_ssMUIDLL;Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016;http://goo.gl/WiwtYT;2016-04-22 00:00:00;75;Florian Roth (with the help of yarGen and Binarly);EXE,FILE,MAL;a5639d3f4a75db637e71ed863d3b265d
PoseidonGroup_MalDoc_1;Detects Poseidon Group - Malicious Word Document;https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/;2016-02-09 00:00:00;80;Florian Roth;FILE,OFFICE;9bceecc0da91439cde483376c77087b9
PoseidonGroup_MalDoc_2;Detects Poseidon Group - Malicious Word Document;https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/;2016-02-09 00:00:00;70;Florian Roth;FILE,OFFICE;f886f4bd346a463de03e14c170eab16b
PoseidonGroup_Malware;Detects Poseidon Group Malware;https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/;2016-02-09 00:00:00;85;Florian Roth;EXE,FILE,MAL;c788eaa9dae39d1d31b7f6910e774162
PowerShell_JAB_B64;Detects base464 encoded $ sign at the beginning of a string;https://twitter.com/ItsReallyNick/status/980915287922040832;2018-04-02 00:00:00;60;Florian Roth;SCRIPT;a3d7993cee55dbaed475a0ce551062ea
PowerShell_Suite_Eidolon;Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1;https://github.com/FuzzySecurity/PowerShell-Suite;2017-12-27 00:00:00;75;Florian Roth;FILE,SCRIPT;a930332d686ee27e385a839cb0d23c26
PowerShell_Suite_Hacktools_Gen_Strings;Detects strings from scripts in the PowerShell-Suite repo;https://github.com/FuzzySecurity/PowerShell-Suite;2017-12-27 00:00:00;75;Florian Roth;GEN,SCRIPT;c054953c2a313abed276db2f60c305a6
PowerShell_Susp_Parameter_Combo;Detects PowerShell invocation with suspicious parameters;https://goo.gl/uAic1X;2017-03-12 00:00:00;60;Florian Roth;ANOMALY,SCRIPT;52cdea0c983cae62e9d8ca3bf497d3d7
PowerShell_in_Word_Doc;Detects a powershell and bypass keyword in a Word document;Internal Research - ME;2017-06-27 00:00:00;50;Florian Roth;FILE,OFFICE,SCRIPT;54f05e36c14d39ad8b83b7bbc4bd8ce0
Powerkatz_DLL_Generic;Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible);PowerKatz Analysis;2016-02-05 00:00:00;80;Florian Roth;EXE,FILE,GEN;64da045ef05b6f27216f9710c37786fd
Powershell_Netcat;Detects a Powershell version of the Netcat network hacking tool;-;2014-10-10 00:00:00;60;Florian Roth;HKTL;1bd48741d1e9a01f94eaebfd8d632e6a
ProcessInjector_Gen;Detects a process injection utility that can be used ofr good and bad purposes;https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c;2018-04-23 00:00:00;60;Florian Roth;EXE,FILE,GEN,HKTL;60cecb6e31198bb728d89e2789b36f46
PwDump_B;Detects a tool used by APT groups - file PwDump.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;d424c9dc593ae76f85d29ceb3ec20603
RAT_Sakula;Detects Sakula v1.0 RAT;http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara;2015-10-13 00:00:00;75;Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings;EXE,FILE,MAL;2a21511dd726187c32de1faf9d457b6c
RDP_Brute_Strings;Detects RDP brute forcer from NCSC report;https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control;2018-04-06 00:00:00;75;NCSC;;f5be15452c1e912628c54df68d6b8b40
REDLEAVES_CoreImplant_UniqueStrings;Strings identifying the core REDLEAVES RAT in its deobfuscated state;https://www.us-cert.gov/ncas/alerts/TA17-117A;1970-01-01 01:00:00;75;USG;MAL,OBFUS;2723ca091b4215392abc9cf8236a24ef
REDLEAVES_DroppedFile_ImplantLoader_Starburn;Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT;https://www.us-cert.gov/ncas/alerts/TA17-117A;1970-01-01 01:00:00;75;USG;MAL;8b1b3cceada4b1497d3ef70ed8910227
RUAG_Bot_Config_File;Detects a specific config file used by malware in RUAG APT case;https://goo.gl/N5MEj0;1970-01-01 01:00:00;60;Florian Roth;APT,FILE;b4135aa113df1c9403c390baa3e8e1ba
RUAG_Cobra_Config_File;Detects a config text file used by malware Cobra in RUAG case;https://goo.gl/N5MEj0;1970-01-01 01:00:00;60;Florian Roth;FILE,NK;4329482e57a3cc6ac143559d5654ec5e
RUAG_Cobra_Malware;Detects a malware mentioned in the RUAG Case called Carbon/Cobra;https://goo.gl/N5MEj0;1970-01-01 01:00:00;60;Florian Roth;EXE,FILE,MAL,NK;9a30aa4c11b1ab858c016e07ccaa8310
RUAG_Exfil_Config_File;Detects a config text file used in data exfiltration in RUAG case;https://goo.gl/N5MEj0;1970-01-01 01:00:00;60;Florian Roth;FILE;718e926c8bfd7412ecb06d371ed85761
RUAG_Tavdig_Malformed_Executable;Detects an embedded executable with a malformed header - known from Tavdig malware;https://goo.gl/N5MEj0;1970-01-01 01:00:00;60;Florian Roth;EXE,FILE;e16cd17470718414cebd80c69b8a736c
ReactOS_cmd_valid;ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset;http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php;2014-05-11 00:00:00;30;Florian Roth;HKTL;e1d135670931d2a0ffad7ea37667c6ef
ReconCommands_in_File;Detects various recon commands in a single file;https://twitter.com/haroonmeer/status/939099379834658817;2017-12-11 00:00:00;40;Florian Roth;;8e3f594f562cdc4b6f167ee60bf0fc43
Recon_Commands_Windows_Gen1;Detects a set of reconnaissance commands on Windows systems;Internal Research;2017-07-10 00:00:00;60;Florian Roth;KEYWORD;af4e21bd7a8bc0843d71acc23a93ed42
ReflectiveLoader;Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended;Internal Research;1970-01-01 01:00:00;60;Florian Roth (auto-filled);EXE,FILE;1fd7c7f6b3176d9a1035b1a1d68140d2
Reflective_DLL_Loader_Aug17_2;Detects Reflective DLL Loader - suspicious - Possible FP could be program crack;Internal Research;2017-08-20 00:00:00;60;Florian Roth;EXE,FILE;dd8911ec43dd2ba1562ea427b01ca65b
Regin_sig_svcsstat;Detects svcstat from Regin report - file svcsstat.exe_sample;-;2014-11-26 00:00:00;75;@MalwrSignatures;;14b579590f609eb92d335baed2c72494
Rehashed_RAT_1;Detects malware from Rehashed RAT incident;https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations;2017-09-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;15526a903b3e22acae7754bf54a10d98
Rehashed_RAT_2;Detects malware from Rehashed RAT incident;https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations;2017-09-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;70b9fd72775c6fa868c819e580a6040e
Rehashed_RAT_3;Detects malware from Rehashed RAT incident;https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations;2017-09-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;6749588122377de88f6f39ad88cf96a3
RemExp_asp;Semi-Auto-generated - file RemExp.asp.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;99538f26f7158d7c4497ce7cac4d0ec1
Rem_View_php_php;Semi-Auto-generated - file Rem View.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;c8b71fdebb0e5e13446d7b4ab27f3c24
RemoteCmd;Detects a remote access tool used by APT groups - file RemoteCmd.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE;dfa2313b7c62c2aa21e9487e1c99e54a
RemoteExec_Tool;Remote Access Tool used in APT Terracotta;https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/;2015-08-04 00:00:00;75;Florian Roth;APT,EXE,FILE;5bfde6a69f576f4479d1a5ef0a7f3bad
RocketKitten_Keylogger;Detects Keylogger used in Rocket Kitten APT;https://goo.gl/SjQhlp;2015-09-01 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL,MIDDLE_EAST;371e10680c2cec64629c2d671001e2f1
Rombertik_CarbonGrabber;Detects CarbonGrabber alias Rombertik - file Copy#064046.scr;http://blogs.cisco.com/security/talos/rombertik;2015-05-05 00:00:00;75;Florian Roth;EXE,FILE;9ead69ddd32e5db41809c3996151cdda
Rombertik_CarbonGrabber_Builder;Detects CarbonGrabber alias Rombertik Builder - file Builder.exe;http://blogs.cisco.com/security/talos/rombertik;2015-05-05 00:00:00;75;Florian Roth;EXE,FILE;c6535efaae6732fe098ce2cf098107ba
Rombertik_CarbonGrabber_Builder_Server;Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe;http://blogs.cisco.com/security/talos/rombertik;2015-05-05 00:00:00;75;Florian Roth;EXE,FILE;58ae753ac4f58140e43888ca3e27b1c5
Rombertik_CarbonGrabber_Panel;Detects CarbonGrabber alias Rombertik Panel - file index.php;http://blogs.cisco.com/security/talos/rombertik;2015-05-05 00:00:00;75;Florian Roth;;63ab76e8e846781141b9dfb464c10398
RottenPotato_Potato;Detects a component of privilege escalation tool Rotten Potato - file Potato.exe;https://github.com/foxglovesec/RottenPotato;2017-02-07 00:00:00;90;Florian Roth;EXE,FILE;be54bbe28b6c8d7fbda4dd525f684be9
SAM_Hive_Backup;Detects a SAM hive backup file;https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump;2015-03-31 00:00:00;60;Florian Roth;EXTVAR,FILE;6c935acbe2c1cc41f02e36c792e73c73
SCT_Scriptlet_in_Temp_Inet_Files;Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass);http://goo.gl/KAB8Jw;2016-04-26 00:00:00;75;Florian Roth;EXTVAR,FILE;422c490c2b55ea132885ff2edd79c444
SLServer_campaign_code;Searches for the related campaign code.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;02ade1eaea0bac9e74086fd5dbb51d44
SLServer_command_and_control;Searches for the C2 server.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;4ce76481034d5ef2ac10cfd8e2f20f9e
SLServer_dialog_remains;Searches for related dialog remnants.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks / modified by Florian Roth;FILE;b3901b72799c0dd18aae12ed54da9821
SLServer_mutex;Searches for the mutex.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;b6cd1d5a8d26d6f2d6d21f80f8de8cfb
SLServer_unknown_string;Searches for a unique string.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;af7fd981f96874bebda96e9d360855e3
SNOWGLOBE_Babar_Malware;Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe;http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france;2015-02-18 00:00:00;80;Florian Roth;EXE,FILE,MAL;183c725591cbbb67a1b0b280dccffbe8
SQLCracker;Chinese Hacktool Set - file SQLCracker.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d72f12da7b9ac7e7aa16be5cbaccc86d
SQLMap;This signature detects the SQLMap SQL injection tool;-;2014-07-06 00:00:00;60;Florian Roth;HKTL;98e627b7d61a419bf070a77bb567a129
SQLTools;Chinese Hacktool Set - file SQLTools.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;db6030b4038bac7431602eeceffb2811
STNC_php_php;Semi-Auto-generated - file STNC.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;8f8dd0097027f710c7fa991ef2432bd6
SUSP_Bad_PDF;Detects PDF that embeds code to steal NTLM hashes;Internal Research;2018-05-03 00:00:00;75;Florian Roth, Markus Neis;FILE,SUSP;e31e105385471c2664b7c061aedac9cf
SUSP_CMD_Var_Expansion;Detects Office droppers that include a variable expansion string;https://twitter.com/asfakian/status/1044859525675843585;2018-09-26 00:00:00;60;Florian Roth;FILE,OFFICE,SUSP;7c1163971a89e1921c1a486baaa5072a
SUSP_ELF_LNX_UPX_Compressed_File;Detects a suspicious ELF binary with UPX compression;Internal Research;2018-12-12 00:00:00;40;Florian Roth;FILE,LINUX,SUSP;4052342a830f55f02a949b76de1267e3
SUSP_EnableContent_String_Gen;Detects suspicious string that asks to enable active content in Office Doc;Internal Research;2019-02-12 00:00:00;75;Florian Roth;FILE,GEN,OFFICE,SUSP;70c79e8178d4628e5dc5a7c76b13b1f6
SUSP_Imphash_PassRevealer_PY_EXE;Detects an imphash used by password revealer and hack tools;Internal Research;2018-04-06 00:00:00;40;Florian Roth;EXE,FILE,HKTL,SUSP;29e5ad98ad6f8a1588eb37b4d2ad0238
SUSP_JAVA_Class_with_VBS_Content;Detects a JAVA class file with strings known from VBS files;https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies;2019-01-03 00:00:00;60;Florian Roth;FILE,SCRIPT,SUSP;2d8cb05f3262ed4c4b1ee1b99129f4d2
SUSP_LNK_Big_Link_File;Detects a suspiciously big LNK file - maybe with embedded content;Internal Research;2018-05-15 00:00:00;65;Florian Roth;FILE,SUSP;2434620a156275a9b7ede3a822bed7a4
SUSP_LNK_File_AppData_Roaming;Detects a suspicious link file that references to AppData Roaming;https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html;2018-05-16 00:00:00;50;Florian Roth;FILE,SUSP;f1e9fd4cba6619454d2e6162c84bd181
SUSP_LNK_File_PathTraversal;Detects a suspicious link file that references a file multiple folders lower than the link itself;https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html;2018-05-16 00:00:00;40;Florian Roth;FILE,SUSP;f731f5d681534f95c3e18ca4f8879588
SUSP_LNK_SuspiciousCommands;Detects LNK file with suspicious content;-;2018-09-18 00:00:00;60;Florian Roth;FILE,SUSP;27c8f30ffb31c9bb67693cf4cfc1a033
SUSP_LNK_lnkfileoverRFC;detect APT lnk files that run double extraction and launch routines with autoruns;-;2018-09-18 00:00:00;75;@Grotezinfosec, modified by Florian Roth;APT,FILE,SUSP;3715aa6f3090a5820cc72255523a6cde
SUSP_Microsoft_7z_SFX_Combo;Detects a suspicious file that has a Microsoft copyright and is a 7z SFX;Internal Research;2018-09-16 00:00:00;75;Florian Roth;ANOMALY,EXE,FILE,SUSP;a3a9108b18f27c38e1a8cf2c36bcf24b
SUSP_Microsoft_RAR_SFX_Combo;Detects a suspicious file that has a Microsoft copyright and is a RAR SFX;Internal Research;2018-09-16 00:00:00;75;Florian Roth;ANOMALY,EXE,FILE,SUSP;a6aa52a1aeb7cfe07781bd8fd979f1ff
SUSP_Modified_SystemExeFileName_in_File;Detecst a variant of a system file name often used by attackers to cloak their activity;https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group;2018-12-11 00:00:00;65;Florian Roth;EXE,FILE,SUSP;82b7ee96542c85910d615a2f83340a37
SUSP_Office_Dropper_Strings;Detects Office droppers that include a notice to enable active content;Internal Research;2018-09-13 00:00:00;75;Florian Roth;FILE,MAL,OFFICE,SUSP;c16fb85c66f239c0a37d86f222f3838f
SUSP_PDB_Strings_Keylogger_Backdoor;Detects PDB strings used in backdoors or keyloggers;Internal Research;2018-03-23 00:00:00;65;Florian Roth;EXE,FILE,HKTL,MAL,SUSP;8d52995e69499575c48870a5e015c3bb
SUSP_PiratedOffice_2007;Detects an Office document that was created with a pirated version of MS Office 2007;https://twitter.com/pwnallthethings/status/743230570440826886?lang=en;2018-12-04 00:00:00;40;Florian Roth;FILE,OFFICE,SUSP;5f735a9d72877ccd134931a727082232
SUSP_PowerShell_IEX_Download_Combo;Detects strings found in sample from CN group repo leak in October 2018;https://twitter.com/JaromirHorejsi/status/1047084277920411648;2018-10-04 00:00:00;75;Florian Roth;ANOMALY,SCRIPT,SUSP;e4c7e99f1968611d133183bab2996022
SUSP_PowerShell_String_K32_RemProcess;Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode;https://github.com/nccgroup/redsnarf;2018-03-31 00:00:00;75;Florian Roth;FILE,SCRIPT,SUSP;80e6addb6d5b52ccc4ef6ff7ee8218b2
SUSP_Powershell_ShellCommand_May18_1;Detects a supcicious powershell commandline;https://github.com/0x00-0x00/ShellPop;2018-05-18 00:00:00;75;Tobias Michalski;HKTL,SUSP;e7b7619775c90a8d973214fb149a8b1f
SUSP_Putty_Unnormal_Size;Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware);Internal Research;2019-01-07 00:00:00;50;Florian Roth;EXE,FILE,SUSP;741f7d491478d22036feb4ad09919355
SUSP_RAR_with_PDF_Script_Obfuscation;Detects RAR file with suspicious .pdf extension prefix to trick users;Internal Research;2019-04-06 00:00:00;75;Florian Roth;FILE,OBFUS,SUSP;d4b1823ab0ea714a6c2d166c792541ce
SUSP_RTF_Header_Anomaly;Detects malformed RTF header often used to trick mechanisms that check for a full RTF header;https://twitter.com/ItsReallyNick/status/975705759618158593;2019-01-20 00:00:00;75;Florian Roth;FILE,SUSP;283653751850fd301eaaf090edb31f1b
SUSP_Renamed_Dot1Xtray;Detects a legitimate renamed dot1ctray.exe, which is often used by PlugX for DLL side-loading;Internal Research;2018-11-15 00:00:00;75;Florian Roth;EXE,EXTVAR,FILE,SUSP;11a3af23d9945c66524cb6f60545f8f1
SUSP_SFX_RunProgram_WScript;Detects suspicious SFX as used by Gamaredon group;Internal Research;2018-09-27 00:00:00;75;Florian Roth;EXE,FILE,SUSP;7406550f49d81846af5b6eeba58ffa45
SUSP_Scheduled_Task_BigSize;Detects suspiciously big scheduled task XML file as seen in combination with embedded base64 encoded PowerShell code;Internal Research;2018-12-06 00:00:00;75;Florian Roth;FILE,SCRIPT,SUSP;7d1e4d8baeb5d9ba9a9d07c84afaaa4c
SUSP_Script_Obfuscation_Char_Concat;Detects strings found in sample from CN group repo leak in October 2018;https://twitter.com/JaromirHorejsi/status/1047084277920411648;2018-10-04 00:00:00;75;Florian Roth;OBFUS,SUSP;dcc29ae427be97b48072b002c9a3197d
SUSP_Size_of_ASUS_TuningTool;Detects an ASUS tuning tool with a suspicious size;https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/;2018-10-17 00:00:00;60;Florian Roth;EXE,FILE,SUSP;877ecec366fd74453e4622c84b1137f2
SUSP_WordDoc_VBA_Macro_Strings;Detects suspicious strings in Word Doc that indcate malicious use of VBA macros;Internal Research;2019-02-12 00:00:00;60;Florian Roth;FILE,OFFICE,SCRIPT,SUSP;578e795fe8211e16b625a652410e4b85
SUSP_XMRIG_String;Detects a suspicious XMRIG crypto miner executable string in filr;Internal Research;2018-12-28 00:00:00;75;Florian Roth;EXE,FILE,SUSP;79c20663f29d32bdaa0806d8ad45f355
SUSP_autocad_lsp_malware;Recognizes malicious autocad files written in LISP;-;2019-02-04 00:00:00;75;John Lambert @JohnLaTwC;FILE,MAL,SUSP;2eb94ea2a4c876479eecb5609d77bace
SUSP_certificate_payload;Detects payloads that pretend to be certificates;https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/;2018-08-02 00:00:00;50;Didier Stevens, Florian Roth;FILE,SUSP;e5ec1f0dd359cc6ceb9be6d900e60958
SVG_LoadURL;Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections);http://goo.gl/psjCCc;2015-05-24 00:00:00;50;Florian Roth;;297f927a2adf5cf789f789d3f8802876
S_MultiFunction_Scanners_s;Chinese Hacktool Set - file s.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;b0e83c4f048f21a76a79c3383cfdde8c
Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php;Semi-Auto-generated - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;5d4914a5634d049554b64b5f16965c94
Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php;Semi-Auto-generated - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;cbc0b6e310fefbe3cf6fc574ddf7d6d6
Sality_Malware_Oct16;Detects an unspecififed malware - October 2016;Internal Research;2016-10-08 00:00:00;80;Florian Roth;EXE,FILE,MAL;3d3d4e84fbc3ae5f763e7fbe0b153bbd
Saudi_Phish_Trojan;Detects a trojan used in Saudi Aramco Phishing;https://goo.gl/Z3JUAA;2017-10-12 00:00:00;75;Florian Roth;EXE,FILE,MAL;4401ceb9763de9044acecbc30ae86bcb
ScanBox_Malware_Generic;Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP;-;2015-02-28 00:00:00;75;Florian Roth;APT,CHINA,GEN,MAL;1d04717f065176c0fbdb39ce2dfd7ddd
SeDLL_Javascript_Decryptor;Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz;https://goo.gl/MZ7dRg;2017-10-18 00:00:00;75;Florian Roth;EXE,FILE,MAL;fba106c49d4ff77baa3b6a9fb38fe6d8
Silence_malware_1;Detects malware sample mentioned in the Silence report on Securelist;https://securelist.com/the-silence/83009/;2017-11-01 00:00:00;75;Florian Roth;EXE,FILE;2fe00228c7f61644ae594898b5275219
Silence_malware_2;Detects malware sample mentioned in the Silence report on Securelist;https://securelist.com/the-silence/83009/;2017-11-01 00:00:00;75;Florian Roth;EXE,FILE;e38f1402a1263a17e0cac05cba23f1b9
SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php;Semi-Auto-generated - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;4809109057249cdf09cc40e9e8b18337
SimShell_1_0___Simorgh_Security_MGZ_php;Semi-Auto-generated - file SimShell 1.0 - Simorgh Security MGZ.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;3331eb9cc05889b0f918349bec9e5d09
SndVol_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file SndVol.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;9b81e915501f032dae537af5e56c8277
Sniffer_analyzer_SSClone_1210_full_version;Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;8d6eded396110038a3bf1288d1f9fcf6
SoakSoak_Infected_Wordpress;Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX;http://goo.gl/1GzWUX;2014-12-15 00:00:00;60;Florian Roth;OFFICE,WEBSHELL;ae0273466952fb5899a5eef34cf5121c
Sofacy_Malware_StrangeSpaces;Detetcs strange strings from Sofacy malware with many spaces;https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/;2015-12-04 00:00:00;75;Florian Roth;EXE,FILE,MAL,RUSSIA;f38dd724ab6dbd70680a55fac6b8a3d2
Sofacy_Oct17_1;Detects Sofacy malware reported in October 2017;http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html;2017-10-23 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;e7843dbb6e25d553856ac1e727a85dba
Sofacy_Oct17_2;Detects Sofacy malware reported in October 2017;http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html;2017-10-23 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;01fa400317774bee99273b16214bfb17
Sofacy_Trojan_Loader_Feb18_1;Sofacy Activity Feb 2018;https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100;2018-03-01 00:00:00;75;Florian Roth;EXE,FILE,MAL,RUSSIA;236d4994c0251bf578f3f9e417958616
Sphinx_Moth_h2t;sphinx moth threat group file h2t.dat;www.kudelskisecurity.com;2015-08-06 00:00:00;75;Kudelski Security - Nagravision SA (modified by Florian Roth);EXE,FILE;31e80a659c3e68201fb719dd233c7900
Sphinx_Moth_kerberos32;sphinx moth threat group file kerberos32.dll;www.kudelskisecurity.com;2015-08-06 00:00:00;75;Kudelski Security - Nagravision SA (modified by Florian Roth);EXE,FILE;e53e6a49d6839b3a87f6d08429e67091
Sphinx_Moth_kerberos64;sphinx moth threat group file kerberos64.dll;www.kudelskisecurity.com;2015-08-06 00:00:00;75;Kudelski Security - Nagravision SA (modified by Florian Roth);EXE,FILE;e43e3baf39b8fb550a81f2ed90454f6a
StoneDrill;Detects malware from StoneDrill threat report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;2017-03-07 00:00:00;75;Florian Roth;EXE,FILE,MIDDLE_EAST;6c78e0292ca27cd9e6bfc83257102317
StoneDrill_BAT_1;Rule to detect Batch file from StoneDrill report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;1970-01-01 01:00:00;75;Florian Roth;FILE,MIDDLE_EAST;769284956c5e9fe219ad2f39fd49d0af
StoneDrill_Malware_2;Detects malware from StoneDrill threat report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;2017-03-07 00:00:00;75;Florian Roth;EXE,FILE,MAL,MIDDLE_EAST;c0f33936dafe4c1151d2665646ae8d0e
StoneDrill_Service_Install;Rule to detect Batch file from StoneDrill report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;1970-01-01 01:00:00;75;Florian Roth;MIDDLE_EAST;7db335ec3db5560107d7724d26d91c89
StoneDrill_VBS_1;Detects malware from StoneDrill threat report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;2017-03-07 00:00:00;75;Florian Roth;MIDDLE_EAST,SCRIPT;ea4fd67066a84799d5d5c4b42f319818
StoneDrill_main_sub;Rule to detect StoneDrill (decrypted) samples;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;1970-01-01 01:00:00;75;Kaspersky Lab;FILE,MIDDLE_EAST;f8e95a1a42f2cad0ed411bb57c3f83f9
StoneDrill_ntssrvr32;Detects malware from StoneDrill threat report;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;2017-03-07 00:00:00;75;Florian Roth;EXE,FILE,MIDDLE_EAST;334f70d8287bd1bdf2c3a32b287e3fac
StreamEx_ShellCrew;Detects a ;https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar;2017-02-09 00:00:00;80;Cylance;;37f1c675c0b219433486b191c7ac47db
Susp_Indicators_EXE;Detects packed NullSoft Inst EXE with characteristics of NetWire RAT;https://pastebin.com/8qaiyPxs;2018-01-05 00:00:00;60;Florian Roth;FILE,MAL;aa3013e12793b0b66febe9e587b38bb0
Susp_PowerShell_Sep17_1;Detects suspicious PowerShell script in combo with VBS or JS ;Internal Research;2017-09-30 00:00:00;60;Florian Roth;SCRIPT;a06561bfd6d7954b20d08c962be5584c
Susp_PowerShell_Sep17_2;Detects suspicious PowerShell script in combo with VBS or JS ;Internal Research;2017-09-30 00:00:00;75;Florian Roth;FILE,SCRIPT;9f959a750519450736bdec639faed105
Suspicious_AutoIt_by_Microsoft;Detects a AutoIt script with Microsoft identification;Internal Research - VT;2017-12-14 00:00:00;60;Florian Roth;EXE,FILE;b1ab19499a3bc25877a2c0033f156769
Suspicious_BAT_Strings;Detects a string also used in Netwire RAT auxilliary;https://pastebin.com/8qaiyPxs;2018-01-05 00:00:00;60;Florian Roth;MAL;096288f1c59e2d39359bac6c492e8783
Suspicious_JS_script_content;Detects suspicious statements in JavaScript files;Research on Leviathan https://goo.gl/MZ7dRg;2017-12-02 00:00:00;70;Florian Roth;SCRIPT;c4ff8b7f0a9876c0151b731812a220cc
Suspicious_PowerShell_WebDownload_1;Detects suspicious PowerShell code that downloads from web sites;Internal Research;2017-02-22 00:00:00;60;Florian Roth;SCRIPT;2b698db643c0d3613aa4dfd35f5b6b61
Suspicious_Script_Running_from_HTTP;Detects a suspicious ;https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100;2017-08-20 00:00:00;50;Florian Roth;;9aea42700ef9b213c29a5e46d66c2707
Suspicious_Size_chrome_exe;Detects uncommon file size of chrome.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;6c72d59dab450e4929dfc4d9f9e9de3c
Suspicious_Size_csrss_exe;Detects uncommon file size of csrss.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;f0a250c305180729278e5eb73dd32e4a
Suspicious_Size_explorer_exe;Detects uncommon file size of explorer.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;95082eda1cadc052e1967d974ece09bf
Suspicious_Size_firefox_exe;Detects uncommon file size of firefox.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;b3a5a70652057f334fc818a110efe609
Suspicious_Size_iexplore_exe;Detects uncommon file size of iexplore.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;b0957b83e22c8e5561edb6b8a3e25ac5
Suspicious_Size_igfxhk_exe;Detects uncommon file size of igfxhk.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;187e40d82d4acbf71bce459af350df38
Suspicious_Size_java_exe;Detects uncommon file size of java.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;8dfb790413e4c8e65e5705844ce1973d
Suspicious_Size_lsass_exe;Detects uncommon file size of lsass.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;6f52d255c6f1a702d591eacc111dffd7
Suspicious_Size_rundll32_exe;Detects uncommon file size of rundll32.exe;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;50f572aa9ac04739c15e48a7e2b663e6
Suspicious_Size_servicehost_dll;Detects uncommon file size of servicehost.dll;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;f753d55c8975223c3f57dbe21139e075
Suspicious_Size_smss_exe;Detects uncommon file size of smss.exe;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;9c5b6b04b8028b9a74c539bee18024e2
Suspicious_Size_spoolsv_exe;Detects uncommon file size of spoolsv.exe;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;2c7920d6862050fb0399aabc49a32aca
Suspicious_Size_svchost_exe;Detects uncommon file size of svchost.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;1a3a12a2135e83b6f547d7adf0f703c9
Suspicious_Size_taskhost_exe;Detects uncommon file size of taskhost.exe;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;6289839a09908cf668596fda8471aa01
Suspicious_Size_wininit_exe;Detects uncommon file size of wininit.exe;-;2015-12-23 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;47b765ada4ccb737a431b6dd7059821b
Suspicious_Size_winlogon_exe;Detects uncommon file size of winlogon.exe;-;2015-12-21 00:00:00;60;Florian Roth;EXE,EXTVAR,FILE;4ca18eae8a30fc1ad6ee48545d348145
SysInternals_Tool_Anomaly;SysInternals Tool Anomaly - does not contain Mark Russinovich as author;Internal Research;2016-12-06 00:00:00;50;Florian Roth;EXE,FILE;cddeac6cfa8f9d025ab09b0b44d0fd5b
TA17_293A_Query_Javascript_Decode_Function;-;https://www.us-cert.gov/ncas/alerts/TA17-293A;1970-01-01 01:00:00;75;other (modified by Florian Roth);;2ab53fdf8d76be5dc4b3f6a4ef5e881f
TA17_293A_Query_XML_Code_MAL_DOC;-;https://www.us-cert.gov/ncas/alerts/TA17-293A;1970-01-01 01:00:00;75;other (modified by Florian Roth);FILE;4c881a7123ebbb20350f9966af923e68
TA17_293A_Query_XML_Code_MAL_DOC_PT_2;-;https://www.us-cert.gov/ncas/alerts/TA17-293A;1970-01-01 01:00:00;75;other (modified by Florian Roth);FILE;67a7f44c74b9179e3ea93bfe8e9473a2
TA17_293A_energetic_bear_api_hashing_tool;Energetic Bear API Hashing Tool;-;1970-01-01 01:00:00;75;CERT RE Team;EXE,FILE,RUSSIA;2e53603ebc893a0e2babe154026c8656
TA17_293A_malware_1;inveigh pen testing tools & related artifacts;https://www.us-cert.gov/ncas/alerts/TA17-293A;2017-07-17 00:00:00;75;US-CERT Code Analysis Team (modified by Florian Roth);;b0bc1690ae0009f1e4a41a7e3fa5a17a
TA17_318B_volgmer;Malformed User Agent in Volgmer malware;https://www.us-cert.gov/ncas/alerts/TA17-318B;2017-11-15 00:00:00;75;US CERT;FILE;707e4be5aafdcfdb2f866ca2c2afc525
TA18_074A_screen;Detects malware mentioned in TA18-074A;https://www.us-cert.gov/ncas/alerts/TA18-074A;2018-03-16 00:00:00;75;Florian Roth;EXE,FILE;8856226c92431fc35f2f523d6fd0e8de
TA18_074A_scripts;Detects malware mentioned in TA18-074A;https://www.us-cert.gov/ncas/alerts/TA18-074A;2018-03-16 00:00:00;75;Florian Roth;;15e9e3122af3d2155ccd51db2f34284b
TA459_Malware_May17_1;Detects TA459 related malware;https://goo.gl/RLf9qU;2017-05-31 00:00:00;75;Florian Roth;FILE,MAL;1873db263183fe132c6b0dc6a4509572
TA459_Malware_May17_2;Detects TA459 related malware;https://goo.gl/RLf9qU;2017-05-31 00:00:00;75;Florian Roth;EXE,FILE,MAL;e54af08137beca67bdf30509009cb44d
TRITON_ICS_FRAMEWORK;TRITON framework recovered during Mandiant ICS incident response;https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html;1970-01-01 01:00:00;75;nicholas.carr @itsreallynick;;9d8a900242d6c3aacbad519b78d10a9a
TeleDoor_Backdoor;Detects the TeleDoor Backdoor as used in Petya Attack in June 2017;https://goo.gl/CpfJQQ;2017-07-05 00:00:00;75;Florian Roth;EXE,FILE,MAL,RANSOM;5c47701790d58c1a3dc110c11d0f6bc4
Tiny_Network_Tool_Generic;Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples);-;2014-08-10 00:00:00;40;Florian Roth;EXE,FILE,GEN,HKTL;ba73058cbb7abaf4b72d6e50d3a22a3f
TurlaMosquito_Mal_1;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;727f55bfcaece96cce1b1522e761beb9
TurlaMosquito_Mal_2;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;e61b480ad856a1c9faa3fbe05d4c89da
TurlaMosquito_Mal_3;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;1072204aa49b4b53d643bbd0e1cb53ba
TurlaMosquito_Mal_4;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;05eeef2b4696db27aaee7b10fd75943f
TurlaMosquito_Mal_5;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;363f83194e110f17a877fd70ecf582d6
TurlaMosquito_Mal_6;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;2cd1317774544fb2db23fd0a3b21b481
TurlaMosquito_Mal_7;Detects malware sample from Turla Mosquito report;https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf;2018-02-22 00:00:00;75;Florian Roth;EXE,FILE,RUSSIA;97c3c889e4e17cb4ef3f37b075d039ee
Turla_APT_Malware_Gen1;Detects Turla malware (based on sample used in the RUAG APT case);https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case;2016-06-09 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;378d747a8b1d50f9e8a633ea9772dc0b
Turla_APT_Malware_Gen2;Detects Turla malware (based on sample used in the RUAG APT case);https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case;2016-06-09 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;8d2782742892856d8c1acd6fea08365d
Turla_APT_Malware_Gen3;Detects Turla malware (based on sample used in the RUAG APT case);https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case;2016-06-09 00:00:00;75;Florian Roth;APT,EXE,FILE,MAL,RUSSIA;2ca12d50f35b0a3dd61f9ab225d24fcb
Turla_APT_srsvc;Detects Turla malware (based on sample used in the RUAG APT case);https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case;2016-06-09 00:00:00;75;Florian Roth;APT,EXE,FILE,RUSSIA;9a65217e2c2f000a82a7e970a2423316
Turla_KazuarRAT;Detects Turla Kazuar RAT described by DrunkBinary;https://twitter.com/DrunkBinary/status/982969891975319553;2018-04-08 00:00:00;75;Markus Neis / Florian Roth;EXE,FILE,MAL,RUSSIA;ab3353bc76cde790d9d81e8b32e6adda
Typical_Malware_String_Transforms;Detects typical strings in a reversed or otherwise modified form;Internal Research;2016-07-31 00:00:00;60;Florian Roth;EXE,FILE,MAL;495b5bbeee3e6ca4a40fa9b527941cc9
Tzddos_DDoS_Tool_CN;Disclosed hacktool set - file tzddos;-;2014-11-17 00:00:00;60;Florian Roth;HKTL;0951f1d147e0d88ff5e5a130057de058
UACME_Akagi;Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor;https://github.com/hfiref0x/UACME;2015-05-14 00:00:00;60;Florian Roth;MAL;f38734da4427adc7679421863eb9810f
UACME_Akagi_2;Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe;https://github.com/hfiref0x/UACME;2017-02-03 00:00:00;80;Florian Roth;EXE,FILE;26b20569c1f315363b7c07b3664ff069
URL_File_Local_EXE;Detects an .url file that points to a local executable;https://twitter.com/malwareforme/status/915300883012870144;2017-10-04 00:00:00;60;Florian Roth;;cc10db7c91677347a4eb04993e6b33dc
UnPack_rar_Folder_InjectT;Disclosed hacktool set (old stuff) - file InjectT.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;9e1e1c2bb13ec00569071012dd3e3a7b
UnPack_rar_Folder_TBack;Disclosed hacktool set (old stuff) - file TBack.DLL;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;ebca59b5c623c397f400e822068ae447
Unit78020_Malware_1;Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe;http://threatconnect.com/camerashy/?utm_campaign=CameraShy;2015-09-24 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,MAL;65d433751af588375650541429136607
Unit78020_Malware_Gen1;Detects malware by Chinese APT PLA Unit 78020 - Generic Rule;http://threatconnect.com/camerashy/?utm_campaign=CameraShy;2015-09-24 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,GEN,MAL;83728ac064469e96e2777f4cfec7f8f8
Unit78020_Malware_Gen2;Detects malware by Chinese APT PLA Unit 78020 - Generic Rule;http://threatconnect.com/camerashy/?utm_campaign=CameraShy;2015-09-24 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,GEN,MAL;56f9cfa9fcc5650cc824c3cac9d9ee87
Unit78020_Malware_Gen3;Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong;http://threatconnect.com/camerashy/?utm_campaign=CameraShy;2015-09-24 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE,GEN,MAL;94206241e8087036f47f47591f2d4c67
Universal_Exploit_Strings;Detects a group of strings often used in exploit codes;not set;2017-12-02 00:00:00;50;Florian Roth;SCRIPT;30d5be6afd352ecd58a10c4d232a55ce
Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;9786d434fceed0b4472ec44c1bdf3c03
Unknown_8af033424f9590a15472a23cc3236e68070b952e;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;69303ba6ed5d249b9b6ad47d5eadfe7a
Unknown_Malware_Sample_Jul17_2;Detects unknown malware sample with pastebin RAW URL;https://goo.gl/iqH8CK;2017-08-01 00:00:00;75;Florian Roth;EXE,FILE,MAL;6828e5bbbc31415b3953a5d895653ddf
Unspecified_Malware_Jul17_1A;Detects samples of an unspecified malware - July 2017;Winnti HDRoot VT;2017-07-07 00:00:00;75;Florian Roth;EXE,FILE,MAL;fe9788d0c0d535d06769cd625a8a6548
Unspecified_Malware_Oct16_A;Detects an unspecififed malware - October 2016;Internal Research;2016-10-08 00:00:00;80;Florian Roth;EXE,FILE,MAL;f8e83052a02b677675403c53328332a6
Unspecified_Malware_Oct16_C;Detects an unspecififed malware - October 2016;Internal Research;2016-10-08 00:00:00;80;Florian Roth;EXE,FILE,MAL;2adf625019818624251c6d1dbc8cbe85
UploadShell_98038f1efa4203432349badabad76d44337319a6;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;36659474d392b6d55f570eec009ecefa
User_Function_String;Detects user function string from NCSC report;https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control;2018-04-06 00:00:00;75;NCSC;;68e4e5d5ef2d24dcbd0d49a2d180d005
Utilman_ANOMALY;Abnormal utilman.exe - typical strings not found in file;-;2014-01-06 00:00:00;70;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;4cbe73bb63792729fa42aab6b643bff1
VBS_Obfuscated_Mal_Feb18_1;Detects malicious obfuscated VBS observed in February 2018;https://goo.gl/zPsn83;2018-02-12 00:00:00;75;Florian Roth;OBFUS,SCRIPT;fbf6d1d25ee8ee07562fac5e81687dfa
VBS_WMIExec_Tool_Apr17_1;Tools related to Operation Cloud Hopper;https://github.com/maaaaz/impacket-examples-windows;2017-04-07 00:00:00;75;Florian Roth;SCRIPT;1f5e0ae048d3984556ffaa80a0e15bbb
VBS_dropper_script_Dec17_1;Detects a supicious VBS script that drops an executable;Internal Research;2018-01-01 00:00:00;80;Florian Roth;SCRIPT;519fa7f7c61808fce2bc2aa4e415023e
VBScript_Favicon_File;VBScript cloaked as Favicon file used in Leviathan incident;https://goo.gl/MZ7dRg;2017-10-18 00:00:00;75;Florian Roth;FILE,SCRIPT;548165824a2ddeb6c693174bdfc84139
VSSown_VBS;Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere;-;2015-10-01 00:00:00;75;Florian Roth;HKTL,SCRIPT;ca9257eef68fa327b3865265928cf463
Venom_Rootkit;Venom Linux Rootkit;https://security.web.cern.ch/security/venom.shtml;2017-01-12 00:00:00;75;Florian Roth;LINUX,MAL;cb0709e616a18f2ab1143873246e5ed4
Volgmer_Malware;Detects Volgmer malware as reported in US CERT TA17-318B;https://www.us-cert.gov/ncas/alerts/TA17-318B;2017-11-15 00:00:00;75;Florian Roth;EXE,FILE,MAL;1cf972d589090c8e8f25a6425a7d098b
WAF_Bypass;Chinese Hacktool Set - file WAF-Bypass.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;fb69bb3f21d24c1e36273a950466bb73
WCE_Modified_1_1014;Modified (packed) version of Windows Credential Editor;-;1970-01-01 01:00:00;70;Florian Roth;HKTL;8025184cbea2802be6c716f2aa911079
WCE_in_memory;Detects Windows Credential Editor (WCE) in memory (and also on disk);Internal Research;2016-08-28 00:00:00;80;Florian Roth;HKTL;634fcb7acfe59de1147b96df09f6cee9
WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;8bfc6e21b0cfcec87a84c4cdc543f10f
WannaCry_Ransomware;Detects WannaCry Ransomware;https://goo.gl/HG2j5T;2017-05-12 00:00:00;75;Florian Roth (with the help of binar.ly);CRIME,EXE,FILE,MAL,RANSOM;813683d3aa5c224ca0cbb83ec856cf77
WannaCry_Ransomware_Gen;Detects WannaCry Ransomware;https://www.us-cert.gov/ncas/alerts/TA17-132A;2017-05-12 00:00:00;75;Florian Roth (based on rule by US CERT);CRIME,EXE,FILE,GEN,MAL,RANSOM;350882850aa0264087686aafcabc111e
WaterBug_fa_malware;Symantec Waterbug Attack - FA malware variant;http://t.co/rF35OaAXrl;2015-01-22 00:00:00;75;Symantec Security Response;;3260ea5197e722bc9e4f08f81821613f
WaterBug_sav;Symantec Waterbug Attack - SAV Malware;http://t.co/rF35OaAXrl;2015-01-22 00:00:00;75;Symantec Security Response;MAL;c617aff48fccbe38bbb77ebf59746a9e
Waterbear_10_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;f02572c4f1f22fa9d537891c9487ac62
Waterbear_11_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;e7f5e5affa5ea61578175717212adca7
Waterbear_12_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;ece90c9469f607af6ed978fadd8fedc6
Waterbear_13_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;a64ad8654c020362cf9b23e6708a2aae
Waterbear_14_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;9d3a60f21dd5273b0f1112e597aa5e5a
Waterbear_1_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;da12e8bbdb9bff68563dc29b4f30f379
Waterbear_2_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;39befe16ad2f4728465eccc6f1a2d12b
Waterbear_4_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;bb28036a98c272612c684e85668f5bf5
Waterbear_5_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;FILE;33eeb76f3e9e7258d5dfc9386ad446a9
Waterbear_6_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;b00343474b1d8b5aef8ae573c18f0fb1
Waterbear_7_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;c7f8a0b016f37ee4d13e643269b7ba0b
Waterbear_8_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;bcb9155330b570c1c0644cd7f6678bb2
Waterbear_9_Jun17;Detects malware from Operation Waterbear;https://goo.gl/L9g9eR;2017-06-23 00:00:00;75;Florian Roth;EXE,FILE;3224ffea601940bad27ab05940c6dfa9
WebCrack4_RouterPasswordCracking;Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;9b8787adb3ffde114a5b882d54039305
WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;97e21ccd95557e830dcc1bf78395a769
WebShell_AK_74_Security_Team_Web_Shell_Beta_Version;PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php;-;1970-01-01 01:00:00;75;Florian Roth;WEBSHELL;50104da4f2517412997e248744a69114
WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz;PHP Webshells Github Archive - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.php;-;1970-01-01 01:00:00;75;Florian Roth;WEBSHELL;1bbf8cba3b9ff1bbf203b542a83b0c3f
WebShell_JexBoss_WAR_1;Detects JexBoss versions in WAR form;Internal Research;2018-11-08 00:00:00;75;Florian Roth;FILE,WEBSHELL;32621519a4c08d5453423bba3e51ca59
WebShell_PHP_Web_Kit_v3;Detects PAS Tool PHP Web Kit;https://github.com/wordfence/grizzly;2016-01-01 00:00:00;75;Florian Roth;FILE;cc88ada76efa2268f305a9f588c12a51
WebShell_PHP_Web_Kit_v4;Detects PAS Tool PHP Web Kit;https://github.com/wordfence/grizzly;2016-01-01 00:00:00;75;Florian Roth;FILE;a86d493242c2dfe7d87fb09bdc9c4ae3
WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall;PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php;-;1970-01-01 01:00:00;75;Florian Roth;WEBSHELL;83db1a6fff21310afa749d817523db08
Webshell_Caterpillar_ASPX;Volatile Cedar Webshell - from file caterpillar.aspx;http://goo.gl/emons5;2015-04-03 00:00:00;75;Florian Roth;MIDDLE_EAST,WEBSHELL;63bfca160217bbd4794c9d52d24f19a7
Webshell_FOPO_Obfuscation_APT_ON_Nov17_1;Detects malware from NK APT incident DE;Internal Research - ON;2017-11-17 00:00:00;75;Florian Roth;APT,FILE,OBFUS,WEBSHELL;f362727b1b624a24491ed5832467914e
Webshell_and_Exploit_CN_APT_HK;Webshell and Exploit Code in relation with APT against Honk Kong protesters;-;2014-10-10 00:00:00;50;Florian Roth;APT,WEBSHELL;aa24085f67cb0949939760ef0cc2a3d0
Webshell_c100;Detects Webshell - rule generated from from files c100 v. 777shell;https://github.com/nikicat/web-malware-collection;2016-01-11 00:00:00;70;Florian Roth;WEBSHELL;1b68f3d546cb543d8bd0cec31ddd5343
WiltedTulip_Matryoshka_RAT;Detects Matryoshka RAT used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE,MAL;8d4d22d2f1bed7e55d1a8321f7f5605c
WiltedTulip_Netsrv_netsrvs;Detects sample from Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;f14e23cde811af2b1894fece8fb82141
WiltedTulip_ReflectiveLoader;Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;903b49f48f3839e7e4f4160ec7f6b372
WiltedTulip_SilverlightMSI;Detects powershell tool call Get_AD_Users_Logon_History used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;;5727badf7477a3e4ca17756f51890b65
WiltedTulip_Tools_back;Detects Chrome password dumper used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;88a6cf8324f1203b86aeb85a874056fc
WiltedTulip_Tools_clrlg;Detects Windows eventlog cleaner used in Operation Wilted Tulip - file clrlg.bat;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;;299110a0dfc05c80ac9cb50a36ef7e4c
WiltedTulip_WindowsTask;Detects hack tool used in Operation Wilted Tulip - Windows Tasks;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;;e72bad7c35f15d04e31f120ff89b61ea
WiltedTulip_Windows_UM_Task;Detects a Windows scheduled task as used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;;8733677d146ca5e1bf6852bbb0d96155
WiltedTulip_Zpp;Detects hack tool used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;b33682b2cd91fee91ea3f27b4181e9bb
WiltedTulip_matryoshka_Injector;Detects hack tool used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;506d959ff30835da357a46dc423f5a0b
WiltedTulip_powershell;Detects powershell script used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;;b8d51b15ffe31dff178aa64b92012424
WiltedTulip_tdtess;Detects malicious service used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;c27755eaf3e81b3935cd2b7cb6eefacc
WiltedTulip_vminst;Detects malware used in Operation Wilted Tulip;http://www.clearskysec.com/tulip;2017-07-23 00:00:00;75;Florian Roth;EXE,FILE;244de6fd531745d524839ae9f1ee0f96
WinRAR_SFX_Anomaly;Detects WinRAR SFX content with the product name of major vendor's tools (sus);-;2016-03-24 00:00:00;30;Florian Roth;EXE,FILE;434b885d8d8650738ac064d4b106a33e
Win_PrivEsc_ADACLScan4_3;Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1;https://adaclscan.codeplex.com/;2016-06-02 00:00:00;60;Florian Roth;;fb157df74f83433b8799c576fb9b93d4
Win_PrivEsc_folderperm;Detects a tool that can be used for privilege escalation - file folderperm.ps1;http://www.greyhathacker.net/?p=738;2016-06-02 00:00:00;80;Florian Roth;;c6d020fdb2c341ca2319e1e610c6203e
Win_PrivEsc_gp3finder_v4_0;Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe;http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/;2016-06-02 00:00:00;80;Florian Roth;EXE,FILE;63f3b51f6b461d3a91d62f5ada2f4fd0
Winexe_RemoteExecution;Winexe tool used by Sofacy group several APT cases;http://dokumente.linksfraktion.de/inhalt/report-orig.pdf;2015-06-19 00:00:00;70;Florian Roth;APT,EXE,FILE,RUSSIA;27644d19608d8f49660c3ffa4ed05120
Winnti_malware_FWPK;Detects a Winnti malware - FWPKCLNT.SYS;VTI research;2015-10-10 00:00:00;75;Florian Roth;CHINA,EXE,FILE;cfb4375bfea67ded293f982e694a68d8
Winnti_malware_Nsiproxy;Detects a Winnti rootkit;-;2015-10-10 00:00:00;75;Florian Roth;CHINA,EXE,FILE;dd12b43a7020dac3b83fb691a60510b9
Winnti_malware_StreamPortal_Gen;Detects a Winnti malware - Streamportal;VTI research;2015-10-10 00:00:00;75;Florian Roth;CHINA,EXE,FILE,GEN;1babba12643d522ec9869c192e786a26
Winnti_malware_UpdateDLL;Detects a Winnti malware - Update.dll;VTI research;2015-10-10 00:00:00;75;Florian Roth;CHINA,EXE,FILE;d394a36c721f84e9049a0a401faf7a14
Winnti_signing_cert;Detects a signing certificate used by the Winnti APT group;https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/;2015-10-10 00:00:00;75;Florian Roth;APT,CHINA,EXE,FILE;7f516b615d90fb27c00bd394bf85389d
WoolenGoldfish_Generic_1;Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ;http://goo.gl/NpJpVZ;2015-03-25 00:00:00;90;Florian Roth;GEN;74d1b02f71a242892c438474ca9b1889
WoolenGoldfish_Generic_2;Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ;http://goo.gl/NpJpVZ;2015-03-25 00:00:00;90;Florian Roth;GEN;ca2f74641174924e9780e0a9dbb9e472
WoolenGoldfish_Generic_3;Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ;http://goo.gl/NpJpVZ;2015-03-25 00:00:00;90;Florian Roth;GEN;69ddee0248af0613c2cad86c4ee57d4f
WoolenGoldfish_Sample_1;Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ;http://goo.gl/NpJpVZ;2015-03-25 00:00:00;60;Florian Roth;;2e2435291d817a44efd22e532d202b8c
WordDoc_PowerShell_URLDownloadToFile;Detects Word Document with PowerShell URLDownloadToFile;https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/;2017-02-23 00:00:00;75;Florian Roth;FILE,OFFICE,SCRIPT;87d9fd8b804fb0024aa59fd9841fdfcb
Wordpress_Config_Webshell_Preprend;Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it;Internal Research;2017-06-25 00:00:00;65;Florian Roth;FILE,OFFICE,WEBSHELL;497072fdd28e57d7884131d3bf1e52f9
Worse_Linux_Shell_php;Semi-Auto-generated - file Worse Linux Shell.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;LINUX,WEBSHELL;0c45de75272c42db9e783d417cace562
XOR_4byte_Key;Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan);http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family;2015-12-15 00:00:00;60;Florian Roth;EXE,FILE,MAL;803a44769d6e517b4e83b320955fe96f
Xtreme_RAT_Gen_Imp;Detects XTREME sample analyzed in September 2017;Internal Research;2017-09-27 00:00:00;75;Florian Roth;EXE,FILE,GEN,MAL;b6eda61d28d9e53ed455b9ac4b5f4e7f
Xtreme_Sep17_1;Detects XTREME sample analyzed in September 2017;Internal Research;2017-09-27 00:00:00;75;Florian Roth;EXE,FILE;10343d0e7b1acac9862f527b67ec5852
Xtreme_Sep17_2;Detects XTREME sample analyzed in September 2017;Internal Research;2017-09-27 00:00:00;75;Florian Roth;EXE,FILE;8e02c951f2bdb5ba33bee83aed95bf51
Xtreme_Sep17_3;Detects XTREME sample analyzed in September 2017;Internal Research;2017-09-27 00:00:00;75;Florian Roth;EXE,FILE;74f6e84cecfb523dbfc7553f80386786
ZXshell_20171211_chrsben;Detects ZxShell variant surfaced in Dec 17;https://goo.gl/snc85M;2017-12-11 00:00:00;75;Florian Roth;EXE,FILE;eed3c0ffa0ec4c09d70013689a2920f9
Z_WebShell;Detects Z Webshell from NCSC report;https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control;2018-04-06 00:00:00;75;NCSC;WEBSHELL;3493cb5d4fe894a69ac536083b6649cc
Zehir_4_asp;Semi-Auto-generated - file Zehir 4.asp.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;e15d702876107fd0881539486635eea7
Zeus_Panda;Detects ZEUS Panda Malware;https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf;2017-08-04 00:00:00;75;Florian Roth;CHINA,EXE,FILE,MAL;c997e355f805a1b7482632128a590f91
ZxShell_Jul17;Detects a ZxShell - CN threat group;https://blogs.rsa.com/cat-phishing/;2017-07-08 00:00:00;75;Florian Roth;;960b51abe999993e2f37b97c00aab61c
ZxShell_Related_Malware_CN_Group_Jul17_1;Detects a ZxShell related sample from a CN threat group;https://blogs.rsa.com/cat-phishing/;2017-07-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;f2b44d07a0b6c373f9951254481ecfff
ZxShell_Related_Malware_CN_Group_Jul17_2;Detects a ZxShell related sample from a CN threat group;https://blogs.rsa.com/cat-phishing/;2017-07-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;dd08b6b16c23daef88f18ba2b8dd4bd9
ZxShell_Related_Malware_CN_Group_Jul17_3;Detects a ZxShell related sample from a CN threat group;https://blogs.rsa.com/cat-phishing/;2017-07-08 00:00:00;75;Florian Roth;EXE,FILE,MAL;30989b54ed29b1db81ea655e983445b7
_1_c2007_php_php_c100_php;Semi-Auto-generated - from files 1.txt, c2007.php.php.txt, c100.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;e43084c84635549f7f50eca296fd0b4d
_Bitchin_Threads_;Auto-generated rule on file =Bitchin Threads=.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;3b86a6f8825e7083eab4afbb3af8f843
_Crystal_php_nshell_php_php_load_shell_php_php;Semi-Auto-generated - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;c1a03efe1675d593f9108cd96583448a
apt_ProjectSauron_MyTrampoline;Rule to detect ProjectSauron MyTrampoline module;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;FILE;28035368a7809dc0fdbac49cffd8077f
apt_ProjectSauron_encrypted_LSA;Rule to detect ProjectSauron encrypted LSA samples;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;EXTVAR,FILE;217cb2f14d48929959b4000738e447af
apt_ProjectSauron_encrypted_SSPI;Rule to detect encrypted ProjectSauron SSPI samples;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;EXTVAR,FILE;6a9285f65d1db311a3daa4720d60bafb
apt_ProjectSauron_encrypted_container;Rule to detect ProjectSauron samples encrypted container;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;EXTVAR,FILE;ab20df1e8d3673b596300c32721e8d85
apt_ProjectSauron_encryption;Rule to detect ProjectSauron string encryption;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;;b44e22742066f68f6487ec67e603b088
apt_ProjectSauron_generic_pipe_backdoor;Rule to detect ProjectSauron generic pipe backdoors;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;FILE,MAL;f4802bcfd2d29151d15a4ada9de50639
apt_ProjectSauron_pipe_backdoor;Rule to detect ProjectSauron pipe backdoors;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;FILE,MAL;b03ff7feeb50c1ce5ac40fc49c6f5fd8
apt_RU_MoonlightMaze_IRIX_exploit_GEN;Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;FILE;f5382f15d590e8b7d4db2582a5c3f145
apt_RU_MoonlightMaze_customlokitools;Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-15 00:00:00;75;Kaspersky Lab;;e7cbfcde5583b7e0472f0bf40456cca3
apt_RU_MoonlightMaze_customsniffer;Rule to detect Moonlight Maze sniffer tools;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-15 00:00:00;75;Kaspersky Lab;;39fece5cd3f66002b3c15103774ceaaa
apt_RU_MoonlightMaze_de_tool;Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;;0df4635deb993f330e8e420861343201
apt_RU_MoonlightMaze_encrypted_keylog;Rule to detect Moonlight Maze encrypted keylogger logs;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;FILE,HKTL;e4925f70d4b6f9ea4e155b547cae9068
apt_RU_MoonlightMaze_u_logcleaner;Rule to detect log cleaners based on utclean.c;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;FILE;35b9ff29a1ead717afc1325de27636c7
apt_RU_MoonlightMaze_wipe;Rule to detect log cleaner based on wipe.c;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;FILE;770a97bf75c94625579c0efece5008de
apt_RU_MoonlightMaze_xk_keylogger;Rule to detect Moonlight Maze 'xk' keylogger;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-27 00:00:00;75;Kaspersky Lab;HKTL;b4a90854d2ae42bcd04156f07fd4e795
apt_duqu2_drivers;Rule to detect Duqu 2.0 drivers;-;1970-01-01 01:00:00;75;-;FILE;ed8dfb7339d0182e66eb026c0e543612
apt_duqu2_loaders;Rule to detect Duqu 2.0 samples;-;1970-01-01 01:00:00;75;-;EXE,FILE;2504f4f9bb56ddfdcae097ba1874e0d6
apt_equation_cryptotable;Rule to detect the crypto library used in Equation group malware;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;;1113d9250bb6388fd75226479aebd8e0
apt_equation_doublefantasy_genericresource;Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW;http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/;1970-01-01 01:00:00;75;-;;73303480172f14f0ba47ad3e31d078c5
apt_equation_equationlaser_runtimeclasses;Rule to detect the EquationLaser malware;https://securelist.com/blog/;1970-01-01 01:00:00;75;-;;d4ddb620e02e00c09390704fcaeba0cd
apt_equation_exploitlib_mutexes;Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW;http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/;1970-01-01 01:00:00;75;-;;ba262131482ebc7db3dadf6135b09053
apt_equation_keyword;Rule to detect Equation group's keyword in executable file;http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/;1970-01-01 01:00:00;75;Florian Roth (auto-filled);EXE,FILE;ba178f21aa42b409c8afc2f70d59eaff
apt_hellsing_implantstrings;detection for Hellsing implants;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;b2d60797f37691ee8f58fd237979b0e0
apt_hellsing_installer;detection for Hellsing xweber/msger installers;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;6c83582f80d2baec697c6e0abad4a2c7
apt_hellsing_irene;detection for Hellsing msger irene installer;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;e03e9290afec0ec22f57c93ed5d3dfe0
apt_hellsing_msgertype2;detection for Hellsing msger type 2 implants;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;f5a1fd8f46c824cecc59a1cd90010c0b
apt_hellsing_proxytool;detection for Hellsing proxy testing tool;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;c230366df2c8b2f81481c061f31b770c
apt_hellsing_xkat;detection for Hellsing xKat tool;-;2015-04-07 00:00:00;75;Costin Raiu, Kaspersky Lab;;ed43036b6eea1b76a549da86dcbce89d
blackenergy3_installer;Matches unique code block for import name construction ;https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf;2015-05-29 00:00:00;75;Mike Schladt;;1f2732586d1e4c8f555836d455bea0a5
cachedump;Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;636450218951b5fc4b6a3438821d6d32
ce_enfal_cmstar_debug_msg;Detects the static debug strings within CMSTAR;http://goo.gl/JucrP9;2015-05-10 00:00:00;75;rfalcone;EXE,FILE;12232a5ed0f968d7364799de4ac6b187
churrasco;Chinese Hacktool Set - file churrasco.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;3046162de9ac33671d4b1b8e073eb31e
clean_apt15_patchedcmd;This is a patched CMD. This is the CMD that RoyalCli uses.;-;1970-01-01 01:00:00;75;Ahmed Zaki;FILE;c515c94d988e8c312ad547d114f1c39b
conhost_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file conhost.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;6000fd3d5de836d9bc4e5b7e55c0926d
connectback2_pl;Semi-Auto-generated - file connectback2.pl.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;3aebcc815380f3f2ab69ef4b004e98fe
csh_php_php;Semi-Auto-generated - file csh.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;8837657cf099791938128b4bf969ce6c
csrss_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file csrss.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;03d348dd675cc7a09fb126bbfbc9c05f
custom_ssh_backdoor_server;Custome SSH backdoor based on python and paramiko - file server.py;https://goo.gl/S46L3o;2015-05-14 00:00:00;75;Florian Roth;MAL;25d016ee3d9bf64a6343b857a415c494
cyberlords_sql_php_php;Semi-Auto-generated - file cyberlords_sql.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;ba8a510b4de92ef4cf7ab015674499be
cyclotron;Chinese Hacktool Set - file cyclotron.sys;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;b8e7fed1fa94e26ac9ecf660665df956
datPcShare;Chinese Hacktool Set - file datPcShare.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;593dd2af262cc16a4e886322deb29e36
dat_NaslLib;Chinese Hacktool Set - file NaslLib.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;2fa3d0c5b58f509b508242fc88a5ff38
dat_report;Chinese Hacktool Set - file report.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;77f62cd039a24bd4baec30cfee4c71d0
dat_xpf;Chinese Hacktool Set - file xpf.sys;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;4a0f6e59e6dc01c7df5ac5696708ddb8
dbexpora;Chinese Hacktool Set - file dbexpora.dll;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;298f48a95251fe707d37b72df2c0c036
derusbi_kernel;Derusbi Driver version;-;2015-12-09 00:00:00;75;Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud;FILE;eb91ac39dc4f1929b35f8b5fa550dff7
derusbi_linux;Derusbi Server Linux version;-;2015-12-09 00:00:00;75;Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud;LINUX;581b9af4dc8734a0be16b722c408cf90
dll_Reg;Chinese Hacktool Set - file Reg.bat;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,SCRIPT;2a877bf7526e2afe4d21fb479151141f
dll_UnReg;Chinese Hacktool Set - file UnReg.bat;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,SCRIPT;a106773454143a1048cb0680104f5b5c
dnscat2_Hacktool;Detects dnscat2 - from files dnscat, dnscat2.exe;https://downloads.skullsecurity.org/dnscat2/;2016-05-15 00:00:00;75;Florian Roth;EXE,FILE,HKTL;15f0257a6725f8a15961acd03ff8dc8b
doskey_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file doskey.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;0d7bab04a1ad5def9e50448a64a9fb3d
dubseven_dropper_dialog_remains;Searches for related dialog remnants. How rude.;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;63221ed9d4dbd4eb4774fc4b6fd3a8ef
dubseven_dropper_registry_checks;Searches for registry keys checked for by the dropper;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;90b594aa86fb3bbf1a868ac3b9dc532a
dubseven_file_set;Searches for service files loading UP007;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;a69faef356dc674e9bcfd722b574cdc2
exploit_ole_stdolelink;StdOleLink, potential 0day in April 2017;-;1970-01-01 01:00:00;55;David Cannings;EXTVAR;544e7758f31b2839b2945b646cbe4f2c
explorer_ANOMALY;Abnormal explorer.exe - typical strings not found in file;-;2014-05-27 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;7163770a8a8ed46cb7e948e205b7da24
f3_diy;Chinese Hacktool Set - file diy.asp;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,FILE,HKTL,WEBSHELL;6949576e7997139b23b8a8f912039c26
fgexec;Detects a tool used by APT groups - file fgexec.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;5aa34e6a2a246aaca730872c20aff1c8
glassRAT;Detects GlassRAT by RSA (modified by Florian Roth - speed improvements);-;2015-11-03 00:00:00;75;RSA RESEARCH;MAL;0dd040086ce93ef6115762b088223ff8
h4ntu_shell__powered_by_tsoi_;Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;79c16815b63984713315f04934e85c0f
hatman;Matches the known samples of the HatMan malware.;https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware;2017-12-19 00:00:00;75;DHS/NCCIC/ICS-CERT;EXTVAR;b43c452b01655f6e7aa995edfc4faafd
hidshell_php_php;Semi-Auto-generated - file hidshell.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;904ca614620ebfae9c69cf603a7315c3
hkdoor_backdoor;Hacker's Door Backdoor;https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html;1970-01-01 01:00:00;75;Cylance Inc.;EXE,FILE,MAL;2888cb6f3755d7e4a3d055a5839d9696
hkdoor_backdoor_dll;Hacker's Door Backdoor DLL;https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html;1970-01-01 01:00:00;75;Cylance Inc.;EXE,FILE,MAL;1ab777d959b8d40ae9a40eb451180b7f
hkdoor_driver;Hacker's Door Driver;-;1970-01-01 01:00:00;75;Florian Roth (auto-filled);EXE,FILE;315d255ff35c1f7980ceca52e67d8f06
hkdoor_dropper;Hacker's Door Dropper;https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html;1970-01-01 01:00:00;75;Cylance Inc.;EXE,EXTVAR,FILE,MAL;4a0ca23791dd6152ad1218114833019a
iKAT_command_lines_agent;iKAT hack tools set agent - file ikat.exe;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;75;Florian Roth;HKTL;90b87fbe08aeab845a2b3802a1ed6457
iKAT_priv_esc_tasksch;Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista.;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;75;Florian Roth;HKTL;0db6047cbc9747face3a71a917cdf436
iKAT_revelations;iKAT hack tool showing the content of password fields - file revelations.exe;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;75;Florian Roth;HKTL;82c5743854c09d67937ba39b6d3a0fb3
iKAT_startbar;Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;50;Florian Roth;HKTL;216bdb1439d9e1168cbe45a297776a23
iKAT_tools_nmap;Generic rule for NMAP - based on NMAP 4 standalone;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;50;Florian Roth;GEN,HKTL;2621b155f0e5c9d56fd97d8227e6cd11
iKAT_wmi_rundll;This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe;http://ikat.ha.cked.net/Windows/functions/ikatfiles.html;2014-05-11 00:00:00;65;Florian Roth;HKTL;3cb042b0f99767c80534fb7302a518ba
iexplore_ANOMALY;Abnormal iexplore.exe - typical strings not found in file;-;2014-04-23 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;1188f9594966d9c2173630898dffce1a
lazaruswannacry;Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta;https://twitter.com/neelmehta/status/864164081116225536;2017-05-15 00:00:00;75;Costin G. Raiu, Kaspersky Lab;FILE,MAL,NK,RANSOM;bd8fe0a10869c2164ed47fe11609e871
lnk_detect;Detects malicious LNK file from NCSC report;https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control;2018-04-06 00:00:00;75;NCSC;FILE;ef173f984427761c31820f50cc6596aa
loki2crypto;Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */;https://en.wikipedia.org/wiki/Moonlight_Maze;2017-03-21 00:00:00;75;Costin Raiu, Kaspersky Lab;;3ffa9692450dce83bff0d6b1614f796e
lsass_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file lsass.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;6de1a35b6ea13be71ec3ce64baefd368
lsremora;Detects a tool used by APT groups;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;fe8c425425ed93eed1e2732290440b48
lurm_safemod_on_cgi;Semi-Auto-generated - file lurm_safemod_on.cgi.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;cbb8cdf15b1454ef556415f787a709da
magnify_ANOMALY;Abnormal magnify.exe (Magnifier) - typical strings not found in file;-;2014-01-06 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;7ebc4f239bd3b0c91541a89b838fc399
maindll_mutex;Matches on the maindll mutex;-;2016-04-18 00:00:00;75;Matt Brooks, @cmatthewbrooks;FILE;7e9aa5d5dac442cbe576f23730f564a3
malware_apt15_exchange_tool;This is a an exchange enumeration/hijacking tool used by an APT 15;-;1970-01-01 01:00:00;75;Ahmed Zaki;APT,FILE;9a750c1f8ae6e5859bb4848297b1c134
malware_apt15_generic;Find generic data potentially relating to AP15 tools;-;1970-01-01 01:00:00;75;David Cannings;;2e592d5d7630faf07239b6561e9db05b
malware_apt15_royalcli_1;Generic strings found in the Royal CLI tool;-;1970-01-01 01:00:00;75;David Cannings;FILE,GEN;05b65da919e071c06561c0c9f2760b2d
malware_apt15_royaldll;DLL implant, originally rights.dll and runs as a service;-;1970-01-01 01:00:00;75;David Cannings;;fc0995094c570c8b0985b22f5781b5c8
malware_apt15_royaldll_2;DNS backdoor used by APT15;-;1970-01-01 01:00:00;75;Ahmed Zaki;APT,FILE,MAL;0f86b9753a269e00ab61e2fce336735d
malware_sakula_memory;Sakula malware - strings after unpacking (memory rule);-;1970-01-01 01:00:00;75;David Cannings;;84dca55538bb8e72fa854bff207b3e5f
malware_sakula_shellcode;Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula;-;1970-01-01 01:00:00;75;David Cannings;;e16dac83956a234f4cea66f300f00d20
malware_sakula_xorloop;XOR loops from Sakula malware;-;1970-01-01 01:00:00;75;David Cannings;;298ae70c25c7a60fddf48d67655bd50a
ms10048_x64;Chinese Hacktool Set - file ms10048-x64.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;54ac93e2d46d3047d2f20c841211e7e2
ms10048_x86;Chinese Hacktool Set - file ms10048-x86.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;925da43346f39314f49dd87da5371a42
ms11080_withcmd;Chinese Hacktool Set - file ms11080_withcmd.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;0bb8bc61c2767f2ee718bf241887c9fd
msi_dll_Anomaly;Detetcs very small and supicious msi.dll;https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar;2017-02-10 00:00:00;75;Florian Roth;EXE,EXTVAR,FILE;1d576fa4cffe5b60ba29e4a51502c20a
mswin_check_lm_group;Chinese Hacktool Set - file mswin_check_lm_group.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;94b26263646b42303edd528cc0290898
multiple_php_webshells;Semi-Auto-generated - from files multiple_php_webshells;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;40043c79942f4fdac240752066560c3e
multiple_php_webshells_2;Semi-Auto-generated ;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;52be6ddcb48702c0f70c63724c1bd1d0
myshell_php_php;Semi-Auto-generated - file myshell.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;345b2927ef2dff24cf7033ec0f444f2d
mysql_php_php;Semi-Auto-generated - file mysql.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;fec8ad70a2458b33bcabb3d1551fffd9
mysql_pwd_crack;Chinese Hacktool Set - file mysql_pwd_crack.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;5856627847855b675e8a66a67a50a140
mysql_shell_php;Semi-Auto-generated - file mysql_shell.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;17480783154b67d617c06169faed44b9
mysql_tool_php_php;Semi-Auto-generated - file mysql_tool.php.php.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;b5a9a1972df53fd74b9389e02efd4545
mysqlfast;Chinese Hacktool Set - file mysqlfast.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d451ea12d7a1aab5bde2d776a05a5eb6
narrator_ANOMALY;Abnormal narrator.exe - typical strings not found in file;-;2014-01-06 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;e341d3c6edc5d865508ac98fc77bf2b9
notepad_ANOMALY;Abnormal notepad.exe - typical strings not found in file;-;2014-01-06 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;25fd6f2b5b4bf72e35c04c2adcc3cb13
osk_ANOMALY;Abnormal osk.exe (On Screen Keyboard) - typical strings not found in file;-;2014-01-06 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;3596194f79d589ad48fa6db351425906
packager_cve2017_11882;Attempts to exploit CVE-2017-11882 using Packager;https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py;1970-01-01 01:00:00;60;Rich Warren;EXPLOIT,FILE;864e2d071c88012cb04b967e10737265
portscan;Auto-generated rule on file portscan.exe;-;1970-01-01 01:00:00;75;yarGen Yara Rule Generator by Florian Roth;HKTL;05eb3b63f970d40cbd939361ad69e05b
portscanner;Chinese Hacktool Set - file portscanner.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;447ce7e8937ddc42b833d9c31dc5f3af
power_pe_injection;PowerShell with PE Reflective Injection;-;1970-01-01 01:00:00;75;Benjamin DELPY (gentilkiwi);HKTL,SCRIPT;6a47798d77ed935f790562515be60443
pstgdump;Detects a tool used by APT groups - file pstgdump.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;6a82cd50d7dd5c507b0656dafc3f5eb4
pw_inspector;Chinese Hacktool Set - file pw-inspector.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;cdb2585b1cd68ce4c169bfd8e44b3ea2
pw_inspector_2;Chinese Hacktool Set - file pw-inspector.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;1bdcca68966bd00abe175670ec2cdf8f
reDuhServers_reDuh;Chinese Hacktool Set - file reDuh.jsp;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;9b013a288dfe671ae7b7c07280f5cb55
reDuhServers_reDuh_2;Chinese Hacktool Set - file reDuh.php;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;8cb4ec6b7aba4bd99d7a582cab34e23c
reDuhServers_reDuh_3;Chinese Hacktool Set - file reDuh.aspx;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;8d58a95adde8aaf74ba16b15bce45c43
redSails_EXE;Detects Red Sails Hacktool by WinDivert references;https://github.com/BeetleChunks/redsails;2017-10-02 00:00:00;75;Florian Roth;EXE,FILE,HKTL;da9633674219be99df24384fa40bab11
redSails_PY;Detects Red Sails Hacktool - Python;https://github.com/BeetleChunks/redsails;2017-10-02 00:00:00;75;Florian Roth;HKTL,SCRIPT;ba2ac36ab55b1fd16f004ba9f391cf25
rtf_cve2017_11882;Attempts to identify the exploit CVE 2017 11882;https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about;1970-01-01 01:00:00;60;John Davison;EXPLOIT,EXTVAR;bdf84cc2d7a4edd1bd57d059dc03e442
rtf_cve2017_11882_ole;Attempts to identify the exploit CVE 2017 11882;https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about;1970-01-01 01:00:00;60;John Davison;EXPLOIT,EXTVAR;eea52fd013d7c4303989b807e48ec498
s4u;Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe;https://github.com/aurel26/s-4-u-for-windows;2015-06-05 00:00:00;50;Florian Roth;EXE,FILE;c9c9889458ed606219f46245264978a9
servpw;Detects a tool used by APT groups - file servpw.exe;http://goo.gl/igxLyF;2016-09-08 00:00:00;75;Florian Roth;APT,EXE,FILE,HKTL;4c44aaef2888b360d207a57fb67437d7
shimrat;Detects ShimRat and the ShimRat loader;-;2015-11-20 00:00:00;75;Yonathan Klijnsma (yonathan.klijnsma@fox-it.com);;396f77d8723852b35b60f81bfb8201e3
sig_238_2323;Disclosed hacktool set (old stuff) - file 2323.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;671ecf0f8b6451bc5c1aa9822e3b2e4d
sig_238_FPipe;Disclosed hacktool set (old stuff) - file FPipe.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;3db253e4e8432bb8bb5015730f7e2b11
sig_238_Glass2k;Disclosed hacktool set (old stuff) - file Glass2k.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;109ddfa900feb5cc832d6dde9a9faeb4
sig_238_RunAsEx;Disclosed hacktool set (old stuff) - file RunAsEx.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;ee5690ee979328383c1f9dcaaf43c2c8
sig_238_TELNET;Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;24094ccb0fee5134ebe3042e422a7ce7
sig_238_TFTPD32;Disclosed hacktool set (old stuff) - file TFTPD32.EXE;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;308719a15261f0bc7bc3f807152f3d77
sig_238_cmd_2;Disclosed hacktool set (old stuff) - file cmd.jsp;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;7107159672bd9af551b33f201449f635
sig_238_concon;Disclosed hacktool set (old stuff) - file concon.com;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;ffbccd48a9a7dbdba2c7e92818b342c1
sig_238_eee;Disclosed hacktool set (old stuff) - file eee.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;55a284e8eaa2e6966d56a14e52a6b5ed
sig_238_findoor;Disclosed hacktool set (old stuff) - file findoor.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;7800fd8cc8ca0466391049c268dc2337
sig_238_fscan;Disclosed hacktool set (old stuff) - file fscan.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;cf9a542f748189c5207853f0e1a7b079
sig_238_gina;Disclosed hacktool set (old stuff) - file gina.reg;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;3f0138e7977aae0c86a0a8174f9e0a33
sig_238_hunt;Disclosed hacktool set (old stuff) - file hunt.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;30a573a5939b5db3587379f1f48383fe
sig_238_iecv;Disclosed hacktool set (old stuff) - file iecv.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;ef78d13c83964ded149079e505de6151
sig_238_letmein;Disclosed hacktool set (old stuff) - file letmein.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;0797c03e127ff981c82de2e25d679d05
sig_238_listip;Disclosed hacktool set (old stuff) - file listip.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;79d94d763d652bdabb4ea2e6b4fe2f05
sig_238_nbtdump;Disclosed hacktool set (old stuff) - file nbtdump.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;12788ca834543dd859ee6c13a8f8d9d3
sig_238_sqlcmd;Disclosed hacktool set (old stuff) - file sqlcmd.exe;-;2014-11-23 00:00:00;40;Florian Roth;HKTL;95a458be072e67dced4c92ac44754be8
sig_238_token;Disclosed hacktool set (old stuff) - file token.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;f7664d9b3f1d9c5af0c430f5fc2a51a8
sig_238_webget;Disclosed hacktool set (old stuff) - file webget.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;83377684db249cd55e2554876b9b15b6
sig_238_xsniff;Disclosed hacktool set (old stuff) - file xsniff.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;2826aa5f80e3131170948e146cd8e2a4
subTee_nativecmd;NativeCmd - used by various threat groups;https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/;2015-07-10 00:00:00;40;Florian Roth;EXE,FILE;fa3bc97508d5b59a667e73793141677e
superscan3_0;Disclosed hacktool set (old stuff) - file superscan3.0.exe;-;2014-11-23 00:00:00;60;Florian Roth;HKTL;829decbab49f42e23a685d5f2ec467ba
susp_file_enumerator_with_encrypted_resource_101;Generic detection for samples that enumerate files with encrypted resource called 101;https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/;1970-01-01 01:00:00;75;-;EXTVAR,FILE,GEN;3ed00faaf9f60ca3fce42daf625d22f2
svchost_ANOMALY;Abnormal svchost.exe - typical strings not found in file;-;2014-04-23 00:00:00;55;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;a53bc1a64613fa7269958fb51de965cb
taskmgr_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file taskmgr.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;ce28b3e636b792dfb173eb815840cc44
telnet_cgi;Semi-Auto-generated - file telnet.cgi.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;caa1f6ec7d8cb95421c74829761537f7
telnet_pl;Semi-Auto-generated - file telnet.pl.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;77a38a261ee4bb41ff20cae0251972be
telnetd_pl;Semi-Auto-generated - file telnetd.pl.txt;-;1970-01-01 01:00:00;75;Neo23x0 Yara BRG + customization by Stefan -dfate- Molls;WEBSHELL;eee6760bf5a9f11145c5dc7008692d85
templatr;Chinese Hacktool Set - file templatr.php;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;2cfe692b5b0641931a272a133b5f4635
tools_NTCmd;Chinese Hacktool Set - file NTCmd.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;d7246b437634f7133081f76de2a68cf8
tools_Sqlcmd;Chinese Hacktool Set - file Sqlcmd.exe;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,EXE,FILE,HKTL;acaa57fceebfa8b196b20ee49b3dc93e
trigger_drop;Chinese Hacktool Set - file trigger_drop.php;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;b1336b4b6722c4aad2a7f417e3b8829f
trigger_modify;Chinese Hacktool Set - file trigger_modify.php;http://tools.zjqhr.com/;2015-06-13 00:00:00;75;Florian Roth;CHINA,HKTL,WEBSHELL;2606a5120e7f259adda923febcc83375
turla_png_dropper;Detects the PNG Dropper used by the Turla group;https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/;2018-11-23 00:00:00;75;Ben Humphrey;FILE,MAL,RUSSIA;de95b6ccb16010b9cac218bf9641f013
turla_png_reg_enum_payload;Payload that has most recently been dropped by the Turla PNG Dropper;https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/;2018-11-23 00:00:00;75;Ben Humphrey;FILE,MAL,RUSSIA;5290cd0791a4a647c04d8210dba5f305
webshell_MySQL_Web_Interface_Version_0_8;Web Shell - file MySQL Web Interface Version 0.8.php;-;2014-01-28 00:00:00;70;Florian Roth;WEBSHELL;7e0986b901c9f243894464b80aa3c6fb
webshell_Mysql_interface_v1_0;Web Shell - file Mysql interface v1.0.php;-;2014-01-28 00:00:00;70;Florian Roth;WEBSHELL;1f940f598a9df629fd3018290d2eef2a
webshell_e8eaf8da94012e866e51547cd63bb996379690bf;Detects a web shell;https://github.com/bartblaze/PHP-backdoors;2016-09-10 00:00:00;75;Florian Roth;FILE,WEBSHELL;932ada53abd9853e82637abe4315051c
wininit_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file wininit.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;f99d9489cef2ffe884c121aea2be371d
winlogon_ANOMALY;Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file winlogon.exe;not set;2015-03-16 00:00:00;75;Florian Roth;ANOMALY,EXTVAR,REQ_PRIVATE,SUSP;4a3d7db2d2e7ec83cbc5bee1198d5a7d
