Skip to content

Commit 76575d4

Browse files
fusionracemimeframe
fusionrace
authored and
mimeframe
committed
[Rules] Reorganized folders and files (#38)
1 parent f9c718e commit 76575d4

File tree

58 files changed

+832
-878
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+832
-878
lines changed

‎rules/public/MachO.yara

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
private rule MachO
2+
{
3+
meta:
4+
description = "Mach-O binaries"
5+
condition:
6+
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
7+
}

‎rules/public/hacktool/linux/__init__.py

Whitespace-only changes.

‎rules/public/hacktool_macos.yara renamed to ‎rules/public/hacktool/macos/hacktool_macos_macpmem.yara

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,11 @@
1-
import "pe"
1+
include "../../MachO.yara"
22

3-
private rule MachO
4-
{
5-
meta:
6-
description = "Mach-O binaries"
7-
condition:
8-
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
9-
}
10-
11-
rule tool_macpmem
3+
rule hacktool_macos_macpmem
124
{
135
meta:
146
description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
157
reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
16-
author = "Airbnb CSIRT"
8+
author = "@mimeframe"
179
strings:
1810
// osxpmem
1911
$a1 = "%s/MacPmem.kext" wide ascii

‎rules/public/hacktool/multi/hacktool_multi_bloodhound_owned.yara

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule hacktool_multi_bloodhound_owned
2+
{
3+
meta:
4+
description = "Bloodhound: Custom queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains"
5+
reference = "https://github.com/porterhau5/BloodHound-Owned/"
6+
author = "@fusionrace"
7+
strings:
8+
$s1 = "Find all owned Domain Admins" fullword ascii wide
9+
$s2 = "Find Shortest Path from owned node to Domain Admins" fullword ascii wide
10+
$s3 = "List all directly owned nodes" fullword ascii wide
11+
$s4 = "Set owned and wave properties for a node" fullword ascii wide
12+
$s5 = "Find spread of compromise for owned nodes in wave" fullword ascii wide
13+
$s6 = "Show clusters of password reuse" fullword ascii wide
14+
$s7 = "Something went wrong when creating SharesPasswordWith relationship" fullword ascii wide
15+
$s8 = "reference doc of custom Cypher queries for BloodHound" fullword ascii wide
16+
$s9 = "Created SharesPasswordWith relationship between" fullword ascii wide
17+
$s10 = "Skipping finding spread of compromise due to" fullword ascii wide
18+
condition:
19+
any of them
20+
}

‎rules/public/hacktool/multi/hacktool_multi_jtesta_ssh_mitm.yara

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
rule hacktool_multi_jtesta_ssh_mitm
2+
{
3+
meta:
4+
description = "intercepts ssh connections to capture credentials"
5+
reference = "https://github.com/jtesta/ssh-mitm"
6+
author = "@fusionrace"
7+
strings:
8+
$a1 = "INTERCEPTED PASSWORD:" wide ascii
9+
$a2 = "more sshbuf problems." wide ascii
10+
condition:
11+
all of ($a*)
12+
}

‎rules/public/hacktool/multi/hacktool_multi_masscan.yara

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule hacktool_multi_masscan
2+
{
3+
meta:
4+
description = "masscan is a performant port scanner, it produces results similar to nmap"
5+
reference = "https://github.com/robertdavidgraham/masscan"
6+
author = "@mimeframe"
7+
strings:
8+
$a1 = "EHLO masscan" fullword wide ascii
9+
$a2 = "User-Agent: masscan/" wide ascii
10+
$a3 = "/etc/masscan/masscan.conf" fullword wide ascii
11+
$b1 = "nmap(%s): unsupported. This code will never do DNS lookups." wide ascii
12+
$b2 = "nmap(%s): unsupported, we do timing WAY different than nmap" wide ascii
13+
$b3 = "[hint] I've got some local priv escalation 0days that might work" wide ascii
14+
$b4 = "[hint] VMware on Macintosh doesn't support masscan" wide ascii
15+
condition:
16+
all of ($a*) or any of ($b*)
17+
}

‎rules/public/hacktool/multi/hacktool_multi_ncc_ABPTTS.yara

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule hacktool_multi_ncc_ABPTTS
2+
{
3+
meta:
4+
description = "Allows for TCP tunneling over HTTP"
5+
reference = "https://github.com/nccgroup/ABPTTS"
6+
author = "@mimeframe"
7+
strings:
8+
$s1 = "---===[[[ A Black Path Toward The Sun ]]]===---" ascii wide
9+
$s2 = "https://vulnerableserver/EStatus/" ascii wide
10+
$s3 = "Error: no ABPTTS forwarding URL was specified. This utility will now exit." ascii wide
11+
// access key
12+
$s4 = "tQgGur6TFdW9YMbiyuaj9g6yBJb2tCbcgrEq" fullword ascii wide
13+
// encryption key
14+
$s5 = "63688c4f211155c76f2948ba21ebaf83" fullword ascii wide
15+
// log file
16+
$s6 = "ABPTTSClient-log.txt" fullword ascii wide
17+
condition:
18+
any of them
19+
}

‎rules/public/hacktool/multi/hacktool_multi_ntlmrelayx.yara

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
rule hacktool_multi_ntlmrelayx
2+
{
3+
meta:
4+
description = "https://www.fox-it.com/en/insights/blogs/blog/inside-windows-network/"
5+
reference = "https://github.com/CoreSecurity/impacket/blob/master/examples/ntlmrelayx.py"
6+
author = "@mimeframe"
7+
strings:
8+
$a1 = "Started interactive SMB client shell via TCP" wide ascii
9+
$a2 = "Service Installed.. CONNECT!" wide ascii
10+
$a3 = "Done dumping SAM hashes for host:" wide ascii
11+
$a4 = "DA already added. Refusing to add another" wide ascii
12+
$a5 = "Domain info dumped into lootdir!" wide ascii
13+
condition:
14+
any of ($a*)
15+
}

‎rules/public/hacktool/multi/hacktool_multi_pyrasite_py.yara

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule hacktool_multi_pyrasite_py
2+
{
3+
meta:
4+
description = "A tool for injecting arbitrary code into running Python processes."
5+
reference = "https://github.com/lmacken/pyrasite"
6+
author = "@fusionrace"
7+
strings:
8+
$s1 = "WARNING: ptrace is disabled. Injection will not work." fullword ascii wide
9+
$s2 = "A payload that connects to a given host:port and receives commands" fullword ascii wide
10+
$s3 = "A reverse Python connection payload." fullword ascii wide
11+
$s4 = "pyrasite - inject code into a running python process" fullword ascii wide
12+
$s5 = "The ID of the process to inject code into" fullword ascii wide
13+
$s6 = "This file is part of pyrasite." fullword ascii wide
14+
$s7 = "https://github.com/lmacken/pyrasite" fullword ascii wide
15+
$s8 = "Setup a communication socket with the process by injecting" fullword ascii wide
16+
$s9 = "a reverse subshell and having it connect back to us." fullword ascii wide
17+
$s10 = "Write out a reverse python connection payload with a custom port" fullword ascii wide
18+
$s11 = "Wait for the injected payload to connect back to us" fullword ascii wide
19+
$s12 = "PyrasiteIPC" fullword ascii wide
20+
$s13 = "A reverse Python shell that behaves like Python interactive interpreter." fullword ascii wide
21+
$s14 = "pyrasite cannot establish reverse" fullword ascii wide
22+
condition:
23+
any of them
24+
}

‎rules/public/hacktool/multi/hacktool_multi_responder_py.yara

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule hacktool_multi_responder_py
2+
{
3+
meta:
4+
description = "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server"
5+
reference = "http://www.c0d3xpl0it.com/2017/02/compromising-domain-admin-in-internal-pentest.html"
6+
author = "@fusionrace"
7+
strings:
8+
$s1 = "Poison all requests with another IP address than Responder's one." fullword ascii wide
9+
$s2 = "Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned." fullword ascii wide
10+
$s3 = "Enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network." fullword ascii wide
11+
$s4 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
12+
$s5 = "Upstream HTTP proxy used by the rogue WPAD Proxy for outgoing requests (format: host:port)" fullword ascii wide
13+
$s6 = "31mOSX detected, -i mandatory option is missing" fullword ascii wide
14+
$s7 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
15+
condition:
16+
any of them
17+
}

‎rules/public/hacktool/windows/hacktool_windows_hot_potato.yara

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
rule hacktool_windows_hot_potato
2+
{
3+
meta:
4+
description = "https://foxglovesecurity.com/2016/01/16/hot-potato/"
5+
reference = "https://github.com/foxglovesec/Potato"
6+
author = "@mimeframe"
7+
strings:
8+
$a1 = "Parsing initial NTLM auth..." wide ascii
9+
$a2 = "Got PROPFIND for /test..." wide ascii
10+
$a3 = "Starting NBNS spoofer..." wide ascii
11+
$a4 = "Exhausting UDP source ports so DNS lookups will fail..." wide ascii
12+
$a5 = "Usage: potato.exe -ip" wide ascii
13+
condition:
14+
any of ($a*)
15+
}

‎rules/public/hacktool/windows/hacktool_windows_mimikatz_copywrite.yara

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule hacktool_windows_mimikatz_copywrite
2+
{
3+
meta:
4+
description = "Mimikatz credential dump tool: Author copywrite"
5+
reference = "https://github.com/gentilkiwi/mimikatz"
6+
author = "@fusionrace"
7+
md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
8+
md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
9+
md5_3 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
10+
md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
11+
md5_5 = "09c542ff784bf98b2c4899900d4e699c5b2e2619a4c5eff68f6add14c74444ca"
12+
md5_6 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
13+
strings:
14+
$s1 = "Kiwi en C" fullword ascii wide
15+
$s2 = "Benjamin DELPY `gentilkiwi`" fullword ascii wide
16+
$s3 = "http://blog.gentilkiwi.com/mimikatz" fullword ascii wide
17+
$s4 = "Build with love for POC only" fullword ascii wide
18+
$s5 = "gentilkiwi (Benjamin DELPY)" fullword wide
19+
$s6 = "KiwiSSP" fullword wide
20+
$s7 = "Kiwi Security Support Provider" fullword wide
21+
$s8 = "kiwi flavor !" fullword wide
22+
condition:
23+
any of them
24+
}

‎rules/public/hacktool/windows/hacktool_windows_mimikatz_errors.yara

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rule hacktool_windows_mimikatz_errors
2+
{
3+
meta:
4+
description = "Mimikatz credential dump tool: Error messages"
5+
reference = "https://github.com/gentilkiwi/mimikatz"
6+
author = "@fusionrace"
7+
md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
8+
md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
9+
strings:
10+
$s1 = "[ERROR] [LSA] Symbols" fullword ascii wide
11+
$s2 = "[ERROR] [CRYPTO] Acquire keys" fullword ascii wide
12+
$s3 = "[ERROR] [CRYPTO] Symbols" fullword ascii wide
13+
$s4 = "[ERROR] [CRYPTO] Init" fullword ascii wide
14+
condition:
15+
all of them
16+
}

‎rules/public/hacktool/windows/hacktool_windows_mimikatz_files.yara

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
rule hacktool_windows_mimikatz_files
2+
{
3+
meta:
4+
description = "Mimikatz credential dump tool: Files"
5+
reference = "https://github.com/gentilkiwi/mimikatz"
6+
author = "@fusionrace"
7+
md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
8+
md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
9+
strings:
10+
$s1 = "kiwifilter.log" fullword wide
11+
$s2 = "kiwissp.log" fullword wide
12+
$s3 = "mimilib.dll" fullword ascii wide
13+
condition:
14+
any of them
15+
}

‎rules/public/hacktool/windows/hacktool_windows_mimikatz_modules.yara

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule hacktool_windows_mimikatz_modules
2+
{
3+
meta:
4+
description = "Mimikatz credential dump tool: Modules"
5+
reference = "https://github.com/gentilkiwi/mimikatz"
6+
author = "@fusionrace"
7+
md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
8+
md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
9+
md5_3 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
10+
md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
11+
md5_5 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
12+
strings:
13+
$s1 = "mimilib" fullword ascii wide
14+
$s2 = "mimidrv" fullword ascii wide
15+
$s3 = "mimilove" fullword ascii wide
16+
condition:
17+
any of them
18+
}

‎rules/public/hacktool/windows/hacktool_windows_mimikatz_sekurlsa.yara

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule hacktool_windows_mimikatz_sekurlsa
2+
{
3+
meta:
4+
description = "Mimikatz credential dump tool"
5+
reference = "https://github.com/gentilkiwi/mimikatz"
6+
author = "@fusionrace"
7+
SHA256_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
8+
SHA256_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
9+
strings:
10+
$s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
11+
$s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
12+
$s3 = "!SspCredentialList" ascii wide
13+
$s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
14+
$s5 = "wdigest!l_LogSessList" fullword ascii wide
15+
$s6 = "tspkg!TSGlobalCredTable" fullword ascii wide
16+
condition:
17+
all of them
18+
}

‎rules/public/hacktool/windows/hacktool_windows_ncc_wmicmd.yara

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule hacktool_windows_ncc_wmicmd
2+
{
3+
meta:
4+
description = "Command shell wrapper for WMI"
5+
reference = "https://github.com/nccgroup/WMIcmd"
6+
author = "@mimeframe"
7+
strings:
8+
$a1 = "Need to specify a username, domain and password for non local connections" wide ascii
9+
$a2 = "WS-Management is running on the remote host" wide ascii
10+
$a3 = "firewall (if enabled) allows connections" wide ascii
11+
$a4 = "WARNING: Didn't see stdout output finished marker - output may be truncated" wide ascii
12+
$a5 = "Command sleep in milliseconds - increase if getting truncated output" wide ascii
13+
$b1 = "0x800706BA" wide ascii
14+
$b2 = "NTLMDOMAIN:" wide ascii
15+
$b3 = "cimv2" wide ascii
16+
condition:
17+
any of ($a*) or all of ($b*)
18+
}

‎rules/public/hacktool/windows/hacktool_windows_rdp_cmd_delivery.yara

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
rule hacktool_windows_rdp_cmd_delivery
2+
{
3+
meta:
4+
description = "Delivers a text payload via RDP (rubber ducky)"
5+
reference = "https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh"
6+
author = "@fusionrace"
7+
strings:
8+
$s1 = "Usage: rdp-cmd-delivery.sh OPTIONS" ascii wide
9+
$s2 = "[--tofile 'c:\\test.txt' local.ps1 #will copy contents of local.ps1 to c:\\test.txt" ascii wide
10+
$s3 = "-cmdfile local.bat #will execute everything from local.bat" ascii wide
11+
$s4 = "To deliver powershell payload, use '--cmdfile script.ps1' but inside powershell console" ascii wide
12+
condition:
13+
any of them
14+
}

‎rules/public/hacktool/windows/hacktool_windows_wmi_implant.yara

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule hacktool_windows_wmi_implant
2+
{
3+
meta:
4+
description = "A PowerShell based tool that is designed to act like a RAT"
5+
reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
6+
author = "@fusionrace"
7+
strings:
8+
$s1 = "This really isn't applicable unless you are using WMImplant interactively." fullword ascii wide
9+
$s2 = "What command do you want to run on the remote system? >" fullword ascii wide
10+
$s3 = "Do you want to [create] or [delete] a string registry value? >" fullword ascii wide
11+
$s4 = "Do you want to run a WMImplant against a list of computers from a file? [yes] or [no] >" fullword ascii wide
12+
$s5 = "What is the name of the service you are targeting? >" fullword ascii wide
13+
$s6 = "This function enables the user to upload or download files to/from the attacking machine to/from the targeted machine" fullword ascii wide
14+
$s7 = "gen_cli - Generate the CLI command to execute a command via WMImplant" fullword ascii wide
15+
$s8 = "exit - Exit WMImplant" fullword ascii wide
16+
$s9 = "Lateral Movement Facilitation" fullword ascii wide
17+
$s10 = "vacant_system - Determine if a user is away from the system." fullword ascii wide
18+
$s11 = "Please provide the ProcessID or ProcessName flag to specify the process to kill!" fullword ascii wide
19+
condition:
20+
any of them
21+
}

‎rules/public/hacktool_linux.yara

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)