rule_net_greyware_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'net' taken from the ThreatHunting-Keywords github project
rule rule_net_greyware_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'net' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "net"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1_net_greyware_tool_keyword = " localgroup Administrators localadm /ADD " nocase ascii wide
                        $string2_net_greyware_tool_keyword = /\\net\.exe\\"\saccounts/ nocase ascii wide
                        $string3_net_greyware_tool_keyword = /\\net\.exe.{0,1000}\slocalgroup\sadmin/ nocase ascii wide
                        $string4_net_greyware_tool_keyword = /\\net\.exe.{0,1000}\ssessions/ nocase ascii wide
                        $string5_net_greyware_tool_keyword = /\\net\.exe.{0,1000}\sview\s.{0,1000}\/domain/ nocase ascii wide
                        $string6_net_greyware_tool_keyword = /\\net1\ssessions/ nocase ascii wide
                        $string7_net_greyware_tool_keyword = "net  group \"domain admins\" /domain" nocase ascii wide
                        $string8_net_greyware_tool_keyword = "net  group \"Domain Computers\" /domain" nocase ascii wide
                        $string9_net_greyware_tool_keyword = "net  group \"domain computers\" /domain" nocase ascii wide
                        $string10_net_greyware_tool_keyword = "net  group \"enterprise admins\" /domain" nocase ascii wide
                        $string11_net_greyware_tool_keyword = "net  group \"ESX Admins\" /domain /add" nocase ascii wide
                        $string12_net_greyware_tool_keyword = "net  group \"ESX Admins\"" nocase ascii wide
                        $string13_net_greyware_tool_keyword = "net  user admin P@ssw0rd!" nocase ascii wide
                        $string14_net_greyware_tool_keyword = /net\s\.exe.{0,1000}\sgroup\s\\"ESX\sAdmins\\"/ nocase ascii wide
                        $string15_net_greyware_tool_keyword = "net accounts /maxpwage:unlimited" nocase ascii wide
                        $string16_net_greyware_tool_keyword = /net\sgroup\s\\"Admins\.\sdel\sdominio\\"\s\/domain/ nocase ascii wide
                        $string17_net_greyware_tool_keyword = /net\sgroup\s\\"Dom.{0,1000}nen\-Admins\\"\s\/domain/ nocase ascii wide
                        $string18_net_greyware_tool_keyword = "net group \"Domain Administrateurs\" /domain" nocase ascii wide
                        $string19_net_greyware_tool_keyword = "net group \"Domain Admins\" /domain" nocase ascii wide
                        $string20_net_greyware_tool_keyword = "net group \"Domain Admins\" /domain" nocase ascii wide
                        $string21_net_greyware_tool_keyword = "net group \"Domain Admins\" support /add" nocase ascii wide
                        $string22_net_greyware_tool_keyword = "net group \"domain computers\" /domain" nocase ascii wide
                        $string23_net_greyware_tool_keyword = "net group \"Enterprise admins\" /domain" nocase ascii wide
                        $string24_net_greyware_tool_keyword = "net group \"SQL Admins\" /domain" nocase ascii wide
                        $string25_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Account\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string26_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Backup\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string27_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Domain\sComputers.{0,1000}\s\/domain/ nocase ascii wide
                        $string28_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Domain\sControllers.{0,1000}\s\/domain/ nocase ascii wide
                        $string29_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Domain\sControllers.{0,1000}\/domain/ nocase ascii wide
                        $string30_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Enterprise\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string31_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Exchange\sTrusted\sSubsystem.{0,1000}\s\/domain/ nocase ascii wide
                        $string32_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Microsoft\sExchange\sServers.{0,1000}\s\/domain/ nocase ascii wide
                        $string33_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Print\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string34_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Schema\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string35_net_greyware_tool_keyword = /net\sgroup\s.{0,1000}Server\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string36_net_greyware_tool_keyword = /net\sgroup\s\/domain\s.{0,1000}Domain\sAdmins/ nocase ascii wide
                        $string37_net_greyware_tool_keyword = "net group administrators /domain" nocase ascii wide
                        $string38_net_greyware_tool_keyword = /net\sgroup\sAdmins\.\sdel\sdominio\s\/domain/ nocase ascii wide
                        $string39_net_greyware_tool_keyword = "net localgroup \"Cert Publishers\" /domain" nocase ascii wide
                        $string40_net_greyware_tool_keyword = /net\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,1000}\s\/add/ nocase ascii wide
                        $string41_net_greyware_tool_keyword = /net\slocalgroup\s.{0,1000}Backup\sOperators/ nocase ascii wide
                        $string42_net_greyware_tool_keyword = /net\slocalgroup\s\\\\"Remote\sDesktop\sUsers\\\\"\sSupport\s\/add/ nocase ascii wide
                        $string43_net_greyware_tool_keyword = "net localgroup admin" nocase ascii wide
                        $string44_net_greyware_tool_keyword = "net localgroup Administrators support /add" nocase ascii wide
                        $string45_net_greyware_tool_keyword = "net localgroup Administrators Support /add" nocase ascii wide
                        $string46_net_greyware_tool_keyword = /net\sshare\sc\=c\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string47_net_greyware_tool_keyword = /net\sshare\sd\=d\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string48_net_greyware_tool_keyword = /net\sshare\se\=e\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string49_net_greyware_tool_keyword = /net\sshare\se\=e\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string50_net_greyware_tool_keyword = /net\sshare\sf\=f\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string51_net_greyware_tool_keyword = /net\sshare\sg\=g\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string52_net_greyware_tool_keyword = /net\sshare\sh\=h\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string53_net_greyware_tool_keyword = /net\sshare\si\=i\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string54_net_greyware_tool_keyword = /net\sshare\sj\=j\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string55_net_greyware_tool_keyword = /net\sshare\sk\=k\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string56_net_greyware_tool_keyword = /net\sstop\s\\"\.NET\sRuntime\sOptimization\sService\\"/ nocase ascii wide
                        $string57_net_greyware_tool_keyword = /net\sstop\s\\"IBM\sDomino\sDiagnostics\s\(CProgramFilesIBMDomino\)\\"/ nocase ascii wide
                        $string58_net_greyware_tool_keyword = /net\sstop\s\\"IBM\sDomino\sServer\s\(CProgramFilesIBMDominodata\)\\"/ nocase ascii wide
                        $string59_net_greyware_tool_keyword = "net stop \"SAVAdminService\"" nocase ascii wide
                        $string60_net_greyware_tool_keyword = "net stop \"SAVService\"" nocase ascii wide
                        $string61_net_greyware_tool_keyword = "net stop \"SAVService\"" nocase ascii wide
                        $string62_net_greyware_tool_keyword = "net stop \"Simply Accounting Database Connection Manager\"" nocase ascii wide
                        $string63_net_greyware_tool_keyword = "net stop \"SntpService\"" nocase ascii wide
                        $string64_net_greyware_tool_keyword = "net stop \"Sophos " nocase ascii wide
                        $string65_net_greyware_tool_keyword = "net stop \"Sophos Agent\"" nocase ascii wide
                        $string66_net_greyware_tool_keyword = "net stop \"Sophos Anti-Virus\"" nocase ascii wide
                        $string67_net_greyware_tool_keyword = "net stop \"Sophos AutoUpdate Service\"" nocase ascii wide
                        $string68_net_greyware_tool_keyword = "net stop \"Sophos AutoUpdate Service\"" nocase ascii wide
                        $string69_net_greyware_tool_keyword = "net stop \"Sophos Endpoint Defense Service\"" nocase ascii wide
                        $string70_net_greyware_tool_keyword = "net stop \"Sophos Message Router\"" nocase ascii wide
                        $string71_net_greyware_tool_keyword = "net stop \"Sophos System Protection Service\"" nocase ascii wide
                        $string72_net_greyware_tool_keyword = "net stop \"Sophos Web Control Service\"" nocase ascii wide
                        $string73_net_greyware_tool_keyword = "net stop \"Sophos Web Control Service\"" nocase ascii wide
                        $string74_net_greyware_tool_keyword = "net stop \"SQL Backups\"" nocase ascii wide
                        $string75_net_greyware_tool_keyword = "net stop \"SQLsafe Backup Service\"" nocase ascii wide
                        $string76_net_greyware_tool_keyword = /net\sstop\s\\"storagecraft\simagemanager.{0,1000}\\"/ nocase ascii wide
                        $string77_net_greyware_tool_keyword = "net stop \"swi_service\"" nocase ascii wide
                        $string78_net_greyware_tool_keyword = "net stop \"swi_update\"" nocase ascii wide
                        $string79_net_greyware_tool_keyword = "net stop \"Symantec System Recovery\"" nocase ascii wide
                        $string80_net_greyware_tool_keyword = "net stop \"Veeam Backup Catalog Data Service\"" nocase ascii wide
                        $string81_net_greyware_tool_keyword = "net stop \"Zoolz 2 Service\"" nocase ascii wide
                        $string82_net_greyware_tool_keyword = "net stop acronisagent" nocase ascii wide
                        $string83_net_greyware_tool_keyword = "net stop AcronisAgent" nocase ascii wide
                        $string84_net_greyware_tool_keyword = "net stop acrsch2svc" nocase ascii wide
                        $string85_net_greyware_tool_keyword = "net stop AcrSch2Svc" nocase ascii wide
                        $string86_net_greyware_tool_keyword = "net stop agntsvc" nocase ascii wide
                        $string87_net_greyware_tool_keyword = "net stop Antivirus" nocase ascii wide
                        $string88_net_greyware_tool_keyword = "net stop ARSM /y" nocase ascii wide
                        $string89_net_greyware_tool_keyword = "net stop arsm" nocase ascii wide
                        $string90_net_greyware_tool_keyword = "net stop AVP" nocase ascii wide
                        $string91_net_greyware_tool_keyword = "net stop backp" nocase ascii wide
                        $string92_net_greyware_tool_keyword = "net stop backup" nocase ascii wide
                        $string93_net_greyware_tool_keyword = "net stop BackupExec" nocase ascii wide
                        $string94_net_greyware_tool_keyword = "net stop BackupExecAgent" nocase ascii wide
                        $string95_net_greyware_tool_keyword = "net stop badrv" nocase ascii wide
                        $string96_net_greyware_tool_keyword = "net stop bedbg /y" nocase ascii wide
                        $string97_net_greyware_tool_keyword = "net stop cbservi" nocase ascii wide
                        $string98_net_greyware_tool_keyword = "net stop cbvscserv" nocase ascii wide
                        $string99_net_greyware_tool_keyword = "net stop DCAgent" nocase ascii wide
                        $string100_net_greyware_tool_keyword = "net stop dnscache" nocase ascii wide
                        $string101_net_greyware_tool_keyword = "net stop DPS" nocase ascii wide
                        $string102_net_greyware_tool_keyword = "net stop EhttpSrv" nocase ascii wide
                        $string103_net_greyware_tool_keyword = "net stop ekrn" nocase ascii wide
                        $string104_net_greyware_tool_keyword = "net stop EPSecurityService" nocase ascii wide
                        $string105_net_greyware_tool_keyword = "net stop EPUpdateService" nocase ascii wide
                        $string106_net_greyware_tool_keyword = "net stop EsgShKernel" nocase ascii wide
                        $string107_net_greyware_tool_keyword = "net stop ESHASRV" nocase ascii wide
                        $string108_net_greyware_tool_keyword = "net stop FA_Scheduler" nocase ascii wide
                        $string109_net_greyware_tool_keyword = "net stop firebirdguardiandefaultinstance" nocase ascii wide
                        $string110_net_greyware_tool_keyword = "net stop gupdatem" nocase ascii wide
                        $string111_net_greyware_tool_keyword = "net stop ibmiasrw" nocase ascii wide
                        $string112_net_greyware_tool_keyword = "net stop IISADMIN" nocase ascii wide
                        $string113_net_greyware_tool_keyword = "net stop IISADMIN" nocase ascii wide
                        $string114_net_greyware_tool_keyword = "net stop IMAP4Svc" nocase ascii wide
                        $string115_net_greyware_tool_keyword = "net stop KAVFS" nocase ascii wide
                        $string116_net_greyware_tool_keyword = "net stop KAVFSGT" nocase ascii wide
                        $string117_net_greyware_tool_keyword = "net stop kavfsslp" nocase ascii wide
                        $string118_net_greyware_tool_keyword = "net stop klnagent" nocase ascii wide
                        $string119_net_greyware_tool_keyword = "net stop macmnsvc" nocase ascii wide
                        $string120_net_greyware_tool_keyword = "net stop masvc" nocase ascii wide
                        $string121_net_greyware_tool_keyword = "net stop MBAMService" nocase ascii wide
                        $string122_net_greyware_tool_keyword = "net stop MBEndpointAgent" nocase ascii wide
                        $string123_net_greyware_tool_keyword = "net stop McAfeeEngineService" nocase ascii wide
                        $string124_net_greyware_tool_keyword = "net stop McAfeeFramework" nocase ascii wide
                        $string125_net_greyware_tool_keyword = "net stop McAfeeFrameworkMcAfeeFramework" nocase ascii wide
                        $string126_net_greyware_tool_keyword = "net stop McShield" nocase ascii wide
                        $string127_net_greyware_tool_keyword = "net stop mfefire" nocase ascii wide
                        $string128_net_greyware_tool_keyword = "net stop mfemms" nocase ascii wide
                        $string129_net_greyware_tool_keyword = "net stop mfevtp" nocase ascii wide
                        $string130_net_greyware_tool_keyword = "net stop mozyprobackup" nocase ascii wide
                        $string131_net_greyware_tool_keyword = "net stop mr2kserv" nocase ascii wide
                        $string132_net_greyware_tool_keyword = "net stop MsDtsServer" nocase ascii wide
                        $string133_net_greyware_tool_keyword = "net stop MsDtsServer100" nocase ascii wide
                        $string134_net_greyware_tool_keyword = "net stop MsDtsServer110" nocase ascii wide
                        $string135_net_greyware_tool_keyword = "net stop MSExchangeADTopology" nocase ascii wide
                        $string136_net_greyware_tool_keyword = "net stop MSExchangeFBA" nocase ascii wide
                        $string137_net_greyware_tool_keyword = "net stop MSExchangeIS" nocase ascii wide
                        $string138_net_greyware_tool_keyword = "net stop MSExchangeSA" nocase ascii wide
                        $string139_net_greyware_tool_keyword = "net stop MSExchangeUM" nocase ascii wide
                        $string140_net_greyware_tool_keyword = /net\sstop\smsftesql\$PROD/ nocase ascii wide
                        $string141_net_greyware_tool_keyword = "net stop msiserver" nocase ascii wide
                        $string142_net_greyware_tool_keyword = /net\sstop\sMSOLAP\$SQL_2008/ nocase ascii wide
                        $string143_net_greyware_tool_keyword = /net\sstop\sMSOLAP\$SYSTEM_BGC/ nocase ascii wide
                        $string144_net_greyware_tool_keyword = /net\sstop\sMSOLAP\$TPS/ nocase ascii wide
                        $string145_net_greyware_tool_keyword = /net\sstop\sMSOLAP\$TPSAMA/ nocase ascii wide
                        $string146_net_greyware_tool_keyword = /net\sstop\sMSSQL\$BKUPEXEC/ nocase ascii wide
                        $string147_net_greyware_tool_keyword = /net\sstop\sMSSQL\$CONTOSO1/ nocase ascii wide
                        $string148_net_greyware_tool_keyword = /net\sstop\sMSSQL\$ECWDB2/ nocase ascii wide
                        $string149_net_greyware_tool_keyword = /net\sstop\sMSSQL\$ISARS/ nocase ascii wide
                        $string150_net_greyware_tool_keyword = /net\sstop\sMSSQL\$MSFW/ nocase ascii wide
                        $string151_net_greyware_tool_keyword = /net\sstop\sMSSQL\$PRACTICEMGT/ nocase ascii wide
                        $string152_net_greyware_tool_keyword = /net\sstop\sMSSQL\$PRACTTICEBGC/ nocase ascii wide
                        $string153_net_greyware_tool_keyword = /net\sstop\sMSSQL\$PROD/ nocase ascii wide
                        $string154_net_greyware_tool_keyword = /net\sstop\sMSSQL\$PROFXENGAGEMENT/ nocase ascii wide
                        $string155_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SBSMONITORING/ nocase ascii wide
                        $string156_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SHAREPOINT/ nocase ascii wide
                        $string157_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SOPHOS/ nocase ascii wide
                        $string158_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SQL_2008/ nocase ascii wide
                        $string159_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SQLEXPRESS/ nocase ascii wide
                        $string160_net_greyware_tool_keyword = /net\sstop\sMSSQL\$SYSTEM_BGC/ nocase ascii wide
                        $string161_net_greyware_tool_keyword = /net\sstop\sMSSQL\$TPS/ nocase ascii wide
                        $string162_net_greyware_tool_keyword = /net\sstop\sMSSQL\$TPSAMA/ nocase ascii wide
                        $string163_net_greyware_tool_keyword = /net\sstop\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string164_net_greyware_tool_keyword = /net\sstop\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string165_net_greyware_tool_keyword = "net stop MSSQLServerADHelper100" nocase ascii wide
                        $string166_net_greyware_tool_keyword = "net stop MSSQLServerADHelper100" nocase ascii wide
                        $string167_net_greyware_tool_keyword = "net stop OfficeClickToRun" nocase ascii wide
                        $string168_net_greyware_tool_keyword = "net stop PcaSvc" nocase ascii wide
                        $string169_net_greyware_tool_keyword = "net stop QBCFMonitorService" nocase ascii wide
                        $string170_net_greyware_tool_keyword = "net stop QBPOSDBServiceV12" nocase ascii wide
                        $string171_net_greyware_tool_keyword = "net stop QBVSS" nocase ascii wide
                        $string172_net_greyware_tool_keyword = "net stop QuickBooksDB1" nocase ascii wide
                        $string173_net_greyware_tool_keyword = "net stop QuickBooksDB2" nocase ascii wide
                        $string174_net_greyware_tool_keyword = "net stop QuickBooksDB3" nocase ascii wide
                        $string175_net_greyware_tool_keyword = "net stop QuickBooksDB4" nocase ascii wide
                        $string176_net_greyware_tool_keyword = "net stop QuickBooksDB5" nocase ascii wide
                        $string177_net_greyware_tool_keyword = /net\sstop\sReportServer\$ISARS/ nocase ascii wide
                        $string178_net_greyware_tool_keyword = "net stop sacsvr" nocase ascii wide
                        $string179_net_greyware_tool_keyword = "net stop SAVAdminService" nocase ascii wide
                        $string180_net_greyware_tool_keyword = "net stop SAVService" nocase ascii wide
                        $string181_net_greyware_tool_keyword = "net stop sedsvc" nocase ascii wide
                        $string182_net_greyware_tool_keyword = "net stop shadowprotectsvc" nocase ascii wide
                        $string183_net_greyware_tool_keyword = "net stop ShadowProtectSvc" nocase ascii wide
                        $string184_net_greyware_tool_keyword = "net stop sharedaccess" nocase ascii wide
                        $string185_net_greyware_tool_keyword = "net stop ShMonitor" nocase ascii wide
                        $string186_net_greyware_tool_keyword = "net stop Smcinst" nocase ascii wide
                        $string187_net_greyware_tool_keyword = "net stop SmcService" nocase ascii wide
                        $string188_net_greyware_tool_keyword = "net stop sms_site_sql_backup" nocase ascii wide
                        $string189_net_greyware_tool_keyword = "net stop SntpService" nocase ascii wide
                        $string190_net_greyware_tool_keyword = "net stop sophossps" nocase ascii wide
                        $string191_net_greyware_tool_keyword = "net stop SPAdminV4" nocase ascii wide
                        $string192_net_greyware_tool_keyword = "net stop sppsvc" nocase ascii wide
                        $string193_net_greyware_tool_keyword = "net stop SPSearch4" nocase ascii wide
                        $string194_net_greyware_tool_keyword = "net stop SPTimerV4" nocase ascii wide
                        $string195_net_greyware_tool_keyword = "net stop SPTraceV4" nocase ascii wide
                        $string196_net_greyware_tool_keyword = "net stop SPUserCodeV4" nocase ascii wide
                        $string197_net_greyware_tool_keyword = "net stop SPWriterV4" nocase ascii wide
                        $string198_net_greyware_tool_keyword = "net stop spxservice" nocase ascii wide
                        $string199_net_greyware_tool_keyword = "net stop sqbcoreservice" nocase ascii wide
                        $string200_net_greyware_tool_keyword = /net\sstop\sSQLAgent\$ISARS/ nocase ascii wide
                        $string201_net_greyware_tool_keyword = /net\sstop\sSQLAgent\$MSFW/ nocase ascii wide
                        $string202_net_greyware_tool_keyword = /net\sstop\sSQLAgent\$SOPH/ nocase ascii wide
                        $string203_net_greyware_tool_keyword = /net\sstop\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string204_net_greyware_tool_keyword = /net\sstop\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string205_net_greyware_tool_keyword = "net stop SQLBrowser" nocase ascii wide
                        $string206_net_greyware_tool_keyword = "net stop SQLWriter" nocase ascii wide
                        $string207_net_greyware_tool_keyword = "net stop stc_endpt_svc" nocase ascii wide
                        $string208_net_greyware_tool_keyword = "net stop stop SepMasterService" nocase ascii wide
                        $string209_net_greyware_tool_keyword = "net stop svcGenericHost" nocase ascii wide
                        $string210_net_greyware_tool_keyword = "net stop swi_filter" nocase ascii wide
                        $string211_net_greyware_tool_keyword = "net stop swi_service" nocase ascii wide
                        $string212_net_greyware_tool_keyword = "net stop swi_update" nocase ascii wide
                        $string213_net_greyware_tool_keyword = "net stop swi_update_64" nocase ascii wide
                        $string214_net_greyware_tool_keyword = "net stop SysMain" nocase ascii wide
                        $string215_net_greyware_tool_keyword = "net stop TmCCSF" nocase ascii wide
                        $string216_net_greyware_tool_keyword = "net stop tmlisten" nocase ascii wide
                        $string217_net_greyware_tool_keyword = "net stop TrueKey" nocase ascii wide
                        $string218_net_greyware_tool_keyword = "net stop TrueKeyScheduler" nocase ascii wide
                        $string219_net_greyware_tool_keyword = "net stop TrueKeyServiceHel" nocase ascii wide
                        $string220_net_greyware_tool_keyword = "net stop TrustedInstaller" nocase ascii wide
                        $string221_net_greyware_tool_keyword = "net stop vapiendpoint" nocase ascii wide
                        $string222_net_greyware_tool_keyword = "net stop VeeamBackupSvc" nocase ascii wide
                        $string223_net_greyware_tool_keyword = "net stop VeeamBrokerSvc " nocase ascii wide
                        $string224_net_greyware_tool_keyword = "net stop VeeamCatalogSvc" nocase ascii wide
                        $string225_net_greyware_tool_keyword = "net stop VeeamCloudSvc" nocase ascii wide
                        $string226_net_greyware_tool_keyword = "net stop VeeamDeploymentService" nocase ascii wide
                        $string227_net_greyware_tool_keyword = "net stop VeeamDeploySvc" nocase ascii wide
                        $string228_net_greyware_tool_keyword = "net stop VeeamDeploySvc" nocase ascii wide
                        $string229_net_greyware_tool_keyword = "net stop VeeamEnterpriseManagerSvc" nocase ascii wide
                        $string230_net_greyware_tool_keyword = "net stop VeeamHvIntegrationSvc" nocase ascii wide
                        $string231_net_greyware_tool_keyword = "net stop VeeamMountSvc" nocase ascii wide
                        $string232_net_greyware_tool_keyword = "net stop VeeamNFSSvc" nocase ascii wide
                        $string233_net_greyware_tool_keyword = "net stop VeeamRESTSvc" nocase ascii wide
                        $string234_net_greyware_tool_keyword = "net stop VeeamTransportSvc" nocase ascii wide
                        $string235_net_greyware_tool_keyword = "net stop vsnapvss" nocase ascii wide
                        $string236_net_greyware_tool_keyword = "net stop vssvc" nocase ascii wide
                        $string237_net_greyware_tool_keyword = "net stop wbengine" nocase ascii wide
                        $string238_net_greyware_tool_keyword = "net stop wbengine" nocase ascii wide
                        $string239_net_greyware_tool_keyword = "net stop WinDefend" nocase ascii wide
                        $string240_net_greyware_tool_keyword = "net stop WinDefend" nocase ascii wide
                        $string241_net_greyware_tool_keyword = "net stop WRSVC" nocase ascii wide
                        $string242_net_greyware_tool_keyword = /net\suse\s\\\\.{0,1000}\\IPC\$\s\/user\:/ nocase ascii wide
                        $string243_net_greyware_tool_keyword = /net\suser\s.{0,1000}\$.{0,1000}\s\// nocase ascii wide
                        $string244_net_greyware_tool_keyword = "net user /domain >" nocase ascii wide
                        $string245_net_greyware_tool_keyword = "net user BitdefenderBounty " nocase ascii wide
                        $string246_net_greyware_tool_keyword = "NET USER GUEST /ACTIVE:YES" nocase ascii wide
                        $string247_net_greyware_tool_keyword = "net user localadm " nocase ascii wide
                        $string248_net_greyware_tool_keyword = "net user localadm " nocase ascii wide
                        $string249_net_greyware_tool_keyword = /net\suser\sSupport\s.{0,1000}\s\/add\s/ nocase ascii wide
                        $string250_net_greyware_tool_keyword = "net user support /active:yes" nocase ascii wide
                        $string251_net_greyware_tool_keyword = /net\suser\ssupport\sPa\$\$wo0rd\s\/add/ nocase ascii wide
                        $string252_net_greyware_tool_keyword = "net view /all /domain" nocase ascii wide
                        $string253_net_greyware_tool_keyword = "net view /domain" nocase ascii wide
                        $string254_net_greyware_tool_keyword = /net\sview\s\\\\.{0,1000}\s\/all/ nocase ascii wide
                        $string255_net_greyware_tool_keyword = /net.{0,1000}\sgroup\sAdministrator.{0,1000}\s\/add\s\/domain/ nocase ascii wide
                        $string256_net_greyware_tool_keyword = /net\.exe\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,1000}\s\/add/ nocase ascii wide
                        $string257_net_greyware_tool_keyword = /net\.exe\slocalgroup\s.{0,1000}Backup\sOperators/ nocase ascii wide
                        $string258_net_greyware_tool_keyword = /net\.exe\\"\slocalgroup\s.{0,1000}Backup\sOperators/ nocase ascii wide
                        $string259_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Account\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string260_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Backup\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string261_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Domain\sComputers.{0,1000}\s\/domain/ nocase ascii wide
                        $string262_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Domain\sControllers.{0,1000}\s\/domain/ nocase ascii wide
                        $string263_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Enterprise\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string264_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Exchange\sTrusted\sSubsystem.{0,1000}\s\/domain/ nocase ascii wide
                        $string265_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Microsoft\sExchange\sServers.{0,1000}\s\/domain/ nocase ascii wide
                        $string266_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Print\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string267_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Schema\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string268_net_greyware_tool_keyword = /net\.exe.{0,1000}\sgroup\s.{0,1000}Server\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string269_net_greyware_tool_keyword = "net1  group \"domain admins\" /domain" nocase ascii wide
                        $string270_net_greyware_tool_keyword = "net1  group \"Domain Computers\" /domain" nocase ascii wide
                        $string271_net_greyware_tool_keyword = "net1  group \"domain computers\" /domain" nocase ascii wide
                        $string272_net_greyware_tool_keyword = "net1  group \"enterprise admins\" /domain" nocase ascii wide
                        $string273_net_greyware_tool_keyword = "net1 group \"Domain Admins\" /domain" nocase ascii wide
                        $string274_net_greyware_tool_keyword = "net1 group \"SQL Admins\" /domain" nocase ascii wide
                        $string275_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Account\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string276_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Backup\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string277_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Domain\sComputers.{0,1000}\s\/domain/ nocase ascii wide
                        $string278_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Domain\sControllers.{0,1000}\s\/domain/ nocase ascii wide
                        $string279_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Enterprise\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string280_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Exchange\sTrusted\sSubsystem.{0,1000}\s\/domain/ nocase ascii wide
                        $string281_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Microsoft\sExchange\sServers.{0,1000}\s\/domain/ nocase ascii wide
                        $string282_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Print\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string283_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Schema\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string284_net_greyware_tool_keyword = /net1\sgroup\s.{0,1000}Server\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string285_net_greyware_tool_keyword = /net1\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,1000}\s\/add/ nocase ascii wide
                        $string286_net_greyware_tool_keyword = /net1\slocalgroup\s.{0,1000}Backup\sOperators/ nocase ascii wide
                        $string287_net_greyware_tool_keyword = "net1 localgroup admin" nocase ascii wide
                        $string288_net_greyware_tool_keyword = "net1 stop badrv" nocase ascii wide
                        $string289_net_greyware_tool_keyword = "net1 stop gupdatem" nocase ascii wide
                        $string290_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Account\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string291_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Backup\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string292_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Domain\sComputers.{0,1000}\s\/domain/ nocase ascii wide
                        $string293_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Domain\sControllers.{0,1000}\s\/domain/ nocase ascii wide
                        $string294_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Enterprise\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string295_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Exchange\sTrusted\sSubsystem.{0,1000}\s\/domain/ nocase ascii wide
                        $string296_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Microsoft\sExchange\sServers.{0,1000}\s\/domain/ nocase ascii wide
                        $string297_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Print\sOperators.{0,1000}\s\/domain/ nocase ascii wide
                        $string298_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Schema\sAdmins.{0,1000}\s\/domain/ nocase ascii wide
                        $string299_net_greyware_tool_keyword = /net1\.exe.{0,1000}\sgroup\s.{0,1000}Server\sOperators.{0,1000}\s\/domain/ nocase ascii wide

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7c203064-c266-4e6a-bb8e-de615c0ddca5
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
