rule_exegol_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'exegol' taken from the ThreatHunting-Keywords github project
rule rule_exegol_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'exegol' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "exegol"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_exegol_offensive_tool_keyword = /\s\/\.exegol\// nocase ascii wide
                        $string2_exegol_offensive_tool_keyword = /\sASREProastables\.txt/ nocase ascii wide
                        $string3_exegol_offensive_tool_keyword = /\sASREProastables\.txt/ nocase ascii wide
                        $string4_exegol_offensive_tool_keyword = " --attack partial_d --key " nocase ascii wide
                        $string5_exegol_offensive_tool_keyword = " --attack partial_q --key " nocase ascii wide
                        $string6_exegol_offensive_tool_keyword = " --basic \"FUZZ:FUZ2Z\"" nocase ascii wide
                        $string7_exegol_offensive_tool_keyword = /\s\-\-convert_idrsa_pub\s\-\-publickey\s\$HOME\/\.ssh\/id_rsa\.pub/ nocase ascii wide
                        $string8_exegol_offensive_tool_keyword = /\s\-\-createpub\s\-n\s7828374823761928712873129873981723\.\.\.12837182\s\-e\s65537/ nocase ascii wide
                        $string9_exegol_offensive_tool_keyword = /\s\-d\s.{0,100}\s\-dc\s.{0,100}\s\-nu\s\'neo4j\'\s\-np\s/ nocase ascii wide
                        $string10_exegol_offensive_tool_keyword = /\s\-d\s.{0,100}\s\-u\s.{0,100}\s\-p\s.{0,100}\s\-\-listener\s.{0,100}\s\-\-target\s.{0,100}\$DC_HOST/ nocase ascii wide
                        $string11_exegol_offensive_tool_keyword = /\s\-\-deauth\s.{0,100}\s\-a\sTR\:GT\:AP\:BS\:SS\:ID\swlan/ nocase ascii wide
                        $string12_exegol_offensive_tool_keyword = /\sdeepce\.sh\s.{0,100}\-\-install/
                        $string13_exegol_offensive_tool_keyword = /\s\-enabled\s\-u\s.{0,100}\s\-p\s.{0,100}\s\-old\-bloodhound/ nocase ascii wide
                        $string14_exegol_offensive_tool_keyword = /\sexegol\.apk/ nocase ascii wide
                        $string15_exegol_offensive_tool_keyword = /\sexegol\.py/ nocase ascii wide
                        $string16_exegol_offensive_tool_keyword = /\s\-\-file\sownedusers\.txt/ nocase ascii wide
                        $string17_exegol_offensive_tool_keyword = /\s\-\-hash\-type\s.{0,100}\s\-\-attack\-mode\s/ nocase ascii wide
                        $string18_exegol_offensive_tool_keyword = /\s\-\-host\s.{0,100}\s\-\-port\s.{0,100}\s\-\-executable\s.{0,100}\.exe\s\-\-command\s.{0,100}cmd\.exe/ nocase ascii wide
                        $string19_exegol_offensive_tool_keyword = " install evil-winrm" nocase ascii wide
                        $string20_exegol_offensive_tool_keyword = /\s\-\-interface\s.{0,100}\s\-\-analyze\s\-\-disable\-ess/ nocase ascii wide
                        $string21_exegol_offensive_tool_keyword = /\s\-\-interface\s.{0,100}\s\-\-analyze\s\-\-lm\s\-\-disable\-ess/ nocase ascii wide
                        $string22_exegol_offensive_tool_keyword = " --isroca --publickey " nocase ascii wide
                        $string23_exegol_offensive_tool_keyword = /\s\-just\-dc\-user\s\'krbtgt\'\s\-dc\-ip\s\s.{0,100}\s\-k\s\-no\-pass\s\@/ nocase ascii wide
                        $string24_exegol_offensive_tool_keyword = /\sKerberoastables\.txt/ nocase ascii wide
                        $string25_exegol_offensive_tool_keyword = /\skerberos\stgt\s.{0,100}kerberos\+rc4\:\/\/.{0,100}\:.{0,100}\@/ nocase ascii wide
                        $string26_exegol_offensive_tool_keyword = /\s\-\-key\sexamples\/conspicuous\.priv\s\-\-isconspicuous/ nocase ascii wide
                        $string27_exegol_offensive_tool_keyword = /\s\-\-krbpass\s.{0,100}\s\-\-krbsalt\s.{0,100}\s\-t\s.{0,100}\s\-\-escalate\-user\s/ nocase ascii wide
                        $string28_exegol_offensive_tool_keyword = /\slinpeas\.sh/ nocase ascii wide
                        $string29_exegol_offensive_tool_keyword = " --lport 1337 " nocase ascii wide
                        $string30_exegol_offensive_tool_keyword = /\slsa\sminidump\s.{0,100}\.dmp/ nocase ascii wide
                        $string31_exegol_offensive_tool_keyword = /\slsass_creds\.txt/ nocase ascii wide
                        $string32_exegol_offensive_tool_keyword = " lsassy -k -d " nocase ascii wide
                        $string33_exegol_offensive_tool_keyword = " moodlescan -r -u " nocase ascii wide
                        $string34_exegol_offensive_tool_keyword = /\s\-ntds\sntds\.dit\.save\s\-system\ssystem\.save\sLOCAL/ nocase ascii wide
                        $string35_exegol_offensive_tool_keyword = /\s\-nthash\s.{0,100}\s\-spn\s.{0,100}\s\-domain\-sid\s.{0,100}\s\-domain\s/ nocase ascii wide
                        $string36_exegol_offensive_tool_keyword = /\s\-nthash\s.{0,100}\-domain\-sid\sS\-1\-5\-11\-39129514\-1145628974\-103568174\s\-domain/ nocase ascii wide
                        $string37_exegol_offensive_tool_keyword = /\sntlmv1\.py/ nocase ascii wide
                        $string38_exegol_offensive_tool_keyword = " --outdir ldapdomaindump " nocase ascii wide
                        $string39_exegol_offensive_tool_keyword = /\s\-\-plugin\sKeeFarceRebornPlugin\.dll/ nocase ascii wide
                        $string40_exegol_offensive_tool_keyword = /\s\-\-publickey\s.{0,100}\s\-\-ecmdigits\s25\s\-\-verbose\s\-\-private/ nocase ascii wide
                        $string41_exegol_offensive_tool_keyword = /\s\-\-publickey\s.{0,100}\s\-\-uncipherfile\s\.\/ciphered\\_file/
                        $string42_exegol_offensive_tool_keyword = /\spywsus\.py\s/ nocase ascii wide
                        $string43_exegol_offensive_tool_keyword = /\sreq\s\-username\s.{0,100}\s\-p\s.{0,100}\s\-ca\s.{0,100}\s\-target\s.{0,100}\s\-template\s.{0,100}\s\-upn\s/ nocase ascii wide
                        $string44_exegol_offensive_tool_keyword = " -request -format hashcat -outputfile " nocase ascii wide
                        $string45_exegol_offensive_tool_keyword = /\s\-\-requirement\s.{0,100}Exegol\/requirements\.txt/ nocase ascii wide
                        $string46_exegol_offensive_tool_keyword = /\s\-s\s.{0,100}\s\-\-method\s1\s\-\-function\sshell_exec\s\-\-parameters\scmd\:id/ nocase ascii wide
                        $string47_exegol_offensive_tool_keyword = " --script dns-srv-enum " nocase ascii wide
                        $string48_exegol_offensive_tool_keyword = " --script http-ntlm-info " nocase ascii wide
                        $string49_exegol_offensive_tool_keyword = " --script smb-enum-shares " nocase ascii wide
                        $string50_exegol_offensive_tool_keyword = " --script=ldap-search -p " nocase ascii wide
                        $string51_exegol_offensive_tool_keyword = " --script=realvnc-auth-bypass " nocase ascii wide
                        $string52_exegol_offensive_tool_keyword = /\s\-\-script\-args\sdns\-srv\-enum\.domain\=/ nocase ascii wide
                        $string53_exegol_offensive_tool_keyword = /\s\-\-set\-as\-owned\ssmart\s\-bp\s.{0,100}\skerberos\s.{0,100}\s\-\-kdc\-ip\s/ nocase ascii wide
                        $string54_exegol_offensive_tool_keyword = " --shell tcsh exegol" nocase ascii wide
                        $string55_exegol_offensive_tool_keyword = " -smb2support --interactive " nocase ascii wide
                        $string56_exegol_offensive_tool_keyword = /\s\-t\sdcsync\:\/\/.{0,100}\s\-/ nocase ascii wide
                        $string57_exegol_offensive_tool_keyword = /\stargetedKerberoast\.py\s/ nocase ascii wide
                        $string58_exegol_offensive_tool_keyword = /\stheHarvester\.py\s/ nocase ascii wide
                        $string59_exegol_offensive_tool_keyword = /\suberfile\.py\s/ nocase ascii wide
                        $string60_exegol_offensive_tool_keyword = " --wpad --lm --ProxyAuth --disable-ess" nocase ascii wide
                        $string61_exegol_offensive_tool_keyword = /\.py\s\-aesKey\s\\"9ff86898afa70f5f7b9f2bf16320cb38edb2639409e1bc441ac417fac1fed5ab\\"/ nocase ascii wide
                        $string62_exegol_offensive_tool_keyword = /\.py\s\-\-zip\s\-c\sAll\s\-d\s.{0,100}\s\-u\s.{0,100}\s\-\-hashes\s\'ffffffffffffffffffffffffffffffff\'\:.{0,100}\s\-dc\s/ nocase ascii wide
                        $string63_exegol_offensive_tool_keyword = /\/\.cme\/cme\.conf/
                        $string64_exegol_offensive_tool_keyword = /\/\.exegol\//
                        $string65_exegol_offensive_tool_keyword = /\/ASREProastables\.txt/
                        $string66_exegol_offensive_tool_keyword = /\/AzureHound\.ps1/ nocase ascii wide
                        $string67_exegol_offensive_tool_keyword = /\/bash_completion\.d\/exegol/
                        $string68_exegol_offensive_tool_keyword = /\/completions\/exegol\.fish/
                        $string69_exegol_offensive_tool_keyword = /\/CrackMapExec\.git/ nocase ascii wide
                        $string70_exegol_offensive_tool_keyword = /\/crackmapexec\/cme\.conf/
                        $string71_exegol_offensive_tool_keyword = /\/darkweb2017\-top100\.txt/
                        $string72_exegol_offensive_tool_keyword = /\/deepce\.sh\s.{0,100}\-\-install/
                        $string73_exegol_offensive_tool_keyword = /\/exegol\.py/
                        $string74_exegol_offensive_tool_keyword = /\/exegol_user_sources\.list/
                        $string75_exegol_offensive_tool_keyword = "/exegol-docker-build/"
                        $string76_exegol_offensive_tool_keyword = "/Exegol-history/"
                        $string77_exegol_offensive_tool_keyword = /\/Exegol\-images\-.{0,100}\.zip/ nocase ascii wide
                        $string78_exegol_offensive_tool_keyword = /\/Exegol\-images\.git/ nocase ascii wide
                        $string79_exegol_offensive_tool_keyword = /\/linpeas\.sh/
                        $string80_exegol_offensive_tool_keyword = "/metasploit-framework/embedded/framework" nocase ascii wide
                        $string81_exegol_offensive_tool_keyword = /\/ntlmv1\.py/
                        $string82_exegol_offensive_tool_keyword = /\/opt\/\.exegol_aliases/
                        $string83_exegol_offensive_tool_keyword = "/opt/seclists/Discovery/"
                        $string84_exegol_offensive_tool_keyword = "/Plazmaz/LNKUp" nocase ascii wide
                        $string85_exegol_offensive_tool_keyword = /\/pywsus\.py/ nocase ascii wide
                        $string86_exegol_offensive_tool_keyword = /\/Responder\/Responder\.conf/
                        $string87_exegol_offensive_tool_keyword = /\/root\/\.mozilla\/firefox\/.{0,100}\.Exegol/
                        $string88_exegol_offensive_tool_keyword = /\/shadowcoerce\.py/
                        $string89_exegol_offensive_tool_keyword = /\/targetedKerberoast\.py/ nocase ascii wide
                        $string90_exegol_offensive_tool_keyword = /\/theHarvester\.py/ nocase ascii wide
                        $string91_exegol_offensive_tool_keyword = "/tmp/metasploit_install"
                        $string92_exegol_offensive_tool_keyword = /\/top\-usernames\-shortlist\.txt/
                        $string93_exegol_offensive_tool_keyword = /\/uberfile\.py/
                        $string94_exegol_offensive_tool_keyword = "/usr/local/bin/exegol"
                        $string95_exegol_offensive_tool_keyword = /\/var\/log\/exegol\/.{0,100}\.log/
                        $string96_exegol_offensive_tool_keyword = ":'123pentest'" nocase ascii wide
                        $string97_exegol_offensive_tool_keyword = /\\AzureHound\.ps1/ nocase ascii wide
                        $string98_exegol_offensive_tool_keyword = /\\Exegol\-.{0,100}\.zip/ nocase ascii wide
                        $string99_exegol_offensive_tool_keyword = /\\exegol\.py/ nocase ascii wide
                        $string100_exegol_offensive_tool_keyword = /\\Exegol\-images\-.{0,100}\.zip/ nocase ascii wide
                        $string101_exegol_offensive_tool_keyword = /\\Exegol\-images\-.{0,100}\\.{0,100}docker/ nocase ascii wide
                        $string102_exegol_offensive_tool_keyword = /\\pywsus\.py/ nocase ascii wide
                        $string103_exegol_offensive_tool_keyword = /\\shadowcoerce\.py/ nocase ascii wide
                        $string104_exegol_offensive_tool_keyword = /\\uberfile\.py/ nocase ascii wide
                        $string105_exegol_offensive_tool_keyword = /aclpwn\s\-f\s.{0,100}\s\-ft\scomputer\s\-t\s.{0,100}\s\-tt\sdomain\s\-d\s.{0,100}\s\-dry/ nocase ascii wide
                        $string106_exegol_offensive_tool_keyword = /addcomputer\.py\s\-computer\-name\s.{0,100}\s\-computer\-pass\s.{0,100}\s\-dc\-host\s.{0,100}\s\-domain\-netbios\s/ nocase ascii wide
                        $string107_exegol_offensive_tool_keyword = /addcomputer\.py\s\-delete\s\-computer\-name\s.{0,100}\s\-dc\-host\s.{0,100}\s\-domain\-netbios\s/ nocase ascii wide
                        $string108_exegol_offensive_tool_keyword = /addspn\.py\s\-u\s.{0,100}\s\-p\s.{0,100}\s\-t\s.{0,100}\s\-s\s.{0,100}\s\-\-additional\s/ nocase ascii wide
                        $string109_exegol_offensive_tool_keyword = "adidnsdump -u " nocase ascii wide
                        $string110_exegol_offensive_tool_keyword = "aireplay-ng " nocase ascii wide
                        $string111_exegol_offensive_tool_keyword = "aireplay-ng " nocase ascii wide
                        $string112_exegol_offensive_tool_keyword = "airodump-ng " nocase ascii wide
                        $string113_exegol_offensive_tool_keyword = "amass enum -d " nocase ascii wide
                        $string114_exegol_offensive_tool_keyword = /avrdude\s\-c\susbasp\s\-p\sm328p\s\-U\sflash\:w\:avr\.hex/ nocase ascii wide
                        $string115_exegol_offensive_tool_keyword = "aws configure --profile exegol" nocase ascii wide
                        $string116_exegol_offensive_tool_keyword = "bettercap -iface eth0" nocase ascii wide
                        $string117_exegol_offensive_tool_keyword = /binwalk\s\-e\simage\.png/ nocase ascii wide
                        $string118_exegol_offensive_tool_keyword = "bloodhound &> /dev/null &" nocase ascii wide
                        $string119_exegol_offensive_tool_keyword = /bloodhound\-import\s\-du\sneo4j\s\-dp\s.{0,100}\.json/ nocase ascii wide
                        $string120_exegol_offensive_tool_keyword = /bloodhound\-quickwin\s\-u\s.{0,100}\s\-p\s/ nocase ascii wide
                        $string121_exegol_offensive_tool_keyword = "bruteforce-luks -" nocase ascii wide
                        $string122_exegol_offensive_tool_keyword = "bruteforce-luks -t 4 -l 5 -m 5 /dev/sdb1" nocase ascii wide
                        $string123_exegol_offensive_tool_keyword = /bully\swlan1mon\s\-b\s.{0,100}\s\-c\s9\s\-S\s\-F\s\-B\s\-v\s3/ nocase ascii wide
                        $string124_exegol_offensive_tool_keyword = /buster\s\-e\s.{0,100}\s\-f\sjohn\s\-l\sdoe\s\-b\s\'.{0,100}.{0,100}.{0,100}.{0,100}1989\'/ nocase ascii wide
                        $string125_exegol_offensive_tool_keyword = "byt3bl33d3r/pth-toolkit" nocase ascii wide
                        $string126_exegol_offensive_tool_keyword = "calebstewart/pwncat" nocase ascii wide
                        $string127_exegol_offensive_tool_keyword = /cat\sdomains\.txt\s\|\sdnsx\s\-silent\s\-w\sjira.{0,100}grafana.{0,100}jenkins\s\-d\s\-/ nocase ascii wide
                        $string128_exegol_offensive_tool_keyword = "certipy find " nocase ascii wide
                        $string129_exegol_offensive_tool_keyword = "certipy relay -ca " nocase ascii wide
                        $string130_exegol_offensive_tool_keyword = "certipy req -username " nocase ascii wide
                        $string131_exegol_offensive_tool_keyword = /certsync\s\-u\s.{0,100}\s\-p\s.{0,100}\-d\s.{0,100}\s\-ca\-ip\s/ nocase ascii wide
                        $string132_exegol_offensive_tool_keyword = /cewl\s\-\-depth\s.{0,100}\s\-\-with\-numbers\s\-/ nocase ascii wide
                        $string133_exegol_offensive_tool_keyword = /client\s\$ATTACKER\-IP\:\$ATTACKER\-PORT\sR\:\$PORT\:socks/ nocase ascii wide
                        $string134_exegol_offensive_tool_keyword = /cloudfail\.py\s\-\-target\sseo\.com\s\-\-tor/ nocase ascii wide
                        $string135_exegol_offensive_tool_keyword = "cloudmapper collect --account parent --profile parent" nocase ascii wide
                        $string136_exegol_offensive_tool_keyword = /cloudmapper\sconfigure\sadd\-account\s\-\-config\-file\sconfig\.json\s\-\-name\sparent\s\-\-id\sXXX\s\-\-default\strue/ nocase ascii wide
                        $string137_exegol_offensive_tool_keyword = "cloudmapper configure discover-organization-accounts" nocase ascii wide
                        $string138_exegol_offensive_tool_keyword = /cloudsplaining\screate\-multi\-account\-config\-file\s\-o\saccounts\.yml/ nocase ascii wide
                        $string139_exegol_offensive_tool_keyword = "cloudsplaining download --profile someprofile" nocase ascii wide
                        $string140_exegol_offensive_tool_keyword = /cloudsplaining\sscan\s\-\-input\-file\sdefault\.json/ nocase ascii wide
                        $string141_exegol_offensive_tool_keyword = /cloudsplaining\sscan\-multi\-account\s\-c\saccounts\.yml\s\-r\sTargetRole\s\-\-output\-directory\s\.\//
                        $string142_exegol_offensive_tool_keyword = /cloudsplaining\sscan\-policy\-file\s\-\-input\-file\sexamples\/policies\/wildcards\.json/ nocase ascii wide
                        $string143_exegol_offensive_tool_keyword = /coercer\s\-d\s.{0,100}\s\-u\s/ nocase ascii wide
                        $string144_exegol_offensive_tool_keyword = /corscanner\s\-i\surls\.txt\s\-t\s100/ nocase ascii wide
                        $string145_exegol_offensive_tool_keyword = /cowpatty\s\-f\s.{0,100}\.txt\s\-r\s.{0,100}\.cap\s\-s\s/ nocase ascii wide
                        $string146_exegol_offensive_tool_keyword = /cp\ssliver\-.{0,100}\s\/opt\/tools\/bin/ nocase ascii wide
                        $string147_exegol_offensive_tool_keyword = /crackhound\.py\s\-\-verbose\s\-\-password\s.{0,100}\s\-\-plain\-text\s.{0,100}\s\-\-domain\s.{0,100}\s\-\-file\s.{0,100}\s\-\-add\-password\s/ nocase ascii wide
                        $string148_exegol_offensive_tool_keyword = /crunch\s4\s7\sabcdefghijklmnopqrstuvwxyz1234567890\s\-o\swordlist\.txt/ nocase ascii wide
                        $string149_exegol_offensive_tool_keyword = /curl\s.{0,100}\s\-\-upload\-file\sbackdoor\.php\s\-v/ nocase ascii wide
                        $string150_exegol_offensive_tool_keyword = "cypheroth -u neo4j -p " nocase ascii wide
                        $string151_exegol_offensive_tool_keyword = /dacledit\.py\s\-action\swrite\s\-rights\sDCSync\s\-principal\s.{0,100}\s\-target\-dn\s/ nocase ascii wide
                        $string152_exegol_offensive_tool_keyword = "danielmiessler/SecLists" nocase ascii wide
                        $string153_exegol_offensive_tool_keyword = /danielmiessler\/SecLists\.git/ nocase ascii wide
                        $string154_exegol_offensive_tool_keyword = /darkarmour\s\-f\s.{0,100}\.exe\s\-\-encrypt\sxor\s\-\-jmp\s\-\-loop\s7\s\-o\s.{0,100}\.exe/ nocase ascii wide
                        $string155_exegol_offensive_tool_keyword = "das add -db dbname masscan " nocase ascii wide
                        $string156_exegol_offensive_tool_keyword = "das add -db dbname rustscan " nocase ascii wide
                        $string157_exegol_offensive_tool_keyword = /das\sreport\s\-hosts\s192\.168\.1\.0\/24\s\-oA\sreport2/ nocase ascii wide
                        $string158_exegol_offensive_tool_keyword = "das scan -db dbname -hosts all -oA report1 -nmap '-Pn -sVC -O' -parallel" nocase ascii wide
                        $string159_exegol_offensive_tool_keyword = /das\sscan\s\-db\sdbname\s\-ports\s22.{0,100}80.{0,100}443.{0,100}445\s\-show/ nocase ascii wide
                        $string160_exegol_offensive_tool_keyword = /dfscoerce\.py\s\-d\s/ nocase ascii wide
                        $string161_exegol_offensive_tool_keyword = /dirb\s.{0,100}http.{0,100}\s\/usr\/share\/seclists\/Discovery\/Web\-Content\/big\.txt/ nocase ascii wide
                        $string162_exegol_offensive_tool_keyword = "dirkjanm/ldapdomaindump" nocase ascii wide
                        $string163_exegol_offensive_tool_keyword = "dirkjanm/PKINITtools" nocase ascii wide
                        $string164_exegol_offensive_tool_keyword = /dirsearch\s\-r\s\-w\s\/usr\/share\/wordlists\/seclists\/Discovery\/Web\-Content\/quickhits\.txt/ nocase ascii wide
                        $string165_exegol_offensive_tool_keyword = /dnschef\s\-\-fakeip\s127\.0\.0\.1\s\-q/ nocase ascii wide
                        $string166_exegol_offensive_tool_keyword = /dnsx\s\-silent\s\-d\s.{0,100}\s\-w\sdns_worldlist\.txt/ nocase ascii wide
                        $string167_exegol_offensive_tool_keyword = /dnsx\s\-silent\s\-d\sdomains\.txt\s\-w\sjira.{0,100}grafana.{0,100}jenkins/ nocase ascii wide
                        $string168_exegol_offensive_tool_keyword = /DonPAPI\s\\"\$DOMAIN\\"\// nocase ascii wide
                        $string169_exegol_offensive_tool_keyword = /droopescan\sscan\sdrupal\s\-u\s.{0,100}\s\-t\s32/ nocase ascii wide
                        $string170_exegol_offensive_tool_keyword = "drupwn --mode exploit --target " nocase ascii wide
                        $string171_exegol_offensive_tool_keyword = /dump_WPA\-PBKDF2\-PMKID_EAPOL\.hashcat/ nocase ascii wide
                        $string172_exegol_offensive_tool_keyword = /dump_WPA\-PMKID\-PBKDF2\.hashcat/ nocase ascii wide
                        $string173_exegol_offensive_tool_keyword = /eaphammer\s\-i\seth0\s\-\-channel\s4\s\-\-auth\swpa\-eap\s\-\-essid\s.{0,100}\s\-\-creds/ nocase ascii wide
                        $string174_exegol_offensive_tool_keyword = /echo\s.{0,100}\/24\s\|\sdnsx\s\-silent\s\-resp\-only\s\-ptr/ nocase ascii wide
                        $string175_exegol_offensive_tool_keyword = /echo\s\'8\.8\.8\.8\'\s\|\shakrevdns/ nocase ascii wide
                        $string176_exegol_offensive_tool_keyword = "EgeBalci/amber@latest" nocase ascii wide
                        $string177_exegol_offensive_tool_keyword = "enum4linux-ng -A -u "
                        $string178_exegol_offensive_tool_keyword = "evilmog/ntlmv1-multi" nocase ascii wide
                        $string179_exegol_offensive_tool_keyword = "evil-winrm -" nocase ascii wide
                        $string180_exegol_offensive_tool_keyword = "exegol4thewin" nocase ascii wide
                        $string181_exegol_offensive_tool_keyword = /ExegolController\.py/ nocase ascii wide
                        $string182_exegol_offensive_tool_keyword = "exegol-docker-build" nocase ascii wide
                        $string183_exegol_offensive_tool_keyword = /ExegolExceptions\.py/ nocase ascii wide
                        $string184_exegol_offensive_tool_keyword = "Exegol-images-main" nocase ascii wide
                        $string185_exegol_offensive_tool_keyword = /ExegolManager\.py/ nocase ascii wide
                        $string186_exegol_offensive_tool_keyword = /ExegolProgress\.py/ nocase ascii wide
                        $string187_exegol_offensive_tool_keyword = /ExegolPrompt\.py/ nocase ascii wide
                        $string188_exegol_offensive_tool_keyword = /eyewitness\s\-f\surls\.txt\s\-\-web/ nocase ascii wide
                        $string189_exegol_offensive_tool_keyword = /faketime\s\'202.{0,100}\szsh/ nocase ascii wide
                        $string190_exegol_offensive_tool_keyword = /fcrackzip\s\-u\s\-v\s\-D\s\-p\s.{0,100}\.zip/ nocase ascii wide
                        $string191_exegol_offensive_tool_keyword = /feroxbuster\s\-w\s.{0,100}fzf\-wordlists.{0,100}\s\-u\s/ nocase ascii wide
                        $string192_exegol_offensive_tool_keyword = "ffuf -fs 185 -c -w " nocase ascii wide
                        $string193_exegol_offensive_tool_keyword = /fierce\s\-\-domain.{0,100}\s\-\-dns\-servers\s/ nocase ascii wide
                        $string194_exegol_offensive_tool_keyword = /finalrecon\.py\s\-\-/ nocase ascii wide
                        $string195_exegol_offensive_tool_keyword = /findDelegation\.py\s\-dc\-ip\s/ nocase ascii wide
                        $string196_exegol_offensive_tool_keyword = /FindUncommonShares\.p/ nocase ascii wide
                        $string197_exegol_offensive_tool_keyword = /frida\s\-l\sdisableRoot\.js\s\-f\sowasp\.mstg\.uncrackable1/ nocase ascii wide
                        $string198_exegol_offensive_tool_keyword = "frida-ps -U" nocase ascii wide
                        $string199_exegol_offensive_tool_keyword = /fuxploider\s\-\-url\s.{0,100}\s\-\-not\-regex\s\\"wrong\sfile\stype\\"/ nocase ascii wide
                        $string200_exegol_offensive_tool_keyword = /geowordlists\s\-\-postal\-code\s75001\s\-\-kilometers\s25\s\-\-output\-file\s\/tmp\/around_paris\.txt/ nocase ascii wide
                        $string201_exegol_offensive_tool_keyword = "Get-GPPPassword -" nocase ascii wide
                        $string202_exegol_offensive_tool_keyword = /GetNPUsers\.py\s\-request/ nocase ascii wide
                        $string203_exegol_offensive_tool_keyword = /getnthash\.py\s\-key\s\'8eb7a6388780dd52eb358769dc53ff685fd135f89c4ef55abb277d7d98995f72\'/ nocase ascii wide
                        $string204_exegol_offensive_tool_keyword = /getST\.py\s.{0,100}\s\-spn\s/ nocase ascii wide
                        $string205_exegol_offensive_tool_keyword = /getST\.py\s\-k\s\-no\-pass\s\-spn/ nocase ascii wide
                        $string206_exegol_offensive_tool_keyword = /getTGT\.py\s\-dc\-ip\s/ nocase ascii wide
                        $string207_exegol_offensive_tool_keyword = /gettgtpkinit\.py\s\-cert\-pfx/ nocase ascii wide
                        $string208_exegol_offensive_tool_keyword = /gettgtpkinit\.py\s\-pfx\-base64\s/ nocase ascii wide
                        $string209_exegol_offensive_tool_keyword = /gMSADumper\.py/ nocase ascii wide
                        $string210_exegol_offensive_tool_keyword = "gobuster dir -w " nocase ascii wide
                        $string211_exegol_offensive_tool_keyword = /goldencopy\s.{0,100}\s\-\-password\s.{0,100}\s\-\-stealth\s\-\-krbtgt\s060ee2d06c5648e60a9ed916c9221ad19d90e5fb7b1cccf9d51f540fe991ada1\s/ nocase ascii wide
                        $string212_exegol_offensive_tool_keyword = "gopherus --exploit mysql" nocase ascii wide
                        $string213_exegol_offensive_tool_keyword = /gosecretsdump\s\-ntds\s.{0,100}\-system\s/ nocase ascii wide
                        $string214_exegol_offensive_tool_keyword = /goshs\s\-b\s.{0,100}\s\-\-ssl\s\-\-self\-signed\s\-p\s.{0,100}\s\-d\s\/workspace/ nocase ascii wide
                        $string215_exegol_offensive_tool_keyword = /gpp\-decrypt\.py\s\-f\sgroups\.xml/ nocase ascii wide
                        $string216_exegol_offensive_tool_keyword = "h2csmuggler --scan-list " nocase ascii wide
                        $string217_exegol_offensive_tool_keyword = /h2csmuggler\s\-x\s.{0,100}\s\-\-test/ nocase ascii wide
                        $string218_exegol_offensive_tool_keyword = /h8mail\s\-t\s.{0,100}\@.{0,100}\./ nocase ascii wide
                        $string219_exegol_offensive_tool_keyword = "Hackndo/sprayhound" nocase ascii wide
                        $string220_exegol_offensive_tool_keyword = "Hackplayers/evil-winrm" nocase ascii wide
                        $string221_exegol_offensive_tool_keyword = "hackrf_sweep -f " nocase ascii wide
                        $string222_exegol_offensive_tool_keyword = /hashonymize\s\-\-ntds\s.{0,100}\s\-\-kerberoast\s/ nocase ascii wide
                        $string223_exegol_offensive_tool_keyword = "HashPals/Name-That-Hash" nocase ascii wide
                        $string224_exegol_offensive_tool_keyword = /\-\-hash\-type\s1000\s\-\-potfile\-path.{0,100}\.ntds\.cracked/ nocase ascii wide
                        $string225_exegol_offensive_tool_keyword = /hcxdumptool\s\-i\swlan1\s\-o\s.{0,100}\s\-\-active_beacon\s\-\-enable_status\=1/ nocase ascii wide
                        $string226_exegol_offensive_tool_keyword = /hcxhashtool\s\-i\s.{0,100}\.hashcat\s\-\-info\sstdout/ nocase ascii wide
                        $string227_exegol_offensive_tool_keyword = /hcxpcapngtool\s\-\-all\s\-o\s.{0,100}\.hashcat/ nocase ascii wide
                        $string228_exegol_offensive_tool_keyword = /hcxpcapngtool\s\-o\s.{0,100}\.hashcat\s.{0,100}\.pcapng/ nocase ascii wide
                        $string229_exegol_offensive_tool_keyword = /HOST\/EXEGOL\-01\./ nocase ascii wide
                        $string230_exegol_offensive_tool_keyword = /Host\:\sFUZZ\.machine\.org/ nocase ascii wide
                        $string231_exegol_offensive_tool_keyword = /http.{0,100}\s\|\shakrawler\s\-d\s/ nocase ascii wide
                        $string232_exegol_offensive_tool_keyword = /HTTP\/EXEGOL\-01\./ nocase ascii wide
                        $string233_exegol_offensive_tool_keyword = /infoga\.py\s\-/ nocase ascii wide
                        $string234_exegol_offensive_tool_keyword = "install_aclpwn" nocase ascii wide
                        $string235_exegol_offensive_tool_keyword = "install_ad_apt_tools" nocase ascii wide
                        $string236_exegol_offensive_tool_keyword = "install_adidnsdump" nocase ascii wide
                        $string237_exegol_offensive_tool_keyword = "install_amber" nocase ascii wide
                        $string238_exegol_offensive_tool_keyword = "install_bloodhound" nocase ascii wide
                        $string239_exegol_offensive_tool_keyword = "install_bloodhound-import" nocase ascii wide
                        $string240_exegol_offensive_tool_keyword = "install_bloodhound-py" nocase ascii wide
                        $string241_exegol_offensive_tool_keyword = "install_bloodhound-quickwin" nocase ascii wide
                        $string242_exegol_offensive_tool_keyword = "install_certipy" nocase ascii wide
                        $string243_exegol_offensive_tool_keyword = "install_certsync" nocase ascii wide
                        $string244_exegol_offensive_tool_keyword = "install_coercer" nocase ascii wide
                        $string245_exegol_offensive_tool_keyword = "install_crackhound" nocase ascii wide
                        $string246_exegol_offensive_tool_keyword = "install_cracking_apt_tools" nocase ascii wide
                        $string247_exegol_offensive_tool_keyword = "install_crackmapexec" nocase ascii wide
                        $string248_exegol_offensive_tool_keyword = "install_cypheroth" nocase ascii wide
                        $string249_exegol_offensive_tool_keyword = "install_darkarmour" nocase ascii wide
                        $string250_exegol_offensive_tool_keyword = "install_dfscoerce" nocase ascii wide
                        $string251_exegol_offensive_tool_keyword = "install_donpapi" nocase ascii wide
                        $string252_exegol_offensive_tool_keyword = "install_enum4linux-ng"
                        $string253_exegol_offensive_tool_keyword = "install_enyx" nocase ascii wide
                        $string254_exegol_offensive_tool_keyword = "install_evilwinrm" nocase ascii wide
                        $string255_exegol_offensive_tool_keyword = "install_finduncommonshares" nocase ascii wide
                        $string256_exegol_offensive_tool_keyword = "install_gmsadumper" nocase ascii wide
                        $string257_exegol_offensive_tool_keyword = "install_goldencopy" nocase ascii wide
                        $string258_exegol_offensive_tool_keyword = "install_gosecretsdump" nocase ascii wide
                        $string259_exegol_offensive_tool_keyword = "install_gpp-decrypt" nocase ascii wide
                        $string260_exegol_offensive_tool_keyword = "install_hashonymize" nocase ascii wide
                        $string261_exegol_offensive_tool_keyword = "install_impacket" nocase ascii wide
                        $string262_exegol_offensive_tool_keyword = "install_keepwn" nocase ascii wide
                        $string263_exegol_offensive_tool_keyword = "install_kerbrute" nocase ascii wide
                        $string264_exegol_offensive_tool_keyword = "install_krbrelayx" nocase ascii wide
                        $string265_exegol_offensive_tool_keyword = "install_ldapdomaindump" nocase ascii wide
                        $string266_exegol_offensive_tool_keyword = "install_ldaprelayscan" nocase ascii wide
                        $string267_exegol_offensive_tool_keyword = "install_ldapsearch-ad" nocase ascii wide
                        $string268_exegol_offensive_tool_keyword = "install_lnkup" nocase ascii wide
                        $string269_exegol_offensive_tool_keyword = "install_lsassy" nocase ascii wide
                        $string270_exegol_offensive_tool_keyword = "install_manspider" nocase ascii wide
                        $string271_exegol_offensive_tool_keyword = "install_mitm6_pip" nocase ascii wide
                        $string272_exegol_offensive_tool_keyword = "install_noPac" nocase ascii wide
                        $string273_exegol_offensive_tool_keyword = "install_ntlmv1-multi" nocase ascii wide
                        $string274_exegol_offensive_tool_keyword = "install_oaburl" nocase ascii wide
                        $string275_exegol_offensive_tool_keyword = "install_PassTheCert" nocase ascii wide
                        $string276_exegol_offensive_tool_keyword = "install_pcredz" nocase ascii wide
                        $string277_exegol_offensive_tool_keyword = "install_petitpotam" nocase ascii wide
                        $string278_exegol_offensive_tool_keyword = "install_pkinittools" nocase ascii wide
                        $string279_exegol_offensive_tool_keyword = "install_polenum" nocase ascii wide
                        $string280_exegol_offensive_tool_keyword = "install_privexchange" nocase ascii wide
                        $string281_exegol_offensive_tool_keyword = "install_pth-tools" nocase ascii wide
                        $string282_exegol_offensive_tool_keyword = "install_pygpoabuse" nocase ascii wide
                        $string283_exegol_offensive_tool_keyword = "install_pykek" nocase ascii wide
                        $string284_exegol_offensive_tool_keyword = "install_pylaps" nocase ascii wide
                        $string285_exegol_offensive_tool_keyword = "install_pypykatz" nocase ascii wide
                        $string286_exegol_offensive_tool_keyword = "install_pywhisker" nocase ascii wide
                        $string287_exegol_offensive_tool_keyword = "install_pywsus" nocase ascii wide
                        $string288_exegol_offensive_tool_keyword = "install_responder" nocase ascii wide
                        $string289_exegol_offensive_tool_keyword = "install_roastinthemiddle" nocase ascii wide
                        $string290_exegol_offensive_tool_keyword = "install_ruler" nocase ascii wide
                        $string291_exegol_offensive_tool_keyword = "install_rusthound" nocase ascii wide
                        $string292_exegol_offensive_tool_keyword = "install_shadowcoerce" nocase ascii wide
                        $string293_exegol_offensive_tool_keyword = "install_smartbrute" nocase ascii wide
                        $string294_exegol_offensive_tool_keyword = "install_smbmap" nocase ascii wide
                        $string295_exegol_offensive_tool_keyword = "install_smtp-user-enum" nocase ascii wide
                        $string296_exegol_offensive_tool_keyword = "install_sprayhound" nocase ascii wide
                        $string297_exegol_offensive_tool_keyword = "install_targetedKerberoast" nocase ascii wide
                        $string298_exegol_offensive_tool_keyword = "install_webclientservicescanner" nocase ascii wide
                        $string299_exegol_offensive_tool_keyword = "install_windapsearch-go" nocase ascii wide
                        $string300_exegol_offensive_tool_keyword = "install_zerologon" nocase ascii wide
                        $string301_exegol_offensive_tool_keyword = /\-\-interface\s.{0,100}\s\-\-wpad\s\-\-lm\s\-\-disable\-ess/ nocase ascii wide
                        $string302_exegol_offensive_tool_keyword = "ip link set ligolo up"
                        $string303_exegol_offensive_tool_keyword = /ip\sroute\sadd\s.{0,100}\sdev\sligolo/
                        $string304_exegol_offensive_tool_keyword = "ip tuntap add user root mode tun ligolo"
                        $string305_exegol_offensive_tool_keyword = "irkjanm/krbrelayx" nocase ascii wide
                        $string306_exegol_offensive_tool_keyword = "jackit --reset --debug" nocase ascii wide
                        $string307_exegol_offensive_tool_keyword = /jdwp\-shellifier\.py\s\-t\s.{0,100}\s\-p\s.{0,100}\s\-\-cmd\s/ nocase ascii wide
                        $string308_exegol_offensive_tool_keyword = "john --format=" nocase ascii wide
                        $string309_exegol_offensive_tool_keyword = "john --wordlist=" nocase ascii wide
                        $string310_exegol_offensive_tool_keyword = "joomscan -u " nocase ascii wide
                        $string311_exegol_offensive_tool_keyword = /JuicyPotato\.exe/ nocase ascii wide
                        $string312_exegol_offensive_tool_keyword = "-K lsass_loot" nocase ascii wide
                        $string313_exegol_offensive_tool_keyword = /KeePwn\splugin\sadd\s\-u\s.{0,100}\s\-p\s.{0,100}\s\-d\s.{0,100}\s\-t\s/ nocase ascii wide
                        $string314_exegol_offensive_tool_keyword = "KeePwn plugin check -u " nocase ascii wide
                        $string315_exegol_offensive_tool_keyword = "kerbrute bruteuser " nocase ascii wide
                        $string316_exegol_offensive_tool_keyword = "kerbrute passwordspray " nocase ascii wide
                        $string317_exegol_offensive_tool_keyword = "kerbrute userenum " nocase ascii wide
                        $string318_exegol_offensive_tool_keyword = /kraken\.py\s\-\-connect\s\-\-mode\s.{0,100}\s\-\-profile\s.{0,100}\s\-\-compiler\s/ nocase ascii wide
                        $string319_exegol_offensive_tool_keyword = /KRB5CCNAME\=.{0,100}\.ccache.{0,100}\sgetST\.py\s\-self\s\-impersonate\s.{0,100}\s\-k\s\-no\-pass\s\-dc\-ip\s/ nocase ascii wide
                        $string320_exegol_offensive_tool_keyword = /krbrelayx\.py\s\-/ nocase ascii wide
                        $string321_exegol_offensive_tool_keyword = /LdapRelayScan\.py/ nocase ascii wide
                        $string322_exegol_offensive_tool_keyword = "libnfc_crypto1_crack a0a1a2a3a4a5 0 A 4 B" nocase ascii wide
                        $string323_exegol_offensive_tool_keyword = "ligolo-ng -selfcert" nocase ascii wide
                        $string324_exegol_offensive_tool_keyword = /linkedin2username\.py\s\-u/ nocase ascii wide
                        $string325_exegol_offensive_tool_keyword = "linpeas_darwin_amd64"
                        $string326_exegol_offensive_tool_keyword = "linpeas_darwin_arm64"
                        $string327_exegol_offensive_tool_keyword = "linpeas_linux_386"
                        $string328_exegol_offensive_tool_keyword = "linpeas_linux_amd64"
                        $string329_exegol_offensive_tool_keyword = "linpeas_linux_arm"
                        $string330_exegol_offensive_tool_keyword = /linux\-exploit\-suggester\.sh/
                        $string331_exegol_offensive_tool_keyword = /linux\-smart\-enumeration\.sh/
                        $string332_exegol_offensive_tool_keyword = /lnk\-generate\.py\s\-\-host\s.{0,100}\s\-\-type\sntlm\s\-\-output\s.{0,100}\.lnk/ nocase ascii wide
                        $string333_exegol_offensive_tool_keyword = /lookupsid\.py\s\-hashes\s\:.{0,100}\s.{0,100}\@.{0,100}\s0/ nocase ascii wide
                        $string334_exegol_offensive_tool_keyword = "lsassy -v -" nocase ascii wide
                        $string335_exegol_offensive_tool_keyword = /manspider\s\-\-threads\s.{0,100}\s\-d\s.{0,100}\s\-u\s.{0,100}\s\-H\s.{0,100}\s\-\-content\sadmin/ nocase ascii wide
                        $string336_exegol_offensive_tool_keyword = "mitm6 --" nocase ascii wide
                        $string337_exegol_offensive_tool_keyword = /ms14\-068\.py\s\-u\s/ nocase ascii wide
                        $string338_exegol_offensive_tool_keyword = /ms14\-068\.py\s\-u/ nocase ascii wide
                        $string339_exegol_offensive_tool_keyword = /noPac\s.{0,100}\s\-dc\-ip\s.{0,100}\s\-\-impersonate\s/ nocase ascii wide
                        $string340_exegol_offensive_tool_keyword = /nrf24\-scanner\.py\s\-l\s\-v/ nocase ascii wide
                        $string341_exegol_offensive_tool_keyword = "nth --text 5f4dcc3b5aa765d61d8327deb882cf99" nocase ascii wide
                        $string342_exegol_offensive_tool_keyword = "ntlmrelayx -" nocase ascii wide
                        $string343_exegol_offensive_tool_keyword = "ntlmv1-multi --ntlmv1 " nocase ascii wide
                        $string344_exegol_offensive_tool_keyword = "nuclei -u " nocase ascii wide
                        $string345_exegol_offensive_tool_keyword = /oaburl\.py\s.{0,100}\/.{0,100}\:.{0,100}\@.{0,100}\s\-e\s/ nocase ascii wide
                        $string346_exegol_offensive_tool_keyword = /onesixtyone\s\-c\s.{0,100}snmp_default_pass\.txt/ nocase ascii wide
                        $string347_exegol_offensive_tool_keyword = /onesixtyone\s\-c\s.{0,100}wordlists\// nocase ascii wide
                        $string348_exegol_offensive_tool_keyword = "pass-station search tomcat" nocase ascii wide
                        $string349_exegol_offensive_tool_keyword = /passthecert\.py\s\-action\sadd_computer\s\-crt\suser\.crt\s\-key\suser\.key\s\-domain\s.{0,100}\s\-dc\-ip\s/ nocase ascii wide
                        $string350_exegol_offensive_tool_keyword = /patator\sftp_login\shost\=.{0,100}\suser\=FILE0\s0\=.{0,100}\.txt\s/ nocase ascii wide
                        $string351_exegol_offensive_tool_keyword = /PCredz\s\-f\s.{0,100}\.pcap/ nocase ascii wide
                        $string352_exegol_offensive_tool_keyword = /pdfcrack\s\-f\s.{0,100}\.pdf/ nocase ascii wide
                        $string353_exegol_offensive_tool_keyword = /petitpotam\.py/ nocase ascii wide
                        $string354_exegol_offensive_tool_keyword = "phoneinfoga scan -n " nocase ascii wide
                        $string355_exegol_offensive_tool_keyword = /photon\.py\s\-u\s.{0,100}\s\-l\s3\s\-t\s100\s\-\-wayback/ nocase ascii wide
                        $string356_exegol_offensive_tool_keyword = /php_filter_chain_generator\s\-\-chain\s.{0,100}php\ssystem.{0,100}\'cmd\'\]/ nocase ascii wide
                        $string357_exegol_offensive_tool_keyword = "phpggc -l" nocase ascii wide
                        $string358_exegol_offensive_tool_keyword = /phpggc\smonolog\/rce1\sassert\s\'phpinfo\(\)\'/ nocase ascii wide
                        $string359_exegol_offensive_tool_keyword = "phpggc symfony/rce1 id" nocase ascii wide
                        $string360_exegol_offensive_tool_keyword = "pip install exegol" nocase ascii wide
                        $string361_exegol_offensive_tool_keyword = "pm3 -p /dev/ttyACM0" nocase ascii wide
                        $string362_exegol_offensive_tool_keyword = /pre2k\sauth\s.{0,100}\s\-\-dc\-ip\s/ nocase ascii wide
                        $string363_exegol_offensive_tool_keyword = /printerbug\.py\s.{0,100}\:.{0,100}\@.{0,100}\s/ nocase ascii wide
                        $string364_exegol_offensive_tool_keyword = /privexchange\.py/ nocase ascii wide
                        $string365_exegol_offensive_tool_keyword = "prowler gcp --credentials-file path" nocase ascii wide
                        $string366_exegol_offensive_tool_keyword = "proxmark3 -p /dev/ttyACM0" nocase ascii wide
                        $string367_exegol_offensive_tool_keyword = /proxychains\satexec\.py/ nocase ascii wide
                        $string368_exegol_offensive_tool_keyword = /proxychains\sdcomexec\.py/ nocase ascii wide
                        $string369_exegol_offensive_tool_keyword = /proxychains\spsexec\.py/ nocase ascii wide
                        $string370_exegol_offensive_tool_keyword = "proxychains secretsdump" nocase ascii wide
                        $string371_exegol_offensive_tool_keyword = /proxychains\ssmbexec\.py/ nocase ascii wide
                        $string372_exegol_offensive_tool_keyword = /proxychains\swmiexec\.py/ nocase ascii wide
                        $string373_exegol_offensive_tool_keyword = /pth\-net\srpc\sgroup\smembers\s.{0,100}Domain\sadmins/ nocase ascii wide
                        $string374_exegol_offensive_tool_keyword = /pth\-net\srpc\sgroup\smembers\s.{0,100}Exchange\sServers/ nocase ascii wide
                        $string375_exegol_offensive_tool_keyword = /pth\-net\srpc\spassword\s.{0,100}\s\-U\s.{0,100}\s\-S\s/ nocase ascii wide
                        $string376_exegol_offensive_tool_keyword = /pth\-net\srpc\suser\sadd\s.{0,100}\s\-U\s.{0,100}\-S\s/ nocase ascii wide
                        $string377_exegol_offensive_tool_keyword = /pwncat\-cs\s.{0,100}\:/ nocase ascii wide
                        $string378_exegol_offensive_tool_keyword = "pwncat-cs -lp " nocase ascii wide
                        $string379_exegol_offensive_tool_keyword = "pwncat-cs ssh://" nocase ascii wide
                        $string380_exegol_offensive_tool_keyword = /pwndb\s\-\-target\s\@.{0,100}\s\-\-output\s/ nocase ascii wide
                        $string381_exegol_offensive_tool_keyword = /pygpoabuse\s.{0,100}\s\-hashes\slm\:.{0,100}\s\-gpo\-id\s/ nocase ascii wide
                        $string382_exegol_offensive_tool_keyword = /pyLAPS\.py\s\-\-action\sget\s\-d\s.{0,100}\s\-u\s.{0,100}\s\-p\s.{0,100}\s\-\-dc\-ip\s/ nocase ascii wide
                        $string383_exegol_offensive_tool_keyword = /pyrit\s\-e\s.{0,100}\screate_essid/ nocase ascii wide
                        $string384_exegol_offensive_tool_keyword = /pyrit\s\-i\s.{0,100}\.txt\simport_passwords/ nocase ascii wide
                        $string385_exegol_offensive_tool_keyword = /pyrit\s\-r\s.{0,100}\.pcap\sattack_db/ nocase ascii wide
                        $string386_exegol_offensive_tool_keyword = /pyrit\s\-r\s.{0,100}\.pcap\s\-b\s.{0,100}\s\-i\s.{0,100}\.txt\sattack_passthrough/ nocase ascii wide
                        $string387_exegol_offensive_tool_keyword = /python\srsf\.py/ nocase ascii wide
                        $string388_exegol_offensive_tool_keyword = /python3\srsf\.py/ nocase ascii wide
                        $string389_exegol_offensive_tool_keyword = /pywhisker\.py\s\-/ nocase ascii wide
                        $string390_exegol_offensive_tool_keyword = /rbcd\.py\s\-delegate\-from\s.{0,100}\s\-delegate\-to\s.{0,100}\s\-dc\-ip\s.{0,100}\s\-action\swrite\s/ nocase ascii wide
                        $string391_exegol_offensive_tool_keyword = "rebootuser/LinEnum" nocase ascii wide
                        $string392_exegol_offensive_tool_keyword = /reg\.py\s.{0,100}\@.{0,100}\ssave\s\-keyName\s\'HKLM\\SAM/ nocase ascii wide
                        $string393_exegol_offensive_tool_keyword = /reg\.py\s.{0,100}\@.{0,100}\ssave\s\-keyName\s\'HKLM\\SECURITY/ nocase ascii wide
                        $string394_exegol_offensive_tool_keyword = /reg\.py\s.{0,100}\@.{0,100}\ssave\s\-keyName\s\'HKLM\\SYSTEM/ nocase ascii wide
                        $string395_exegol_offensive_tool_keyword = "register-python-argcomplete --no-defaults exegol" nocase ascii wide
                        $string396_exegol_offensive_tool_keyword = /renameMachine\.py\s\-current\-name\s.{0,100}\s\-new\-name\s.{0,100}\s\-dc\-ip\s.{0,100}\s.{0,100}\:/ nocase ascii wide
                        $string397_exegol_offensive_tool_keyword = "responder --interface" nocase ascii wide
                        $string398_exegol_offensive_tool_keyword = /Responder\/tools\/MultiRelay\/bin\/Runas\.exe/ nocase ascii wide
                        $string399_exegol_offensive_tool_keyword = /Responder\/tools\/MultiRelay\/bin\/Syssvc\.exe/ nocase ascii wide
                        $string400_exegol_offensive_tool_keyword = "responder-http-off" nocase ascii wide
                        $string401_exegol_offensive_tool_keyword = "responder-http-on" nocase ascii wide
                        $string402_exegol_offensive_tool_keyword = "responder-smb-off" nocase ascii wide
                        $string403_exegol_offensive_tool_keyword = "responder-smb-on" nocase ascii wide
                        $string404_exegol_offensive_tool_keyword = "rlwrap nc -lvnp " nocase ascii wide
                        $string405_exegol_offensive_tool_keyword = /roastinthemiddle\s\-i\s.{0,100}\s\-t\s.{0,100}\s\-u\s.{0,100}\.txt\s\-g\s/ nocase ascii wide
                        $string406_exegol_offensive_tool_keyword = "ropnop/go-windapsearch" nocase ascii wide
                        $string407_exegol_offensive_tool_keyword = "rsactftool --" nocase ascii wide
                        $string408_exegol_offensive_tool_keyword = /rsactftool.{0,100}\s\-\-dumpkey\s\-\-key\s/ nocase ascii wide
                        $string409_exegol_offensive_tool_keyword = /ruler\s.{0,100}\sabk\sdump\s\-o\s/ nocase ascii wide
                        $string410_exegol_offensive_tool_keyword = /ruler\s\-k\s\-d\s.{0,100}\sbrute\s\-\-users\s/ nocase ascii wide
                        $string411_exegol_offensive_tool_keyword = /rusthound\s.{0,100}\s\-\-zip\s\-\-ldaps\s\-\-adcs\s\-\-old\-bloodhound/ nocase ascii wide
                        $string412_exegol_offensive_tool_keyword = "samdump2 SYSTEM SAM > " nocase ascii wide
                        $string413_exegol_offensive_tool_keyword = "--script broadcast-dhcp-discover" nocase ascii wide
                        $string414_exegol_offensive_tool_keyword = "searchsploit -m " nocase ascii wide
                        $string415_exegol_offensive_tool_keyword = "searchsploit -x " nocase ascii wide
                        $string416_exegol_offensive_tool_keyword = /secret_fragment_exploit\.py\s.{0,100}\/_fragment/ nocase ascii wide
                        $string417_exegol_offensive_tool_keyword = "secretsdump -sam " nocase ascii wide
                        $string418_exegol_offensive_tool_keyword = /shadowcoerce\.py\s/ nocase ascii wide
                        $string419_exegol_offensive_tool_keyword = "ShawnDEvans/smbmap" nocase ascii wide
                        $string420_exegol_offensive_tool_keyword = /shellerator\s\-\-reverse\-shell\s\-\-lhost\s.{0,100}\s\-\-lport\s.{0,100}\s\-\-type\s/ nocase ascii wide
                        $string421_exegol_offensive_tool_keyword = "ShutdownRepo/smartbrute" nocase ascii wide
                        $string422_exegol_offensive_tool_keyword = /sipvicious_svcrack.{0,100}\s\-u100/ nocase ascii wide
                        $string423_exegol_offensive_tool_keyword = /smartbrute\s.{0,100}kerberos/ nocase ascii wide
                        $string424_exegol_offensive_tool_keyword = "-smb2support --remove-mic --shadow-credentials --shadow-target " nocase ascii wide
                        $string425_exegol_offensive_tool_keyword = /smbexec\.py\s\-hashes\s\:/ nocase ascii wide
                        $string426_exegol_offensive_tool_keyword = /smbexec\.py\s\-share/ nocase ascii wide
                        $string427_exegol_offensive_tool_keyword = "smbmap -u guest -H " nocase ascii wide
                        $string428_exegol_offensive_tool_keyword = /smbpasswd\.py\s\-newpass\s/
                        $string429_exegol_offensive_tool_keyword = /smbserver\.py\s\-smb2support\sEXEGOL/ nocase ascii wide
                        $string430_exegol_offensive_tool_keyword = /smtp\-user\-enum\s.{0,100}\s\-M\sEXPN\s/ nocase ascii wide
                        $string431_exegol_offensive_tool_keyword = /smtp\-user\-enum\s.{0,100}\s\-M\sRCPT\s/ nocase ascii wide
                        $string432_exegol_offensive_tool_keyword = /smtp\-user\-enum\s.{0,100}\s\-M\sVRFY\s/ nocase ascii wide
                        $string433_exegol_offensive_tool_keyword = /spiderfoot\s\-l\s127\.0\.0\.1\:/ nocase ascii wide
                        $string434_exegol_offensive_tool_keyword = "spiderfoot-cli -s http" nocase ascii wide
                        $string435_exegol_offensive_tool_keyword = /SpoolSample_v4\.5_x64\.exe/ nocase ascii wide
                        $string436_exegol_offensive_tool_keyword = "sprayhound -d " nocase ascii wide
                        $string437_exegol_offensive_tool_keyword = "sqlmap --forms --batch -u " nocase ascii wide
                        $string438_exegol_offensive_tool_keyword = /sshuttle\s\-r\s.{0,100}0\.0\.0\.0\/24/ nocase ascii wide
                        $string439_exegol_offensive_tool_keyword = /ssrfmap\s\-r\s.{0,100}\.txt\s\-p\sid\s\-m\sreadfiles.{0,100}portscan/ nocase ascii wide
                        $string440_exegol_offensive_tool_keyword = "subfinder -d " nocase ascii wide
                        $string441_exegol_offensive_tool_keyword = "subfinder -silent -d " nocase ascii wide
                        $string442_exegol_offensive_tool_keyword = "sublist3r -v -d " nocase ascii wide
                        $string443_exegol_offensive_tool_keyword = /swaks\s\-\-to\s.{0,100}\s\-\-from\s.{0,100}\s\-\-header\s.{0,100}Subject\:\s.{0,100}\s\-\-body\s.{0,100}\s\-\-server\s/ nocase ascii wide
                        $string444_exegol_offensive_tool_keyword = "swisskyrepo/SSRFmap" nocase ascii wide
                        $string445_exegol_offensive_tool_keyword = "tarunkant/Gopherus" nocase ascii wide
                        $string446_exegol_offensive_tool_keyword = "ThePorgs/Exegol-images" nocase ascii wide
                        $string447_exegol_offensive_tool_keyword = /ticketer\.py\s\-nthash/ nocase ascii wide
                        $string448_exegol_offensive_tool_keyword = /timing_attack\s.{0,100}\s\-\-brute\-force/ nocase ascii wide
                        $string449_exegol_offensive_tool_keyword = /tls\-scanner\s\-connect\s.{0,100}\:/ nocase ascii wide
                        $string450_exegol_offensive_tool_keyword = /tomcatWarDeployer\s\-v\s\-x\s\-p\s.{0,100}\s\-H\s.{0,100}\s/ nocase ascii wide
                        $string451_exegol_offensive_tool_keyword = /trevorspray\s.{0,100}\-\-recon\s/ nocase ascii wide
                        $string452_exegol_offensive_tool_keyword = "trevorspray -u " nocase ascii wide
                        $string453_exegol_offensive_tool_keyword = "trickster0/Enyx" nocase ascii wide
                        $string454_exegol_offensive_tool_keyword = /twint\s\-g\=.{0,100}km.{0,100}\s\-o\s.{0,100}\s\-\-csv/ nocase ascii wide
                        $string455_exegol_offensive_tool_keyword = /twint\s\-u\s.{0,100}\s\-\-since\s/ nocase ascii wide
                        $string456_exegol_offensive_tool_keyword = /uberfile\s\-\-lhost.{0,100}\s\-\-lport\s.{0,100}\s\-\-target\-os\s.{0,100}\s\-\-downloader\s/ nocase ascii wide
                        $string457_exegol_offensive_tool_keyword = "wafw00f https://" nocase ascii wide
                        $string458_exegol_offensive_tool_keyword = "webclientservicescanner -dc-ip " nocase ascii wide
                        $string459_exegol_offensive_tool_keyword = /webshell\-exegol\.php/ nocase ascii wide
                        $string460_exegol_offensive_tool_keyword = /weevely\sgenerate\s.{0,100}\.php/ nocase ascii wide
                        $string461_exegol_offensive_tool_keyword = /weevely\shttps\:\/\/.{0,100}\.php\s.{0,100}\sid/ nocase ascii wide
                        $string462_exegol_offensive_tool_keyword = /wfuzz\s\-\-.{0,100}\.txt/ nocase ascii wide
                        $string463_exegol_offensive_tool_keyword = "Wh1t3Fox/polenum" nocase ascii wide
                        $string464_exegol_offensive_tool_keyword = /wifite\s\-\-dict\s.{0,100}\.txt/ nocase ascii wide
                        $string465_exegol_offensive_tool_keyword = "wifite --kill" nocase ascii wide
                        $string466_exegol_offensive_tool_keyword = "windapsearch --dc " nocase ascii wide
                        $string467_exegol_offensive_tool_keyword = /winPEAS\.bat/ nocase ascii wide
                        $string468_exegol_offensive_tool_keyword = /winPEASany\.exe/ nocase ascii wide
                        $string469_exegol_offensive_tool_keyword = /winPEASany_ofs\.exe/ nocase ascii wide
                        $string470_exegol_offensive_tool_keyword = /winPEASx64\.exe/ nocase ascii wide
                        $string471_exegol_offensive_tool_keyword = /winPEASx86\.exe/ nocase ascii wide
                        $string472_exegol_offensive_tool_keyword = /winPEASx86_ofs\.exe/ nocase ascii wide
                        $string473_exegol_offensive_tool_keyword = /wmiexec\.py\s\-/ nocase ascii wide
                        $string474_exegol_offensive_tool_keyword = "wpscan --api-token " nocase ascii wide
                        $string475_exegol_offensive_tool_keyword = "XSpear -u " nocase ascii wide
                        $string476_exegol_offensive_tool_keyword = "xsrfprobe -u " nocase ascii wide
                        $string477_exegol_offensive_tool_keyword = /xsser\s\-u\s.{0,100}\s\-g\s.{0,100}\/login\?password\=.{0,100}\s\-\-Coo/ nocase ascii wide
                        $string478_exegol_offensive_tool_keyword = /zerologon\sclone\s.{0,100}https/ nocase ascii wide
                        $string479_exegol_offensive_tool_keyword = /zerologon\-restore\s.{0,100}\s\-target\-ip\s/ nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f8b9d68a-f35f-4e4d-aeee-5d7821502721
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
