empire

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'empire' taken from the ThreatHunting-Keywords github project
rule empire
{
    meta:
        description = "Detection patterns for the tool 'empire' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "empire"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1 = /\s\$FodHelperPath/ nocase ascii wide
                        $string2 = " -AgentDelay " nocase ascii wide
                        $string3 = " -AgentJitter " nocase ascii wide
                        $string4 = " -bootkey " nocase ascii wide
                        $string5 = /\s\-ChildPath\s.{0,100}fodhelper\.exe/ nocase ascii wide
                        $string6 = /\s\-ChildPath\s.{0,100}sdclt\.exe/ nocase ascii wide
                        $string7 = " -CollectionMethod stealth" nocase ascii wide
                        $string8 = " -ComputerName -ServiceEXE " nocase ascii wide
                        $string9 = " -ConType bind " nocase ascii wide
                        $string10 = " -ConType reverse " nocase ascii wide
                        $string11 = " -CShardDLLBytes" nocase ascii wide
                        $string12 = /\s\-DllName\s.{0,100}\s\-FunctionName\s/ nocase ascii wide
                        $string13 = /\s\-Domain\s.{0,100}\s\-SMB1\s/ nocase ascii wide
                        $string14 = " -DoNotPersistImmediately " nocase ascii wide
                        $string15 = " -DumpCerts " nocase ascii wide
                        $string16 = " -DumpCreds " nocase ascii wide
                        $string17 = /\s\-DumpForest\s\-Users\s.{0,100}krbtgt/ nocase ascii wide
                        $string18 = " -ElevatedPersistenceOption " nocase ascii wide
                        $string19 = /\sempire\.arguments/ nocase ascii wide
                        $string20 = /\sempire\.client\./ nocase ascii wide
                        $string21 = /\sempire\.py/ nocase ascii wide
                        $string22 = /\s\-Enumerate\s.{0,100}\s\-Module\s/ nocase ascii wide
                        $string23 = " -ExeArguments " nocase ascii wide
                        $string24 = /\s\-FullPrivs\s.{0,100}\s/ nocase ascii wide
                        $string25 = /\s\-GHUser\s.{0,100}\s\-GHRepo\s/ nocase ascii wide
                        $string26 = /\s\-Hosts\s.{0,100}\s\-TopPorts\s/ nocase ascii wide
                        $string27 = " http_malleable" nocase ascii wide
                        $string28 = " -ImpersonateUser " nocase ascii wide
                        $string29 = " -ImportDllPathPtr " nocase ascii wide
                        $string30 = " Inveigh-" nocase ascii wide
                        $string31 = " -JMXConsole -AppName " nocase ascii wide
                        $string32 = " -KillDate " nocase ascii wide
                        $string33 = " -KillDays " nocase ascii wide
                        $string34 = " -LLMNRTTL " nocase ascii wide
                        $string35 = /\s\-LNKPath\s.{0,100}\s\-EncScript\s/ nocase ascii wide
                        $string36 = " -mDNSTTL " nocase ascii wide
                        $string37 = " -NBNSTTL " nocase ascii wide
                        $string38 = " net localgroup administrators Tater /add" nocase ascii wide
                        $string39 = " -NoBase64 " nocase ascii wide
                        $string40 = " -NoP -sta -NonI -W Hidden -Enc " nocase ascii wide
                        $string41 = " -p 1337:1337 -p 5000:5000" nocase ascii wide
                        $string42 = " -PasswordList " nocase ascii wide
                        $string43 = /\s\-payload\s.{0,100}\-Lhost\s.{0,100}\-Lport/ nocase ascii wide
                        $string44 = " -PayloadPath " nocase ascii wide
                        $string45 = /\s\-PEPath\s.{0,100}\s\-ExeArgs\s/ nocase ascii wide
                        $string46 = " -PermanentWMI " nocase ascii wide
                        $string47 = " -PersistenceScriptName " nocase ascii wide
                        $string48 = " -PersistentScriptFilePath " nocase ascii wide
                        $string49 = " --port 1337" nocase ascii wide
                        $string50 = " -PWDumpFormat " nocase ascii wide
                        $string51 = " -Registry -AtStartup " nocase ascii wide
                        $string52 = " -RemoteDllHandle " nocase ascii wide
                        $string53 = " -RevToSelf " nocase ascii wide
                        $string54 = /\s\-Rhost\s.{0,100}\s\-WARFile\shttp/ nocase ascii wide
                        $string55 = /\s\-Rhosts\s.{0,100}\s\-Password\s.{0,100}\s\-Directory\s.{0,100}\s\-Dictionary\s/ nocase ascii wide
                        $string56 = /\s\-Rhosts\s.{0,100}\s\-Path\s.{0,100}\.txt\s\-Port\s/ nocase ascii wide
                        $string57 = " -ScheduledTask -OnIdle " nocase ascii wide
                        $string58 = /\s\-ServiceName\s.{0,100}\s\-PipeName\s/ nocase ascii wide
                        $string59 = " Set-MasterBootRecord" nocase ascii wide
                        $string60 = /\s\-SiteListFilePath\s.{0,100}\s\-B64Pass\s/ nocase ascii wide
                        $string61 = " SnifferSpoofer" nocase ascii wide
                        $string62 = " -SpooferIP " nocase ascii wide
                        $string63 = /\s\-Target\s.{0,100}\s\-AllDomain\s/ nocase ascii wide
                        $string64 = /\s\-Target\s.{0,100}\s\-InitialGrooms\s/ nocase ascii wide
                        $string65 = /\s\-Target\s.{0,100}\s\-Shellcode\s/ nocase ascii wide
                        $string66 = /\s\-type\suser\s\-search\s.{0,100}\s\-DomainController\s.{0,100}\s\-Credential\s.{0,100}\s\-list\syes/ nocase ascii wide
                        $string67 = /\s\-UserList\s.{0,100}\s\-Domain\s.{0,100}\s\-PasswordList\s.{0,100}\s\-OutFile\s/ nocase ascii wide
                        $string68 = /\s\-Username\s.{0,100}\s\-Hash\s.{0,100}\s\-Command\s/ nocase ascii wide
                        $string69 = " -UserPersistenceOption " nocase ascii wide
                        $string70 = " -VaultElementPtr " nocase ascii wide
                        $string71 = " windows/csharp_exe" nocase ascii wide
                        $string72 = " -WorkingHours " nocase ascii wide
                        $string73 = " Your payload has been delivered" nocase ascii wide
                        $string74 = /\$PipeName\s\=\s\\"TestSVC\\"/ nocase ascii wide
                        $string75 = /\$Taskname\=\\"Tater\\"/ nocase ascii wide
                        $string76 = "//localhost:1337" nocase ascii wide
                        $string77 = /\/api\/admin\/shutdown\?token\=/ nocase ascii wide
                        $string78 = /\/api\/agents\/.{0,100}\/kill\?token\=/ nocase ascii wide
                        $string79 = /\/api\/agents\/all\/kill\?token\=/ nocase ascii wide
                        $string80 = /\/api\/agents\/all\/shell\?token\=/ nocase ascii wide
                        $string81 = /\/api\/agents\/CXPLDTZCKFNT3SLT\/shell\?/ nocase ascii wide
                        $string82 = /\/api\/agents\/stale\?token\=/ nocase ascii wide
                        $string83 = /\/api\/agents\/XMY2H2ZPFWNPGEAP\?token\=/ nocase ascii wide
                        $string84 = /\/api\/listeners\/all\?token\=/ nocase ascii wide
                        $string85 = /\/api\/modules\/collection\/.{0,100}\?token\=/ nocase ascii wide
                        $string86 = /\/api\/modules\/credentials.{0,100}\?token\=/ nocase ascii wide
                        $string87 = /\/api\/reporting\/agent\/initial\?token\=/ nocase ascii wide
                        $string88 = /\/api\/reporting\/msg\/.{0,100}\?token\=/ nocase ascii wide
                        $string89 = /\/api\/reporting\/type\/checkin\?token\=/ nocase ascii wide
                        $string90 = /\/api\/stagers\/dll\?token\=/ nocase ascii wide
                        $string91 = /\/api\/stagers\?token\=/ nocase ascii wide
                        $string92 = /\/api\/users\/1\/disable\?token\=/ nocase ascii wide
                        $string93 = "/api/v2/starkiller" nocase ascii wide
                        $string94 = "/client/generated-stagers/" nocase ascii wide
                        $string95 = /\/data\/empire\.db/ nocase ascii wide
                        $string96 = /\/data\/empire\.orig\.key/ nocase ascii wide
                        $string97 = /\/download\-stager\.js/ nocase ascii wide
                        $string98 = /\/ducky\.py/ nocase ascii wide
                        $string99 = /\/Empire\.git/ nocase ascii wide
                        $string100 = "/empire/client/" nocase ascii wide
                        $string101 = "/empire:latest" nocase ascii wide
                        $string102 = /\/empire\-chain\.pem/ nocase ascii wide
                        $string103 = "/EmpireProject" nocase ascii wide
                        $string104 = "/evilhost:" nocase ascii wide
                        $string105 = /\/Get\-LsaSecret\./ nocase ascii wide
                        $string106 = /\/hop\.php/ nocase ascii wide
                        $string107 = /\/HTTP\-Login\.ps1/ nocase ascii wide
                        $string108 = /\/Invoke\-RunAs\.ps1/ nocase ascii wide
                        $string109 = "/lateral_movement/" nocase ascii wide
                        $string110 = /\/lateral_movement\/.{0,100}\.ps1/ nocase ascii wide
                        $string111 = /\/logs\/empire_server\.log/ nocase ascii wide
                        $string112 = /\/MailRaider\.ps1/ nocase ascii wide
                        $string113 = "/network/bloodhound3" nocase ascii wide
                        $string114 = /\/persistence\/.{0,100}\.ps1/ nocase ascii wide
                        $string115 = /\/persistence\/.{0,100}\.psm1/ nocase ascii wide
                        $string116 = "/privesc/" nocase ascii wide
                        $string117 = "/ps-empire" nocase ascii wide
                        $string118 = "/ReferenceSourceLibraries/Sharpire" nocase ascii wide
                        $string119 = /\/server\/common\/stagers\.py/ nocase ascii wide
                        $string120 = /\/Sharpire\.exe/ nocase ascii wide
                        $string121 = /\/situational_awareness\/.{0,100}\.exe/ nocase ascii wide
                        $string122 = /\/situational_awareness\/.{0,100}\.ps1/ nocase ascii wide
                        $string123 = /\/smb\/psexec\.rb/ nocase ascii wide
                        $string124 = /\/sprayed\-creds\.txt/ nocase ascii wide
                        $string125 = /\/stagers\/.{0,100}\.ps1/ nocase ascii wide
                        $string126 = "/stagers/CSharpPS" nocase ascii wide
                        $string127 = "/tmp/empire"
                        $string128 = /\/tools\/psexec\.rb/ nocase ascii wide
                        $string129 = "/trollsploit/" nocase ascii wide
                        $string130 = /\/x64_slim\.dll/ nocase ascii wide
                        $string131 = /\/xar\-1\.5\.2\.tar\.gz/ nocase ascii wide
                        $string132 = /\\EmpireCompiler\.dll/ nocase ascii wide
                        $string133 = /\\hijackers\\/ nocase ascii wide
                        $string134 = /\\PSRansom\.ps1/ nocase ascii wide
                        $string135 = /\\Sharpire\.exe/ nocase ascii wide
                        $string136 = /\\sprayed\-creds\.txt/ nocase ascii wide
                        $string137 = /\\Temp\\blah\.exe/ nocase ascii wide
                        $string138 = /\\UACBypassTest\.txt/ nocase ascii wide
                        $string139 = "0207936279f3e40608ea72aae76312c3e5485f6eabd041d5c690f485c523a795" nocase ascii wide
                        $string140 = "0c79bc58224e71882e48b6230f3a90ec516f30ba8a6a431f7d2f6323de581a81" nocase ascii wide
                        $string141 = "0fa7194f72ad2e12774792f48c2cc01e4828356087210370acdd9c66b67f818b" nocase ascii wide
                        $string142 = "10226b3b8594c981077a5e415bd98787c94b6f3f2ca48a50089fdf3f2c2547e8" nocase ascii wide
                        $string143 = "1085654ad66ba105edeca8e068047afdcec8f3d35aaa2dc09cf5cb5518971e15" nocase ascii wide
                        $string144 = "12da3e3bfe44e83838a66ed2c8cbaf3fd7153b815d21dd14c2f8de2f10130b3d" nocase ascii wide
                        $string145 = /1337.{0,100}\/api\/agents\/.{0,100}\/results\?token\=/ nocase ascii wide
                        $string146 = /1337.{0,100}\/api\/creds\?token\=/ nocase ascii wide
                        $string147 = /1337.{0,100}\/api\/listeners\?token\=/ nocase ascii wide
                        $string148 = "15065a09f2a944aa4376a3efe035b209f2c9617be19e08640320fb874e0e991c" nocase ascii wide
                        $string149 = "1ee8a433f650466547e5003bcf470eb70cfcaee27cbebae2f55adbcbacd6bf40" nocase ascii wide
                        $string150 = "21f37987d11f82d9a0b38b6caca5b5c7967172f3204c8ecc98cb3a5033097467" nocase ascii wide
                        $string151 = "242edf5f22175e7bb921568de525cd1469c3462fbb5943a04f2cc681cff764f4" nocase ascii wide
                        $string152 = "24b6f5f69fbc819dcfbdaa0efcfbf5a71f26f651e5c2310ebe495b193f89cce9" nocase ascii wide
                        $string153 = "25110aab44570c065061044d38afc50eea45ca5f78bb2b70b0941d63c979cf62" nocase ascii wide
                        $string154 = "285a2bf9a6a6a90d942d0c20832f5c0722e3aa557498cd1b6208b52932bbc18d" nocase ascii wide
                        $string155 = "2873fe0d14429c67afb56a58407a9ac664b395eb0fa7c8101f69b055e3f747fa" nocase ascii wide
                        $string156 = "2c0a644ec77673d8ec16808a8ac299733ee6e91a3fed0c8da41d6d73812b0d29" nocase ascii wide
                        $string157 = "2e70433f8b5f60e28dbd95757dd4bf967fa744142deac4b3bcb0d3b11cb99753" nocase ascii wide
                        $string158 = "32cd91c759b8cb4efca9582ee8ff760f1121f109a5e54a6c6da956713ef81f0f" nocase ascii wide
                        $string159 = "3644992e6ddad57730c25549175afaded580cd12226675105f71525e7d089d24" nocase ascii wide
                        $string160 = "382c77a7693178867a24912db26b69a1fe5d508cde83ea89309758ef5d001e44" nocase ascii wide
                        $string161 = "41792ea386bced0624ba2066ed3616167eebb93212f6751e60382c0ba10a9e59" nocase ascii wide
                        $string162 = "4ed4145e2a1ea00c2cf463f86d627341b58d0e0887ae317ebfce6dd5d48f8749" nocase ascii wide
                        $string163 = "573b83b3dc86832085eca5958fa11c0b5874edb3fdf84a016a21a8cc40454ea2" nocase ascii wide
                        $string164 = "59d6b8ce447b8168f7d17f18a1584dd54c543fed2b35a5b76c49c034e20dffe2" nocase ascii wide
                        $string165 = "5aef3aec6cf7fd4f2a1b1f82768092cf7c861f3f4efb8d7b1764c51f4620e946" nocase ascii wide
                        $string166 = "618af083df8944b89618a4bed2d4be44f901f3b9659f066d6e210ec0cb92e603" nocase ascii wide
                        $string167 = "6be97bfbc4bdb40ea061c20d75d0c812de61b262c96f891a438fdd280aad4c6f" nocase ascii wide
                        $string168 = "6ecb62923d16588654c77ad581388eb27873b09c2ff642cd8303c8a2d577fe53" nocase ascii wide
                        $string169 = "722e522f4029a9e0eb3ce298d28949e304b797d242cd4ae8f81e0530ca0acc8f" nocase ascii wide
                        $string170 = "77db549ca1d8238056074d8abda0c1715bb69f1c0b85795f1680c20960e6a757" nocase ascii wide
                        $string171 = "798ccfbf2e5c14077023d9236363c6e6ebf3bc6b28b551c01b00e272863bdcc7" nocase ascii wide
                        $string172 = "7e4fc58a02442bd5021c2a0b1bc032a1b65dfa1dbb182fc9a13e4716da7c51d9" nocase ascii wide
                        $string173 = "7e5d70e9ea31688ed3b6192e0f4bc7ba02b6d3fc772598ac187c02275a44cc02" nocase ascii wide
                        $string174 = "7fdf7529eb3c25f47136fa12a74040e38f4eda6cdd66f760977e537a292abea6" nocase ascii wide
                        $string175 = "841f439c8f42ffe1fa88303a9d7fd8268b6cdf9dd8b91704ba2dd8a7b8f813a3" nocase ascii wide
                        $string176 = "86943e3a790e194a2f76aa2c4ed2832e19fe4e7a45eeebe5f5bc62fd16825bd5" nocase ascii wide
                        $string177 = "8da1165d0f8bc514c82d5818ac89bb7a5e31d1f78258ac8beecb7b73fc5d857a" nocase ascii wide
                        $string178 = "91a40fb5af592e1b63099fb236a1c955b47c4699197651b9ae1507ecbf4ad2ea" nocase ascii wide
                        $string179 = "95df94b5f2e9428ee39f9f6706fd746a116a8afe9eeb3b318c576bbb934e35a4" nocase ascii wide
                        $string180 = "96023f92abefc6b2196bda989320836075a1fa402106fd7cc8fb546bc09502b7" nocase ascii wide
                        $string181 = "9fb43934f7fab913cd91847ca228bba739f98f58074bcedd50a912a71b313c5c" nocase ascii wide
                        $string182 = "a4a394d85597168c85a244e6ec4d8ff7c8a92f3938bf40dac9ba5a0ce9803d05" nocase ascii wide
                        $string183 = "a58fa5635efa5a680c1861aca8a2e630b4031dadb901fe36df5e1f7018948275" nocase ascii wide
                        $string184 = "ACBypassTest" nocase ascii wide
                        $string185 = "Add-Persistence" nocase ascii wide
                        $string186 = "Add-PSFirewallRules" nocase ascii wide
                        $string187 = "apt install powershell-empire" nocase ascii wide
                        $string188 = "bc2ef0da409c8c1a026e13d11b4cf32995e4a7e742c097ca9d1594aba8d3d4e3" nocase ascii wide
                        $string189 = "bc-security/empire" nocase ascii wide
                        $string190 = "bcsecurity/empire:latest" nocase ascii wide
                        $string191 = "BC-SECURITY/Starkiller" nocase ascii wide
                        $string192 = "Bitmap-Elevate" nocase ascii wide
                        $string193 = /BloodHound\.ps1/ nocase ascii wide
                        $string194 = /BloodHound3\.ps1/ nocase ascii wide
                        $string195 = "Building SYSTEM impersonation" nocase ascii wide
                        $string196 = "BypassUACTokenManipulation" nocase ascii wide
                        $string197 = "c12cad06d0e93742fd0ce0c698c654ff3c86b567dcc4102cd2c5d931d77dcc64" nocase ascii wide
                        $string198 = "c5b69369f46c94d6c1ac5c2f3808be48fa6d790c7d7d909d82850cc8774a14ac" nocase ascii wide
                        $string199 = "c85c649826d3f0cb619861663dbc70669e6705eec03ddb383fc9ef92125aaf25" nocase ascii wide
                        $string200 = "c93ff0ad29732505e9679eed6561ceef907bcb1f5df9b6a588c23e484df85681" nocase ascii wide
                        $string201 = "cc3f112ed5af9b0b4de3ab165c1a08b0d3d24323f8492f0513a0af9e06e95eff" nocase ascii wide
                        $string202 = /code_execution\/.{0,100}\.dll/ nocase ascii wide
                        $string203 = /code_execution\/.{0,100}\.exe/ nocase ascii wide
                        $string204 = /code_execution\/.{0,100}\.ps1/ nocase ascii wide
                        $string205 = "ConvertFrom-LDAPLogonHours" nocase ascii wide
                        $string206 = "ConvertTo-LogonHoursArray" nocase ascii wide
                        $string207 = "ConvertTo-Rc4ByteStream" nocase ascii wide
                        $string208 = "Create-NamedPipe" nocase ascii wide
                        $string209 = "Create-SuspendedWinLogon" nocase ascii wide
                        $string210 = "Create-WinLogonProcess" nocase ascii wide
                        $string211 = "csharp_inject_bof_inject" nocase ascii wide
                        $string212 = "D5865774-CD82-4CCE-A3F1-7F2C4639301B" nocase ascii wide
                        $string213 = "d78fa8da51c45a84c22819f0ab4f2b77135c9e8b48f693dde65384ecc3b8636c" nocase ascii wide
                        $string214 = "d7e3d2ef31bf5905d593420dbd3aa92e709d2524fa63ffa0bb3b75dc2ddc408f" nocase ascii wide
                        $string215 = "Decode-RoutingPacket" nocase ascii wide
                        $string216 = "DecryptNextCharacterWinSCP" nocase ascii wide
                        $string217 = "DecryptWinSCPPassword" nocase ascii wide
                        $string218 = "dedc1f4578fd081f28e2cca23dcb518fad39f9f782755bfa33e9723f32bb4487" nocase ascii wide
                        $string219 = "Discover-PSMSExchangeServers" nocase ascii wide
                        $string220 = "Discover-PSMSSQLServers" nocase ascii wide
                        $string221 = /\-DllInjection\.ps1/ nocase ascii wide
                        $string222 = /\-DllName\s.{0,100}\-Module\s/ nocase ascii wide
                        $string223 = "Do-AltShiftEsc" nocase ascii wide
                        $string224 = "Do-AltShiftTab" nocase ascii wide
                        $string225 = "docker run -it -p 1337:1337 -p 5000:5000 " nocase ascii wide
                        $string226 = /\-Domain\s.{0,100}\s\-AllowDelegation\s/ nocase ascii wide
                        $string227 = /\-Domain\s.{0,100}\s\-SPN\s/ nocase ascii wide
                        $string228 = /download\s.{0,100}bloodhound/ nocase ascii wide
                        $string229 = "DownloadAndExtractFromRemoteRegistry" nocase ascii wide
                        $string230 = /dumpCredStore\.ps1/ nocase ascii wide
                        $string231 = "-DumpForest " nocase ascii wide
                        $string232 = "e17b62d1052bbed122fd65f701fe79600dc84b9dc9d4cd1e17c1dca2cc2c2e71" nocase ascii wide
                        $string233 = "e55c296872a04e46369c46c23bae5707cd7d2e079a2f8350015475b5eecd3e17" nocase ascii wide
                        $string234 = "e8e5705168a9c66d1a4cf17d3ef2928b9141bffa3ca28a0482536e7900975a87" nocase ascii wide
                        $string235 = /echo\s.{0,100}\s\>\s\\\\\.\\pipe\\/ nocase ascii wide
                        $string236 = "ee58b36f91a49518422e7eab0fd0c82c9a154f95ae9dde863a02bc4da7ff398c" nocase ascii wide
                        $string237 = "egresscheck-framework" nocase ascii wide
                        $string238 = "ElevatePrivs" nocase ascii wide
                        $string239 = "Empire Framework GUI" nocase ascii wide
                        $string240 = "empire --rest " nocase ascii wide
                        $string241 = "empire --server " nocase ascii wide
                        $string242 = /empire\.server\.api\.v2/ nocase ascii wide
                        $string243 = /empire\/client\/.{0,100}\.py/ nocase ascii wide
                        $string244 = /empire\/server\/.{0,100}\.py/ nocase ascii wide
                        $string245 = "empire/server/downloads/" nocase ascii wide
                        $string246 = "empire/server/downloads/logs/" nocase ascii wide
                        $string247 = "empire/server/downloads/logs/" nocase ascii wide
                        $string248 = /Empire\@bc\-security\.org/ nocase ascii wide
                        $string249 = /empire_server\./ nocase ascii wide
                        $string250 = "empireadmin" nocase ascii wide
                        $string251 = /empire\-chain\.pem/ nocase ascii wide
                        $string252 = "EmpireCORSMiddleware" nocase ascii wide
                        $string253 = /Empire\-GUI\.git/ nocase ascii wide
                        $string254 = "Empire-master" nocase ascii wide
                        $string255 = /empire\-priv\.key/ nocase ascii wide
                        $string256 = "EmpireProject" nocase ascii wide
                        $string257 = /Empire\-Sponsors\.git/ nocase ascii wide
                        $string258 = "empire-test-kalirolling" nocase ascii wide
                        $string259 = "Enable-SeAssignPrimaryTokenPrivilege" nocase ascii wide
                        $string260 = "Enable-SeDebugPrivilege" nocase ascii wide
                        $string261 = "Encrypt-Bytes" nocase ascii wide
                        $string262 = "Enum-AllTokens" nocase ascii wide
                        $string263 = "Enum-Creds" nocase ascii wide
                        $string264 = /EternalBlue\.ps1/ nocase ascii wide
                        $string265 = "-EventVwrBypass" nocase ascii wide
                        $string266 = "ExfilDataToGitHub" nocase ascii wide
                        $string267 = /Exploit\-EternalBlue\.ps1/ nocase ascii wide
                        $string268 = "Exploit-JBoss -" nocase ascii wide
                        $string269 = /Exploit\-JBoss\.ps1/ nocase ascii wide
                        $string270 = "Exploit-Jenkins" nocase ascii wide
                        $string271 = /Exploit\-Jenkins\.ps1/ nocase ascii wide
                        $string272 = "Exploit-JMXConsole" nocase ascii wide
                        $string273 = "Export-PowerViewCSV" nocase ascii wide
                        $string274 = "f04b79d7179c98ce705876849a20f67bcff5c977f4f7865226e26296f1e80966" nocase ascii wide
                        $string275 = "f3e392c770e87e69c6af2d3e83bd4b6190e6e09ce4aa4a681316dbb11582e1b3" nocase ascii wide
                        $string276 = "f7e5471eda155f8ff46a63d00cab80b18a7eb62cbd1865d30bcff1b074af1887" nocase ascii wide
                        $string277 = "fbd9f058f3838363b1f6f3e63b22ae60532af2f21f5c73b18899c9b0b888e3f3" nocase ascii wide
                        $string278 = "febf23d1ae51d53d18aff75baa9b3c8f13775b5399e6d15ad138d1a9dcc2b871" nocase ascii wide
                        $string279 = /Fetch\-And\-Brute\-Local\-Accounts\.ps1/ nocase ascii wide
                        $string280 = "Find-4624Logons" nocase ascii wide
                        $string281 = "Find-4648Logons" nocase ascii wide
                        $string282 = "Find-AppLockerLogs" nocase ascii wide
                        $string283 = "Find-DLLHijack" nocase ascii wide
                        $string284 = "Find-DomainShare -" nocase ascii wide
                        $string285 = "Find-DomainShare -CheckShareAccess" nocase ascii wide
                        $string286 = /Find\-Fruit\./ nocase ascii wide
                        $string287 = /Find\-Fruit\.ps1/ nocase ascii wide
                        $string288 = "Find-InterestingDomainAcl" nocase ascii wide
                        $string289 = "Find-InterestingDomainShareFile" nocase ascii wide
                        $string290 = "Find-KeePassconfig" nocase ascii wide
                        $string291 = "Find-LocalAdminAccess" nocase ascii wide
                        $string292 = "Find-PathDLLHijack" nocase ascii wide
                        $string293 = "Find-PathHijack" nocase ascii wide
                        $string294 = "Find-ProcessDLLHijack" nocase ascii wide
                        $string295 = "Find-PSScriptsInPSAppLog" nocase ascii wide
                        $string296 = "Find-RDPClientConnections" nocase ascii wide
                        $string297 = "Find-TrustedDocuments" nocase ascii wide
                        $string298 = /Find\-TrustedDocuments\.ps1/ nocase ascii wide
                        $string299 = "Find-UserField -SearchField " nocase ascii wide
                        $string300 = "Find-WMILocalAdminAccess" nocase ascii wide
                        $string301 = "function psenum" nocase ascii wide
                        $string302 = "generate_powershell_exe" nocase ascii wide
                        $string303 = "generate_powershell_shellcode" nocase ascii wide
                        $string304 = "generate_python_exe" nocase ascii wide
                        $string305 = "generate_python_shellcode" nocase ascii wide
                        $string306 = "generate_stageless" nocase ascii wide
                        $string307 = "Get-ActiveTCPConnections" nocase ascii wide
                        $string308 = /Get\-and\-Brute\-LocalAccount\.ps1/ nocase ascii wide
                        $string309 = /Get\-AppLockerConfig\.ps1/ nocase ascii wide
                        $string310 = "Get-BloodHoundData" nocase ascii wide
                        $string311 = "Get-BootKey" nocase ascii wide
                        $string312 = /Get\-BrowserData\.ps1/ nocase ascii wide
                        $string313 = "Get-BrowserInformation" nocase ascii wide
                        $string314 = "Get-CachedGPPPassword" nocase ascii wide
                        $string315 = "Get-ChromeBookmarks" nocase ascii wide
                        $string316 = "Get-ChromeDump" nocase ascii wide
                        $string317 = "Get-ChromeDump" nocase ascii wide
                        $string318 = /Get\-ChromeDump\.ps1/ nocase ascii wide
                        $string319 = "Get-ChromeHistory" nocase ascii wide
                        $string320 = "Get-ClipboardContents" nocase ascii wide
                        $string321 = /Get\-ClipboardContents\.ps1/ nocase ascii wide
                        $string322 = /Get\-ComputerDetails\.ps1/ nocase ascii wide
                        $string323 = "GetComputersFromActiveDirectory" nocase ascii wide
                        $string324 = "Get-DCBadPwdCount" nocase ascii wide
                        $string325 = "Get-DecryptedCpassword" nocase ascii wide
                        $string326 = "Get-DecryptedSitelistPassword" nocase ascii wide
                        $string327 = "Get-DomainDFSshare" nocase ascii wide
                        $string328 = "Get-DomainDFSShareV1" nocase ascii wide
                        $string329 = "Get-DomainDFSShareV2" nocase ascii wide
                        $string330 = "Get-DomainFileServer" nocase ascii wide
                        $string331 = "Get-DomainForeignUser" nocase ascii wide
                        $string332 = "Get-DomainGPOComputerLocalGroupMapping" nocase ascii wide
                        $string333 = "Get-DomainGPOUserLocalGroupMapping" nocase ascii wide
                        $string334 = "Get-DomainManagedSecurityGroup" nocase ascii wide
                        $string335 = "Get-DomainObjectACL -" nocase ascii wide
                        $string336 = "Get-DomainSearcher" nocase ascii wide
                        $string337 = "Get-DomainSpn" nocase ascii wide
                        $string338 = "Get-DomainSPNTicket" nocase ascii wide
                        $string339 = "Get-FireFoxHistory" nocase ascii wide
                        $string340 = "Get-FoxDump " nocase ascii wide
                        $string341 = "Get-FoxDump" nocase ascii wide
                        $string342 = /Get\-FoxDump\.ps1/ nocase ascii wide
                        $string343 = "Get-GPPInnerFields" nocase ascii wide
                        $string344 = "Get-GPPPassword" nocase ascii wide
                        $string345 = /Get\-GPPPassword\.ps1/ nocase ascii wide
                        $string346 = "Get-ImageNtHeaders" nocase ascii wide
                        $string347 = /Get\-IndexedItem\.ps1/ nocase ascii wide
                        $string348 = "Get-InternetExplorerBookmarks" nocase ascii wide
                        $string349 = "Get-InternetExplorerHistory" nocase ascii wide
                        $string350 = "Get-KeePassconfig" nocase ascii wide
                        $string351 = "Get-KeePassDatabaseKey" nocase ascii wide
                        $string352 = "Get-KeePassINIFields" nocase ascii wide
                        $string353 = "Get-KeePassXMLFields" nocase ascii wide
                        $string354 = "Get-KerberosServiceTicket" nocase ascii wide
                        $string355 = /Get\-KerberosServiceTicket\.ps1/ nocase ascii wide
                        $string356 = "Get-Keystrokes" nocase ascii wide
                        $string357 = /Get\-Keystrokes\.ps1/ nocase ascii wide
                        $string358 = "Get-Killdate" nocase ascii wide
                        $string359 = "Get-LAPSPasswords" nocase ascii wide
                        $string360 = /Get\-LAPSPasswords\.ps1/ nocase ascii wide
                        $string361 = "Get-LastLoggedon -" nocase ascii wide
                        $string362 = "Get-LoggedOnLocal -" nocase ascii wide
                        $string363 = "Get-LsaSecret " nocase ascii wide
                        $string364 = "Get-ModifiableRegistryAutoRun" nocase ascii wide
                        $string365 = "Get-ModifiableScheduledTaskFile" nocase ascii wide
                        $string366 = "Get-NetComputer -Unconstrainuser" nocase ascii wide
                        $string367 = "Get-NetFileServer" nocase ascii wide
                        $string368 = "Get-NetForestDomain" nocase ascii wide
                        $string369 = "Get-NetLoggedon -" nocase ascii wide
                        $string370 = "Get-NetRDPSession -" nocase ascii wide
                        $string371 = "Get-NetUser -SPN" nocase ascii wide
                        $string372 = "Get-NetUser -UACFilter NOT_ACCOUNTDISABLE" nocase ascii wide
                        $string373 = "Get-NTLMLocalPasswordHashes" nocase ascii wide
                        $string374 = "Get-PacketNetBIOSSessionService" nocase ascii wide
                        $string375 = "Get-PacketNTLMSSPAuth" nocase ascii wide
                        $string376 = "Get-PacketNTLMSSPNegotiate" nocase ascii wide
                        $string377 = "Get-PacketRPCBind" nocase ascii wide
                        $string378 = "Get-PacketRPCRequest" nocase ascii wide
                        $string379 = "Get-PacketSMB" nocase ascii wide
                        $string380 = "Get-PEBasicInfo" nocase ascii wide
                        $string381 = "Get-PSADForestInfo " nocase ascii wide
                        $string382 = "Get-PSADForestKRBTGTInfo " nocase ascii wide
                        $string383 = "Get-RegAlwaysInstallElevated" nocase ascii wide
                        $string384 = "Get-RegAutoLogon" nocase ascii wide
                        $string385 = "Get-RegistryAlwaysInstallElevated" nocase ascii wide
                        $string386 = "Get-RegistryAutoLogon" nocase ascii wide
                        $string387 = "Get-RickAstley" nocase ascii wide
                        $string388 = /Get\-RickAstley\.ps1/ nocase ascii wide
                        $string389 = "Get-RubeusForgeryArgs" nocase ascii wide
                        $string390 = /Get\-Screenshot\.ps1/ nocase ascii wide
                        $string391 = /Get\-SecurityPackages\.ps1/ nocase ascii wide
                        $string392 = "Get-ServiceUnquoted" nocase ascii wide
                        $string393 = "Get-SharpChromium" nocase ascii wide
                        $string394 = /Get\-SharpChromium\.ps1/ nocase ascii wide
                        $string395 = "Get-SitelistFields" nocase ascii wide
                        $string396 = "Get-SiteListPassword" nocase ascii wide
                        $string397 = /Get\-SiteListPassword\.ps1/ nocase ascii wide
                        $string398 = /Get\-SPN\.ps1/ nocase ascii wide
                        $string399 = "Get-SQLInstanceDomain" nocase ascii wide
                        $string400 = /Get\-SQLInstanceDomain\.ps1/ nocase ascii wide
                        $string401 = /Get\-SQLQuery\.ps1/ nocase ascii wide
                        $string402 = "Get-SQLServerLoginDefaultPw" nocase ascii wide
                        $string403 = "Get-SQLSysadminCheck" nocase ascii wide
                        $string404 = /Get\-System\.ps1/ nocase ascii wide
                        $string405 = /Get\-SystemDNSServer\.ps1/ nocase ascii wide
                        $string406 = "Get-SystemNamedPipe" nocase ascii wide
                        $string407 = /Get\-TimedScreenshot\.ps1/ nocase ascii wide
                        $string408 = "Get-UniqueTokens" nocase ascii wide
                        $string409 = "Get-USBKeystrokes" nocase ascii wide
                        $string410 = "Get-UserBadPwdCount" nocase ascii wide
                        $string411 = "Get-VaultCredential" nocase ascii wide
                        $string412 = /Get\-VaultCredential\.ps1/ nocase ascii wide
                        $string413 = "Get-VulnAutoRun" nocase ascii wide
                        $string414 = "Get-VulnSchTask" nocase ascii wide
                        $string415 = /Get\-WinUpdates\.ps1/ nocase ascii wide
                        $string416 = "Get-WMIRegCachedRDPConnection" nocase ascii wide
                        $string417 = "Get-WMIRegLastLoggedOn" nocase ascii wide
                        $string418 = "Get-WMIRegMountedDrive" nocase ascii wide
                        $string419 = "Get-WorkingHours" nocase ascii wide
                        $string420 = "H4sIAAAAAAAEAIy5BVyTbdQ4PDbYYJSju2N0h5TSndJINyKD0RKKdIOgNIiSChIiYUurgIQoiICAlAJSiojgd9" nocase ascii wide
                        $string421 = "Honey hash" nocase ascii wide
                        $string422 = /http.{0,100}\/127\.0\.0\.1.{0,100}\:1337/ nocase ascii wide
                        $string423 = /http.{0,100}\/localhost.{0,100}\:1337/ nocase ascii wide
                        $string424 = /http\:\/\/127\.0\.0\.1\:8080\/invoker\/JMXInvokerServlet/ nocase ascii wide
                        $string425 = /http\:\/\/localhost\/stager\.php/ nocase ascii wide
                        $string426 = "http://localhost:80/bcsjngnk" nocase ascii wide
                        $string427 = /http_malleable\.py/ nocase ascii wide
                        $string428 = /HTTP\-Login\.ps1/ nocase ascii wide
                        $string429 = "ImportDll::GetAsyncKeyState" nocase ascii wide
                        $string430 = "Import-DllImports" nocase ascii wide
                        $string431 = "Import-DllInRemoteProcess" nocase ascii wide
                        $string432 = "Import-PhishWinLib" nocase ascii wide
                        $string433 = "Inject-BypassStuff " nocase ascii wide
                        $string434 = "Inject-BypassStuff" nocase ascii wide
                        $string435 = "injected into LSASS" nocase ascii wide
                        $string436 = /Injection.{0,100}\s\-ProcName\slsass/ nocase ascii wide
                        $string437 = "Inject-LocalShellcode" nocase ascii wide
                        $string438 = "Inject-NetRipper" nocase ascii wide
                        $string439 = "Inject-RemoteShellcode " nocase ascii wide
                        $string440 = "Inject-RemoteShellcode" nocase ascii wide
                        $string441 = "install  powershell-empire" nocase ascii wide
                        $string442 = "Install-ServiceBinary" nocase ascii wide
                        $string443 = /Install\-SSP\s\-Path.{0,100}\.dll/ nocase ascii wide
                        $string444 = /Install\-SSP\.ps1/ nocase ascii wide
                        $string445 = "-Inveigh " nocase ascii wide
                        $string446 = "Inveigh Relay" nocase ascii wide
                        $string447 = "inveigh_version" nocase ascii wide
                        $string448 = "-InveighRelay " nocase ascii wide
                        $string449 = "invoke obfuscation" nocase ascii wide
                        $string450 = "Invoke-ARPScan" nocase ascii wide
                        $string451 = /Invoke\-ARPScan\.ps1/ nocase ascii wide
                        $string452 = /Invoke\-Assembly\.ps1/ nocase ascii wide
                        $string453 = "Invoke-BackdoorLNK" nocase ascii wide
                        $string454 = /Invoke\-BackdoorLNK\.ps1/ nocase ascii wide
                        $string455 = "Invoke-BloodHound" nocase ascii wide
                        $string456 = /Invoke\-Boolang\.ps1/ nocase ascii wide
                        $string457 = /Invoke\-BSOD\.ps1/ nocase ascii wide
                        $string458 = "Invoke-BypassUAC -Command " nocase ascii wide
                        $string459 = "Invoke-BypassUAC" nocase ascii wide
                        $string460 = /Invoke\-BypassUAC\.ps1/ nocase ascii wide
                        $string461 = "Invoke-BypassUACTokenManipulation" nocase ascii wide
                        $string462 = "Invoke-CallbackIEX" nocase ascii wide
                        $string463 = "Invoke-ClearScript" nocase ascii wide
                        $string464 = /Invoke\-ClearScript\.ps1/ nocase ascii wide
                        $string465 = "Invoke-ClipboardMonitor" nocase ascii wide
                        $string466 = "Invoke-CopyFile" nocase ascii wide
                        $string467 = "Invoke-CredentialInjection" nocase ascii wide
                        $string468 = "Invoke-CredentialInjection" nocase ascii wide
                        $string469 = "Invoke-CredentialPhisher" nocase ascii wide
                        $string470 = "Invoke-CredentialPhisher" nocase ascii wide
                        $string471 = /Invoke\-CredentialPhisher\.ps1/ nocase ascii wide
                        $string472 = /Invoke\-DCOM\.ps1/ nocase ascii wide
                        $string473 = "Invoke-DCSync " nocase ascii wide
                        $string474 = "Invoke-DCSync" nocase ascii wide
                        $string475 = "Invoke-DeadUserBackdoor" nocase ascii wide
                        $string476 = "Invoke-DisableMachineAcctChange" nocase ascii wide
                        $string477 = "Invoke-DllEncode" nocase ascii wide
                        $string478 = "Invoke-DllHijackingCheck" nocase ascii wide
                        $string479 = "Invoke-DllInjection" nocase ascii wide
                        $string480 = /Invoke\-DllInjection\.ps1/ nocase ascii wide
                        $string481 = "Invoke-DomainPasswordSpray" nocase ascii wide
                        $string482 = "Invoke-DownloadFile " nocase ascii wide
                        $string483 = /Invoke\-DownloadFile\.ps1/ nocase ascii wide
                        $string484 = "Invoke-DropboxUpload" nocase ascii wide
                        $string485 = "Invoke-EgressCheck" nocase ascii wide
                        $string486 = /Invoke\-EgressCheck\.ps1/ nocase ascii wide
                        $string487 = "Invoke-Empire -Servers" nocase ascii wide
                        $string488 = "Invoke-Empire" nocase ascii wide
                        $string489 = "Invoke-EnumerateLocalAdmin" nocase ascii wide
                        $string490 = "Invoke-EnvBypass -Command " nocase ascii wide
                        $string491 = "Invoke-EnvBypass" nocase ascii wide
                        $string492 = /Invoke\-EnvBypass\.ps1/ nocase ascii wide
                        $string493 = "Invoke-EternalBlue" nocase ascii wide
                        $string494 = "Invoke-EternalBlue" nocase ascii wide
                        $string495 = "Invoke-EventVwrBypass" nocase ascii wide
                        $string496 = /Invoke\-EventVwrBypass\.ps1/ nocase ascii wide
                        $string497 = "Invoke-ExecuteMSBuild" nocase ascii wide
                        $string498 = /Invoke\-ExecuteMSBuild\.ps1/ nocase ascii wide
                        $string499 = "Invoke-ExfilDataToGitHub" nocase ascii wide
                        $string500 = "Invoke-FindDLLHijack" nocase ascii wide
                        $string501 = "Invoke-FindPathHijack" nocase ascii wide
                        $string502 = "Invoke-FodHelperBypass" nocase ascii wide
                        $string503 = "Invoke-FodHelperBypass" nocase ascii wide
                        $string504 = /Invoke\-FodHelperBypass\.ps1/ nocase ascii wide
                        $string505 = "Invoke-HostRecon" nocase ascii wide
                        $string506 = "Invoke-ImpersonateUser" nocase ascii wide
                        $string507 = "Invoke-Inveigh" nocase ascii wide
                        $string508 = /Invoke\-Inveigh\.ps1/ nocase ascii wide
                        $string509 = /Invoke\-InveighRelay\.ps1/ nocase ascii wide
                        $string510 = "Invoke-IronPython" nocase ascii wide
                        $string511 = /Invoke\-IronPython\.ps1/ nocase ascii wide
                        $string512 = "Invoke-IronPython3" nocase ascii wide
                        $string513 = /Invoke\-IronPython3\.ps1/ nocase ascii wide
                        $string514 = "Invoke-KeeThief" nocase ascii wide
                        $string515 = "Invoke-Kerberoast" nocase ascii wide
                        $string516 = "Invoke-LockWorkStation" nocase ascii wide
                        $string517 = "Invoke-MailSearch" nocase ascii wide
                        $string518 = "Invoke-MetasploitPayload" nocase ascii wide
                        $string519 = /Invoke\-MetasploitPayload\.ps1/ nocase ascii wide
                        $string520 = "Invoke-Mimikatz -Command " nocase ascii wide
                        $string521 = "Invoke-MS16032" nocase ascii wide
                        $string522 = /Invoke\-MS16032\.ps1/ nocase ascii wide
                        $string523 = /Invoke\-MS16\-032\.ps1/ nocase ascii wide
                        $string524 = "Invoke-MS16135" nocase ascii wide
                        $string525 = "Invoke-NetRipper" nocase ascii wide
                        $string526 = /Invoke\-NetRipper\.ps1/ nocase ascii wide
                        $string527 = "Invoke-NinjaCopy" nocase ascii wide
                        $string528 = /Invoke\-NinjaCopy\.ps1/ nocase ascii wide
                        $string529 = "Invoke-NTLMExtract" nocase ascii wide
                        $string530 = "Invoke-NTLMExtract" nocase ascii wide
                        $string531 = /Invoke\-NTLMExtract\.ps1/ nocase ascii wide
                        $string532 = /Invoke\-Ntsd\.ps1/ nocase ascii wide
                        $string533 = "Invoke-PacketCapture" nocase ascii wide
                        $string534 = "Invoke-PacketKnock" nocase ascii wide
                        $string535 = "Invoke-Paranoia" nocase ascii wide
                        $string536 = /Invoke\-Paranoia\.ps1/ nocase ascii wide
                        $string537 = "Invoke-PatchDll" nocase ascii wide
                        $string538 = "Invoke-PatchDll" nocase ascii wide
                        $string539 = "Invoke-PhishingLNK" nocase ascii wide
                        $string540 = "Invoke-PhishingLNK" nocase ascii wide
                        $string541 = /Invoke\-PhishingLNK\.ps1/ nocase ascii wide
                        $string542 = "Invoke-PortBind" nocase ascii wide
                        $string543 = "Invoke-PortFwd " nocase ascii wide
                        $string544 = /Invoke\-PortFwd\.ps1/ nocase ascii wide
                        $string545 = "Invoke-Portscan" nocase ascii wide
                        $string546 = /Invoke\-Portscan\.ps1/ nocase ascii wide
                        $string547 = "Invoke-PostExfil" nocase ascii wide
                        $string548 = "Invoke-PowerDump" nocase ascii wide
                        $string549 = /Invoke\-PowerDump\.ps1/ nocase ascii wide
                        $string550 = /Invoke\-PrintDemon\.ps1/ nocase ascii wide
                        $string551 = /Invoke\-Printnightmare\.ps1/ nocase ascii wide
                        $string552 = "Invoke-ProcessKiller" nocase ascii wide
                        $string553 = "Invoke-PsExec" nocase ascii wide
                        $string554 = /Invoke\-PsExec\.ps1/ nocase ascii wide
                        $string555 = "Invoke-PsExecCmd" nocase ascii wide
                        $string556 = "Invoke-PSInject" nocase ascii wide
                        $string557 = /Invoke\-PSInject\.ps1/ nocase ascii wide
                        $string558 = "Invoke-PSRemoting" nocase ascii wide
                        $string559 = "Invoke-ReflectivePEInjection" nocase ascii wide
                        $string560 = "Invoke-ReverseDNSLookup" nocase ascii wide
                        $string561 = /Invoke\-ReverseDNSLookup\.ps1/ nocase ascii wide
                        $string562 = "Invoke-RickASCII" nocase ascii wide
                        $string563 = /Invoke\-RIDHijacking\.ps1/ nocase ascii wide
                        $string564 = /Invoke\-SauronEye\.ps1/ nocase ascii wide
                        $string565 = "Invoke-SccmCacheFolderVulnCheck" nocase ascii wide
                        $string566 = "Invoke-Schtasks" nocase ascii wide
                        $string567 = "Invoke-SDCLTBypass" nocase ascii wide
                        $string568 = /Invoke\-SDCLTBypass\.ps1/ nocase ascii wide
                        $string569 = "Invoke-SearchGAL" nocase ascii wide
                        $string570 = "Invoke-ServiceAbuse" nocase ascii wide
                        $string571 = "Invoke-ServiceCMD" nocase ascii wide
                        $string572 = "Invoke-ServiceDisable" nocase ascii wide
                        $string573 = "Invoke-ServiceStart" nocase ascii wide
                        $string574 = "Invoke-ServiceStop" nocase ascii wide
                        $string575 = "Invoke-ServiceUserAdd" nocase ascii wide
                        $string576 = "Invoke-SessionGopher" nocase ascii wide
                        $string577 = /Invoke\-SessionGopher\.ps1/ nocase ascii wide
                        $string578 = "Invoke-SharpChiselClient" nocase ascii wide
                        $string579 = /Invoke\-SharpChiselClient\.ps1/ nocase ascii wide
                        $string580 = /Invoke\-SharpLoginPrompt\.ps1/ nocase ascii wide
                        $string581 = "Invoke-SharpSecDump " nocase ascii wide
                        $string582 = /Invoke\-SharpSecDump\.ps1/ nocase ascii wide
                        $string583 = /Invoke\-Shellcode\.ps1/ nocase ascii wide
                        $string584 = "Invoke-ShellcodeMSIL" nocase ascii wide
                        $string585 = /Invoke\-ShellcodeMSIL\.ps1/ nocase ascii wide
                        $string586 = "Invoke-ShellCommand" nocase ascii wide
                        $string587 = "Invoke-SMBAutoBrute" nocase ascii wide
                        $string588 = "Invoke-SMBAutoBrute" nocase ascii wide
                        $string589 = /Invoke\-SMBAutoBrute\.ps1/ nocase ascii wide
                        $string590 = /Invoke\-SMBExec\.ps1/ nocase ascii wide
                        $string591 = /Invoke\-SMBLogin\.ps1/ nocase ascii wide
                        $string592 = "Invoke-SMBScanner" nocase ascii wide
                        $string593 = "Invoke-SmbScanner" nocase ascii wide
                        $string594 = /Invoke\-SmbScanner\.ps1/ nocase ascii wide
                        $string595 = "Invoke-SocksProxy" nocase ascii wide
                        $string596 = "Invoke-SpawnAs" nocase ascii wide
                        $string597 = /Invoke\-SpoolSample\.ps1/ nocase ascii wide
                        $string598 = "Invoke-SQLOSCMD" nocase ascii wide
                        $string599 = /Invoke\-SQLOSCmd\.ps1/ nocase ascii wide
                        $string600 = "Invoke-Ssharp " nocase ascii wide
                        $string601 = /Invoke\-SSharp\.ps1/ nocase ascii wide
                        $string602 = /Invoke\-SSHCommand\.ps1/ nocase ascii wide
                        $string603 = "Invoke-SweetPotato" nocase ascii wide
                        $string604 = /Invoke\-SweetPotato\.ps1/ nocase ascii wide
                        $string605 = "Invoke-Tater " nocase ascii wide
                        $string606 = /Invoke\-Tater\./ nocase ascii wide
                        $string607 = /Invoke\-Tater\.ps1/ nocase ascii wide
                        $string608 = /Invoke\-Tater\.ps1/ nocase ascii wide
                        $string609 = "Invoke-ThreadedFunction" nocase ascii wide
                        $string610 = "Invoke-Thunderstruck" nocase ascii wide
                        $string611 = "Invoke-TokenManipulation" nocase ascii wide
                        $string612 = /Invoke\-TokenManipulation\.ps1/ nocase ascii wide
                        $string613 = "Invoke-UserHunter" nocase ascii wide
                        $string614 = "Invoke-UserImpersonation" nocase ascii wide
                        $string615 = "Invoke-VeeamGetCreds" nocase ascii wide
                        $string616 = "Invoke-Vnc" nocase ascii wide
                        $string617 = /Invoke\-Vnc\.ps1/ nocase ascii wide
                        $string618 = /Invoke\-VoiceTroll\.ps1/ nocase ascii wide
                        $string619 = "Invoke-Watson" nocase ascii wide
                        $string620 = /Invoke\-Watson\.ps1/ nocase ascii wide
                        $string621 = "Invoke-WdigestDowngrade" nocase ascii wide
                        $string622 = /Invoke\-WindowsEnum\.ps1/ nocase ascii wide
                        $string623 = "Invoke-WinEnum" nocase ascii wide
                        $string624 = /Invoke\-WinEnum\.ps1/ nocase ascii wide
                        $string625 = /Invoke\-winPEAS\.ps1/ nocase ascii wide
                        $string626 = /Invoke\-WireTap\.ps1/ nocase ascii wide
                        $string627 = "Invoke-WLMDR" nocase ascii wide
                        $string628 = "Invoke-WMIDebugger" nocase ascii wide
                        $string629 = "Invoke-WScriptBypassUAC" nocase ascii wide
                        $string630 = /Invoke\-WScriptBypassUAC\.ps1/ nocase ascii wide
                        $string631 = "Invoke-WscriptElevate" nocase ascii wide
                        $string632 = "Invoke-WsusConfigCheck" nocase ascii wide
                        $string633 = /Invoke\-ZeroLogon\.ps1/ nocase ascii wide
                        $string634 = /KeePassConfig\.ps1/ nocase ascii wide
                        $string635 = "-KeePassConfigTrigger" nocase ascii wide
                        $string636 = /KeeThief\./ nocase ascii wide
                        $string637 = /KeeThief\.ps1/ nocase ascii wide
                        $string638 = "keyword_obfuscation" nocase ascii wide
                        $string639 = "Kicking off download cradle in a new process" nocase ascii wide
                        $string640 = "Killed running eventvwr" nocase ascii wide
                        $string641 = "Killed running sdclt" nocase ascii wide
                        $string642 = "l33th4x0r=cm91dGluZyBwYWNrZXQ=" nocase ascii wide
                        $string643 = "Launch Empire CLI" nocase ascii wide
                        $string644 = "Launch Empire Server" nocase ascii wide
                        $string645 = "ListMetasploitPayloads" nocase ascii wide
                        $string646 = "LLMNRSpoofer" nocase ascii wide
                        $string647 = "LLMNRSpoofer" nocase ascii wide
                        $string648 = "local:Get-DecryptedCpassword" nocase ascii wide
                        $string649 = "Local:Get-DecryptedSitelistPassword" nocase ascii wide
                        $string650 = "Local:Get-DelegateType" nocase ascii wide
                        $string651 = "Local:Get-KeePassXMLFields" nocase ascii wide
                        $string652 = "Local:Get-PEArchitecture" nocase ascii wide
                        $string653 = "Local:Get-ProcAddress" nocase ascii wide
                        $string654 = "Local:Invoke-PatchDll" nocase ascii wide
                        $string655 = "Local:Invoke-WscriptElevate" nocase ascii wide
                        $string656 = "Local:Invoke-WscriptTrigger" nocase ascii wide
                        $string657 = "Local:Remove-ADS" nocase ascii wide
                        $string658 = "Local:Write-HijackDll" nocase ascii wide
                        $string659 = "lsadump::dcsync" nocase ascii wide
                        $string660 = "make_kernel_shellcode" nocase ascii wide
                        $string661 = "make_kernel_user_payload" nocase ascii wide
                        $string662 = "make_smb1_anonymous_login_packet" nocase ascii wide
                        $string663 = "make_smb1_echo_packet" nocase ascii wide
                        $string664 = "make_smb1_free_hole_session_packet" nocase ascii wide
                        $string665 = "make_smb1_nt_trans_packet" nocase ascii wide
                        $string666 = "make_smb1_trans2_explo" nocase ascii wide
                        $string667 = "make_smb2_payload_body_packet" nocase ascii wide
                        $string668 = "make_smb2_payload_headers_packet" nocase ascii wide
                        $string669 = /MalleableProfiles\.vue/ nocase ascii wide
                        $string670 = "mDNSSpoofer" nocase ascii wide
                        $string671 = /MetasploitPayload\.ps1/ nocase ascii wide
                        $string672 = /MiniEmpireDLL\.dll/ nocase ascii wide
                        $string673 = "NBNSBruteForceHost" nocase ascii wide
                        $string674 = "NBNSBruteForcePause" nocase ascii wide
                        $string675 = "NBNSBruteForceSpoofer" nocase ascii wide
                        $string676 = "NBNSBruteForceSpoofer" nocase ascii wide
                        $string677 = "NBNSBruteForceTarget" nocase ascii wide
                        $string678 = "NBNSSpoofer" nocase ascii wide
                        $string679 = "net user Tater " nocase ascii wide
                        $string680 = "New-ElevatedPersistenceOption" nocase ascii wide
                        $string681 = "New-HoneyHash" nocase ascii wide
                        $string682 = /New\-HoneyHash\.ps1/ nocase ascii wide
                        $string683 = "New-InMemoryModule -ModuleName Win32" nocase ascii wide
                        $string684 = "New-InMemoryModule" nocase ascii wide
                        $string685 = "New-RoutingPacket" nocase ascii wide
                        $string686 = "New-UserPersistenceOption" nocase ascii wide
                        $string687 = "NTLMChallengeBase64" nocase ascii wide
                        $string688 = /NTLMExtract\.ps1/ nocase ascii wide
                        $string689 = "obfuscate_command" nocase ascii wide
                        $string690 = "obfuscated_module_source/" nocase ascii wide
                        $string691 = "Out-Minidump " nocase ascii wide
                        $string692 = /Out\-Minidump\.ps1/ nocase ascii wide
                        $string693 = /Persistence\.psm1/ nocase ascii wide
                        $string694 = "persistence/userland/backdoor_lnk" nocase ascii wide
                        $string695 = /port_forward_pivot\.py/ nocase ascii wide
                        $string696 = /PowerBreach\.ps1/ nocase ascii wide
                        $string697 = "powershell_code_execution_invoke_assembly" nocase ascii wide
                        $string698 = "powershell_collection_keylogger" nocase ascii wide
                        $string699 = "powershell_collection_screenshot" nocase ascii wide
                        $string700 = "powershell_credentials_tokens" nocase ascii wide
                        $string701 = "powershell_management_psinject" nocase ascii wide
                        $string702 = "powershell_management_spawn" nocase ascii wide
                        $string703 = "powershell_privesc_bypassuac_eventvwr" nocase ascii wide
                        $string704 = "powershell_privesc_sherlock" nocase ascii wide
                        $string705 = "PowerShellEmpire" nocase ascii wide
                        $string706 = /PowerUp\.ps1/ nocase ascii wide
                        $string707 = /PowerUpSQL\.ps1/ nocase ascii wide
                        $string708 = /powerview\.ps1/ nocase ascii wide
                        $string709 = "ProcessFileZillaFile" nocase ascii wide
                        $string710 = /\-ProcessID\s.{0,100}\s\-Dll\s.{0,100}\s\-Module\s/ nocase ascii wide
                        $string711 = "ProcessPPKFile" nocase ascii wide
                        $string712 = "ProcessPuTTYLocal" nocase ascii wide
                        $string713 = "ProcessRDPFile" nocase ascii wide
                        $string714 = "ProcessRDPLocal" nocase ascii wide
                        $string715 = "ProcessSuperPuTTYFile" nocase ascii wide
                        $string716 = "Process-TaskingPackets" nocase ascii wide
                        $string717 = "ProcessThoroughLocal" nocase ascii wide
                        $string718 = "ProcessThoroughRemote" nocase ascii wide
                        $string719 = "ProcessWinSCPLocal" nocase ascii wide
                        $string720 = "ps-empire client" nocase ascii wide
                        $string721 = "ps-empire server" nocase ascii wide
                        $string722 = "ps-empire" nocase ascii wide
                        $string723 = "-PsExecCmd" nocase ascii wide
                        $string724 = "-PWDumpFormat" nocase ascii wide
                        $string725 = /python_modules\/keyboard\.zip/ nocase ascii wide
                        $string726 = "Receive-AgentJob" nocase ascii wide
                        $string727 = /ReflectivePick_x64_orig\.dll/ nocase ascii wide
                        $string728 = /ReflectivePick_x86_orig\.dll/ nocase ascii wide
                        $string729 = /ReleaseKeePass\.exe/ nocase ascii wide
                        $string730 = "Restore-ServiceEXE -ServiceName " nocase ascii wide
                        $string731 = /\-Rhost\s.{0,100}\s\-Port\s.{0,100}\s\-Cmd\s.{0,100}cmd\s\/c/ nocase ascii wide
                        $string732 = "Running final exploit packet" nocase ascii wide
                        $string733 = "Send the payload with the grooms" nocase ascii wide
                        $string734 = "server/modules/csharp/" nocase ascii wide
                        $string735 = "set CertPath data/" nocase ascii wide
                        $string736 = "set CollectionMethodAll" nocase ascii wide
                        $string737 = "Set Listener dbx" nocase ascii wide
                        $string738 = "set Listener onedrive" nocase ascii wide
                        $string739 = /set\sProfile\sapt1\.profile/ nocase ascii wide
                        $string740 = "Set-DesktopACLToAllow" nocase ascii wide
                        $string741 = "Set-DesktopACLToAllowEveryone" nocase ascii wide
                        $string742 = "Set-Killdate" nocase ascii wide
                        $string743 = /Set\-MacAttribute\.ps1/ nocase ascii wide
                        $string744 = "Set-MasterBootRecord " nocase ascii wide
                        $string745 = "Set-ServiceBinPath" nocase ascii wide
                        $string746 = "Set-WorkingHours" nocase ascii wide
                        $string747 = "SharpTemplateResources/cmd/" nocase ascii wide
                        $string748 = "smb_eternalblue" nocase ascii wide
                        $string749 = "smb1_anonymous_connect_ipc" nocase ascii wide
                        $string750 = "smb1_anonymous_login" nocase ascii wide
                        $string751 = "-SMBExec" nocase ascii wide
                        $string752 = "SMBNTLMChallenge" nocase ascii wide
                        $string753 = "SMBNTLMResponse" nocase ascii wide
                        $string754 = "SMBRelayChallenge" nocase ascii wide
                        $string755 = "SMBRelayResponse" nocase ascii wide
                        $string756 = "SnifferSpoofer" nocase ascii wide
                        $string757 = "SpooferHostsIgnore" nocase ascii wide
                        $string758 = "SpooferHostsReply" nocase ascii wide
                        $string759 = "SpooferIP" nocase ascii wide
                        $string760 = "SpooferIPsIgnore" nocase ascii wide
                        $string761 = "SpooferIPsReply" nocase ascii wide
                        $string762 = "SpooferLearningDelay" nocase ascii wide
                        $string763 = "SpooferLearningInterval" nocase ascii wide
                        $string764 = "SpooferRepeat" nocase ascii wide
                        $string765 = "Stage-gSharedInfoBitmap" nocase ascii wide
                        $string766 = /stagers\/.{0,100}\/aes\.py/ nocase ascii wide
                        $string767 = /stagers\/.{0,100}\/diffiehellman\.py/ nocase ascii wide
                        $string768 = /stagers\/.{0,100}\/get_sysinfo\.py/ nocase ascii wide
                        $string769 = /stagers\/.{0,100}\/rc4\.py/ nocase ascii wide
                        $string770 = /StarkillerSnackbar\.vue/ nocase ascii wide
                        $string771 = /Start\-MonitorTCPConnections\.ps1/ nocase ascii wide
                        $string772 = "Start-ProcessAsUser" nocase ascii wide
                        $string773 = /Start\-ProcessAsUser\.ps1/ nocase ascii wide
                        $string774 = "Start-TCPMonitor" nocase ascii wide
                        $string775 = /Start\-WebcamRecorder\.ps1/ nocase ascii wide
                        $string776 = "StopInveigh" nocase ascii wide
                        $string777 = "sync-starkiller" nocase ascii wide
                        $string778 = "Test-ServiceDaclPermission" nocase ascii wide
                        $string779 = "tree_connect_andx_request" nocase ascii wide
                        $string780 = "Update-ExeFunctions" nocase ascii wide
                        $string781 = "uselistener dbx" nocase ascii wide
                        $string782 = "uselistener onedrive" nocase ascii wide
                        $string783 = "usemodule persistence/" nocase ascii wide
                        $string784 = "usemodule powershell/persistence" nocase ascii wide
                        $string785 = "usemodule privesc/" nocase ascii wide
                        $string786 = "useplugin csharpserver" nocase ascii wide
                        $string787 = "user Inveigh" nocase ascii wide
                        $string788 = /usestager\s.{0,100}backdoor/ nocase ascii wide
                        $string789 = /usestager\s.{0,100}ducky/ nocase ascii wide
                        $string790 = /usestager\s.{0,100}launcher_bat/ nocase ascii wide
                        $string791 = /usestager\s.{0,100}launcher_lnk/ nocase ascii wide
                        $string792 = /usestager\s.{0,100}shellcode/ nocase ascii wide
                        $string793 = "usestager multi/launcher" nocase ascii wide
                        $string794 = "WindowsEnum -" nocase ascii wide
                        $string795 = "Write-CMDServiceBinary" nocase ascii wide
                        $string796 = "Write-HijackDll" nocase ascii wide
                        $string797 = "Write-HijackDll" nocase ascii wide
                        $string798 = "Write-HijackDll" nocase ascii wide
                        $string799 = "Write-PrivescCheckAsciiReport" nocase ascii wide
                        $string800 = "Write-ServiceEXE " nocase ascii wide
                        $string801 = "Write-ServiceEXECMD" nocase ascii wide
                        $string802 = "Write-UserAddServiceBinary" nocase ascii wide
                        $string803 = "WScriptBypassUAC" nocase ascii wide
                        $string804 = "ZABvAHcAcwBCAHUAaQBsAHQASQBuAFIAbwBsAGUAXQAnAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAJwApACkAIAAtACAAJAAoAEcAZQB0AC0ARABhAHQAZQApACIAIAB8ACAATwB1AHQALQBGAGkAbABlACAAQwA6AFwAVQBBAEMAQgB5AHAAYQBzAHMAVABlAHMAdAAuAHQAeAB0ACAALQBBAHAAcABlAG4AZAA" nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

374b937c-c4f6-4075-8045-115eb5a0ce31
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
