net

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'net' taken from the ThreatHunting-Keywords github project
rule net
{
    meta:
        description = "Detection patterns for the tool 'net' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "net"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1 = " localgroup Administrators localadm /ADD " nocase ascii wide
                        $string2 = /\\net\.exe\\"\saccounts/ nocase ascii wide
                        $string3 = /\\net\.exe.{0,100}\slocalgroup\sadmin/ nocase ascii wide
                        $string4 = /\\net\.exe.{0,100}\ssessions/ nocase ascii wide
                        $string5 = /\\net\.exe.{0,100}\sview\s.{0,100}\/domain/ nocase ascii wide
                        $string6 = /\\net1\ssessions/ nocase ascii wide
                        $string7 = "net  group \"domain admins\" /domain" nocase ascii wide
                        $string8 = "net  group \"Domain Computers\" /domain" nocase ascii wide
                        $string9 = "net  group \"domain computers\" /domain" nocase ascii wide
                        $string10 = "net  group \"enterprise admins\" /domain" nocase ascii wide
                        $string11 = "net  group \"ESX Admins\" /domain /add" nocase ascii wide
                        $string12 = "net  group \"ESX Admins\"" nocase ascii wide
                        $string13 = "net  user admin P@ssw0rd!" nocase ascii wide
                        $string14 = /net\s\.exe.{0,100}\sgroup\s\\"ESX\sAdmins\\"/ nocase ascii wide
                        $string15 = "net accounts /maxpwage:unlimited" nocase ascii wide
                        $string16 = /net\sgroup\s\\"Admins\.\sdel\sdominio\\"\s\/domain/ nocase ascii wide
                        $string17 = /net\sgroup\s\\"Dom.{0,100}nen\-Admins\\"\s\/domain/ nocase ascii wide
                        $string18 = "net group \"Domain Administrateurs\" /domain" nocase ascii wide
                        $string19 = "net group \"Domain Admins\" /domain" nocase ascii wide
                        $string20 = "net group \"Domain Admins\" /domain" nocase ascii wide
                        $string21 = "net group \"Domain Admins\" support /add" nocase ascii wide
                        $string22 = "net group \"domain computers\" /domain" nocase ascii wide
                        $string23 = "net group \"Enterprise admins\" /domain" nocase ascii wide
                        $string24 = "net group \"SQL Admins\" /domain" nocase ascii wide
                        $string25 = /net\sgroup\s.{0,100}Account\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string26 = /net\sgroup\s.{0,100}Backup\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string27 = /net\sgroup\s.{0,100}Domain\sComputers.{0,100}\s\/domain/ nocase ascii wide
                        $string28 = /net\sgroup\s.{0,100}Domain\sControllers.{0,100}\s\/domain/ nocase ascii wide
                        $string29 = /net\sgroup\s.{0,100}Domain\sControllers.{0,100}\/domain/ nocase ascii wide
                        $string30 = /net\sgroup\s.{0,100}Enterprise\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string31 = /net\sgroup\s.{0,100}Exchange\sTrusted\sSubsystem.{0,100}\s\/domain/ nocase ascii wide
                        $string32 = /net\sgroup\s.{0,100}Microsoft\sExchange\sServers.{0,100}\s\/domain/ nocase ascii wide
                        $string33 = /net\sgroup\s.{0,100}Print\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string34 = /net\sgroup\s.{0,100}Schema\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string35 = /net\sgroup\s.{0,100}Server\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string36 = /net\sgroup\s\/domain\s.{0,100}Domain\sAdmins/ nocase ascii wide
                        $string37 = "net group administrators /domain" nocase ascii wide
                        $string38 = /net\sgroup\sAdmins\.\sdel\sdominio\s\/domain/ nocase ascii wide
                        $string39 = "net localgroup \"Cert Publishers\" /domain" nocase ascii wide
                        $string40 = /net\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,100}\s\/add/ nocase ascii wide
                        $string41 = /net\slocalgroup\s.{0,100}Backup\sOperators/ nocase ascii wide
                        $string42 = /net\slocalgroup\s\\\\"Remote\sDesktop\sUsers\\\\"\sSupport\s\/add/ nocase ascii wide
                        $string43 = "net localgroup admin" nocase ascii wide
                        $string44 = "net localgroup Administrators support /add" nocase ascii wide
                        $string45 = "net localgroup Administrators Support /add" nocase ascii wide
                        $string46 = /net\sshare\sc\=c\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string47 = /net\sshare\sd\=d\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string48 = /net\sshare\se\=e\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string49 = /net\sshare\se\=e\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string50 = /net\sshare\sf\=f\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string51 = /net\sshare\sg\=g\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string52 = /net\sshare\sh\=h\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string53 = /net\sshare\si\=i\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string54 = /net\sshare\sj\=j\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string55 = /net\sshare\sk\=k\:\\\s\/GRANT\:Everyone\,FULL/ nocase ascii wide
                        $string56 = /net\sstop\s\\"\.NET\sRuntime\sOptimization\sService\\"/ nocase ascii wide
                        $string57 = /net\sstop\s\\"IBM\sDomino\sDiagnostics\s\(CProgramFilesIBMDomino\)\\"/ nocase ascii wide
                        $string58 = /net\sstop\s\\"IBM\sDomino\sServer\s\(CProgramFilesIBMDominodata\)\\"/ nocase ascii wide
                        $string59 = "net stop \"SAVAdminService\"" nocase ascii wide
                        $string60 = "net stop \"SAVService\"" nocase ascii wide
                        $string61 = "net stop \"SAVService\"" nocase ascii wide
                        $string62 = "net stop \"Simply Accounting Database Connection Manager\"" nocase ascii wide
                        $string63 = "net stop \"SntpService\"" nocase ascii wide
                        $string64 = "net stop \"Sophos " nocase ascii wide
                        $string65 = "net stop \"Sophos Agent\"" nocase ascii wide
                        $string66 = "net stop \"Sophos Anti-Virus\"" nocase ascii wide
                        $string67 = "net stop \"Sophos AutoUpdate Service\"" nocase ascii wide
                        $string68 = "net stop \"Sophos AutoUpdate Service\"" nocase ascii wide
                        $string69 = "net stop \"Sophos Endpoint Defense Service\"" nocase ascii wide
                        $string70 = "net stop \"Sophos Message Router\"" nocase ascii wide
                        $string71 = "net stop \"Sophos System Protection Service\"" nocase ascii wide
                        $string72 = "net stop \"Sophos Web Control Service\"" nocase ascii wide
                        $string73 = "net stop \"Sophos Web Control Service\"" nocase ascii wide
                        $string74 = "net stop \"SQL Backups\"" nocase ascii wide
                        $string75 = "net stop \"SQLsafe Backup Service\"" nocase ascii wide
                        $string76 = /net\sstop\s\\"storagecraft\simagemanager.{0,100}\\"/ nocase ascii wide
                        $string77 = "net stop \"swi_service\"" nocase ascii wide
                        $string78 = "net stop \"swi_update\"" nocase ascii wide
                        $string79 = "net stop \"Symantec System Recovery\"" nocase ascii wide
                        $string80 = "net stop \"Veeam Backup Catalog Data Service\"" nocase ascii wide
                        $string81 = "net stop \"Zoolz 2 Service\"" nocase ascii wide
                        $string82 = "net stop acronisagent" nocase ascii wide
                        $string83 = "net stop AcronisAgent" nocase ascii wide
                        $string84 = "net stop acrsch2svc" nocase ascii wide
                        $string85 = "net stop AcrSch2Svc" nocase ascii wide
                        $string86 = "net stop agntsvc" nocase ascii wide
                        $string87 = "net stop Antivirus" nocase ascii wide
                        $string88 = "net stop ARSM /y" nocase ascii wide
                        $string89 = "net stop arsm" nocase ascii wide
                        $string90 = "net stop AVP" nocase ascii wide
                        $string91 = "net stop backp" nocase ascii wide
                        $string92 = "net stop backup" nocase ascii wide
                        $string93 = "net stop BackupExec" nocase ascii wide
                        $string94 = "net stop BackupExecAgent" nocase ascii wide
                        $string95 = "net stop badrv" nocase ascii wide
                        $string96 = "net stop bedbg /y" nocase ascii wide
                        $string97 = "net stop cbservi" nocase ascii wide
                        $string98 = "net stop cbvscserv" nocase ascii wide
                        $string99 = "net stop DCAgent" nocase ascii wide
                        $string100 = "net stop dnscache" nocase ascii wide
                        $string101 = "net stop DPS" nocase ascii wide
                        $string102 = "net stop EhttpSrv" nocase ascii wide
                        $string103 = "net stop ekrn" nocase ascii wide
                        $string104 = "net stop EPSecurityService" nocase ascii wide
                        $string105 = "net stop EPUpdateService" nocase ascii wide
                        $string106 = "net stop EsgShKernel" nocase ascii wide
                        $string107 = "net stop ESHASRV" nocase ascii wide
                        $string108 = "net stop FA_Scheduler" nocase ascii wide
                        $string109 = "net stop firebirdguardiandefaultinstance" nocase ascii wide
                        $string110 = "net stop gupdatem" nocase ascii wide
                        $string111 = "net stop ibmiasrw" nocase ascii wide
                        $string112 = "net stop IISADMIN" nocase ascii wide
                        $string113 = "net stop IISADMIN" nocase ascii wide
                        $string114 = "net stop IMAP4Svc" nocase ascii wide
                        $string115 = "net stop KAVFS" nocase ascii wide
                        $string116 = "net stop KAVFSGT" nocase ascii wide
                        $string117 = "net stop kavfsslp" nocase ascii wide
                        $string118 = "net stop klnagent" nocase ascii wide
                        $string119 = "net stop macmnsvc" nocase ascii wide
                        $string120 = "net stop masvc" nocase ascii wide
                        $string121 = "net stop MBAMService" nocase ascii wide
                        $string122 = "net stop MBEndpointAgent" nocase ascii wide
                        $string123 = "net stop McAfeeEngineService" nocase ascii wide
                        $string124 = "net stop McAfeeFramework" nocase ascii wide
                        $string125 = "net stop McAfeeFrameworkMcAfeeFramework" nocase ascii wide
                        $string126 = "net stop McShield" nocase ascii wide
                        $string127 = "net stop mfefire" nocase ascii wide
                        $string128 = "net stop mfemms" nocase ascii wide
                        $string129 = "net stop mfevtp" nocase ascii wide
                        $string130 = "net stop mozyprobackup" nocase ascii wide
                        $string131 = "net stop mr2kserv" nocase ascii wide
                        $string132 = "net stop MsDtsServer" nocase ascii wide
                        $string133 = "net stop MsDtsServer100" nocase ascii wide
                        $string134 = "net stop MsDtsServer110" nocase ascii wide
                        $string135 = "net stop MSExchangeADTopology" nocase ascii wide
                        $string136 = "net stop MSExchangeFBA" nocase ascii wide
                        $string137 = "net stop MSExchangeIS" nocase ascii wide
                        $string138 = "net stop MSExchangeSA" nocase ascii wide
                        $string139 = "net stop MSExchangeUM" nocase ascii wide
                        $string140 = /net\sstop\smsftesql\$PROD/ nocase ascii wide
                        $string141 = "net stop msiserver" nocase ascii wide
                        $string142 = /net\sstop\sMSOLAP\$SQL_2008/ nocase ascii wide
                        $string143 = /net\sstop\sMSOLAP\$SYSTEM_BGC/ nocase ascii wide
                        $string144 = /net\sstop\sMSOLAP\$TPS/ nocase ascii wide
                        $string145 = /net\sstop\sMSOLAP\$TPSAMA/ nocase ascii wide
                        $string146 = /net\sstop\sMSSQL\$BKUPEXEC/ nocase ascii wide
                        $string147 = /net\sstop\sMSSQL\$CONTOSO1/ nocase ascii wide
                        $string148 = /net\sstop\sMSSQL\$ECWDB2/ nocase ascii wide
                        $string149 = /net\sstop\sMSSQL\$ISARS/ nocase ascii wide
                        $string150 = /net\sstop\sMSSQL\$MSFW/ nocase ascii wide
                        $string151 = /net\sstop\sMSSQL\$PRACTICEMGT/ nocase ascii wide
                        $string152 = /net\sstop\sMSSQL\$PRACTTICEBGC/ nocase ascii wide
                        $string153 = /net\sstop\sMSSQL\$PROD/ nocase ascii wide
                        $string154 = /net\sstop\sMSSQL\$PROFXENGAGEMENT/ nocase ascii wide
                        $string155 = /net\sstop\sMSSQL\$SBSMONITORING/ nocase ascii wide
                        $string156 = /net\sstop\sMSSQL\$SHAREPOINT/ nocase ascii wide
                        $string157 = /net\sstop\sMSSQL\$SOPHOS/ nocase ascii wide
                        $string158 = /net\sstop\sMSSQL\$SQL_2008/ nocase ascii wide
                        $string159 = /net\sstop\sMSSQL\$SQLEXPRESS/ nocase ascii wide
                        $string160 = /net\sstop\sMSSQL\$SYSTEM_BGC/ nocase ascii wide
                        $string161 = /net\sstop\sMSSQL\$TPS/ nocase ascii wide
                        $string162 = /net\sstop\sMSSQL\$TPSAMA/ nocase ascii wide
                        $string163 = /net\sstop\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string164 = /net\sstop\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string165 = "net stop MSSQLServerADHelper100" nocase ascii wide
                        $string166 = "net stop MSSQLServerADHelper100" nocase ascii wide
                        $string167 = "net stop OfficeClickToRun" nocase ascii wide
                        $string168 = "net stop PcaSvc" nocase ascii wide
                        $string169 = "net stop QBCFMonitorService" nocase ascii wide
                        $string170 = "net stop QBPOSDBServiceV12" nocase ascii wide
                        $string171 = "net stop QBVSS" nocase ascii wide
                        $string172 = "net stop QuickBooksDB1" nocase ascii wide
                        $string173 = "net stop QuickBooksDB2" nocase ascii wide
                        $string174 = "net stop QuickBooksDB3" nocase ascii wide
                        $string175 = "net stop QuickBooksDB4" nocase ascii wide
                        $string176 = "net stop QuickBooksDB5" nocase ascii wide
                        $string177 = /net\sstop\sReportServer\$ISARS/ nocase ascii wide
                        $string178 = "net stop sacsvr" nocase ascii wide
                        $string179 = "net stop SAVAdminService" nocase ascii wide
                        $string180 = "net stop SAVService" nocase ascii wide
                        $string181 = "net stop sedsvc" nocase ascii wide
                        $string182 = "net stop shadowprotectsvc" nocase ascii wide
                        $string183 = "net stop ShadowProtectSvc" nocase ascii wide
                        $string184 = "net stop sharedaccess" nocase ascii wide
                        $string185 = "net stop ShMonitor" nocase ascii wide
                        $string186 = "net stop Smcinst" nocase ascii wide
                        $string187 = "net stop SmcService" nocase ascii wide
                        $string188 = "net stop sms_site_sql_backup" nocase ascii wide
                        $string189 = "net stop SntpService" nocase ascii wide
                        $string190 = "net stop sophossps" nocase ascii wide
                        $string191 = "net stop SPAdminV4" nocase ascii wide
                        $string192 = "net stop sppsvc" nocase ascii wide
                        $string193 = "net stop SPSearch4" nocase ascii wide
                        $string194 = "net stop SPTimerV4" nocase ascii wide
                        $string195 = "net stop SPTraceV4" nocase ascii wide
                        $string196 = "net stop SPUserCodeV4" nocase ascii wide
                        $string197 = "net stop SPWriterV4" nocase ascii wide
                        $string198 = "net stop spxservice" nocase ascii wide
                        $string199 = "net stop sqbcoreservice" nocase ascii wide
                        $string200 = /net\sstop\sSQLAgent\$ISARS/ nocase ascii wide
                        $string201 = /net\sstop\sSQLAgent\$MSFW/ nocase ascii wide
                        $string202 = /net\sstop\sSQLAgent\$SOPH/ nocase ascii wide
                        $string203 = /net\sstop\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string204 = /net\sstop\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string205 = "net stop SQLBrowser" nocase ascii wide
                        $string206 = "net stop SQLWriter" nocase ascii wide
                        $string207 = "net stop stc_endpt_svc" nocase ascii wide
                        $string208 = "net stop stop SepMasterService" nocase ascii wide
                        $string209 = "net stop svcGenericHost" nocase ascii wide
                        $string210 = "net stop swi_filter" nocase ascii wide
                        $string211 = "net stop swi_service" nocase ascii wide
                        $string212 = "net stop swi_update" nocase ascii wide
                        $string213 = "net stop swi_update_64" nocase ascii wide
                        $string214 = "net stop SysMain" nocase ascii wide
                        $string215 = "net stop TmCCSF" nocase ascii wide
                        $string216 = "net stop tmlisten" nocase ascii wide
                        $string217 = "net stop TrueKey" nocase ascii wide
                        $string218 = "net stop TrueKeyScheduler" nocase ascii wide
                        $string219 = "net stop TrueKeyServiceHel" nocase ascii wide
                        $string220 = "net stop TrustedInstaller" nocase ascii wide
                        $string221 = "net stop vapiendpoint" nocase ascii wide
                        $string222 = "net stop VeeamBackupSvc" nocase ascii wide
                        $string223 = "net stop VeeamBrokerSvc " nocase ascii wide
                        $string224 = "net stop VeeamCatalogSvc" nocase ascii wide
                        $string225 = "net stop VeeamCloudSvc" nocase ascii wide
                        $string226 = "net stop VeeamDeploymentService" nocase ascii wide
                        $string227 = "net stop VeeamDeploySvc" nocase ascii wide
                        $string228 = "net stop VeeamDeploySvc" nocase ascii wide
                        $string229 = "net stop VeeamEnterpriseManagerSvc" nocase ascii wide
                        $string230 = "net stop VeeamHvIntegrationSvc" nocase ascii wide
                        $string231 = "net stop VeeamMountSvc" nocase ascii wide
                        $string232 = "net stop VeeamNFSSvc" nocase ascii wide
                        $string233 = "net stop VeeamRESTSvc" nocase ascii wide
                        $string234 = "net stop VeeamTransportSvc" nocase ascii wide
                        $string235 = "net stop vsnapvss" nocase ascii wide
                        $string236 = "net stop vssvc" nocase ascii wide
                        $string237 = "net stop wbengine" nocase ascii wide
                        $string238 = "net stop wbengine" nocase ascii wide
                        $string239 = "net stop WinDefend" nocase ascii wide
                        $string240 = "net stop WinDefend" nocase ascii wide
                        $string241 = "net stop WRSVC" nocase ascii wide
                        $string242 = /net\suse\s\\\\.{0,100}\\IPC\$\s\/user\:/ nocase ascii wide
                        $string243 = /net\suser\s.{0,100}\$.{0,100}\s\// nocase ascii wide
                        $string244 = "net user /domain >" nocase ascii wide
                        $string245 = "net user BitdefenderBounty " nocase ascii wide
                        $string246 = "NET USER GUEST /ACTIVE:YES" nocase ascii wide
                        $string247 = "net user localadm " nocase ascii wide
                        $string248 = "net user localadm " nocase ascii wide
                        $string249 = /net\suser\sSupport\s.{0,100}\s\/add\s/ nocase ascii wide
                        $string250 = "net user support /active:yes" nocase ascii wide
                        $string251 = /net\suser\ssupport\sPa\$\$wo0rd\s\/add/ nocase ascii wide
                        $string252 = "net view /all /domain" nocase ascii wide
                        $string253 = "net view /domain" nocase ascii wide
                        $string254 = /net\sview\s\\\\.{0,100}\s\/all/ nocase ascii wide
                        $string255 = /net.{0,100}\sgroup\sAdministrator.{0,100}\s\/add\s\/domain/ nocase ascii wide
                        $string256 = /net\.exe\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,100}\s\/add/ nocase ascii wide
                        $string257 = /net\.exe\slocalgroup\s.{0,100}Backup\sOperators/ nocase ascii wide
                        $string258 = /net\.exe\\"\slocalgroup\s.{0,100}Backup\sOperators/ nocase ascii wide
                        $string259 = /net\.exe.{0,100}\sgroup\s.{0,100}Account\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string260 = /net\.exe.{0,100}\sgroup\s.{0,100}Backup\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string261 = /net\.exe.{0,100}\sgroup\s.{0,100}Domain\sComputers.{0,100}\s\/domain/ nocase ascii wide
                        $string262 = /net\.exe.{0,100}\sgroup\s.{0,100}Domain\sControllers.{0,100}\s\/domain/ nocase ascii wide
                        $string263 = /net\.exe.{0,100}\sgroup\s.{0,100}Enterprise\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string264 = /net\.exe.{0,100}\sgroup\s.{0,100}Exchange\sTrusted\sSubsystem.{0,100}\s\/domain/ nocase ascii wide
                        $string265 = /net\.exe.{0,100}\sgroup\s.{0,100}Microsoft\sExchange\sServers.{0,100}\s\/domain/ nocase ascii wide
                        $string266 = /net\.exe.{0,100}\sgroup\s.{0,100}Print\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string267 = /net\.exe.{0,100}\sgroup\s.{0,100}Schema\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string268 = /net\.exe.{0,100}\sgroup\s.{0,100}Server\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string269 = "net1  group \"domain admins\" /domain" nocase ascii wide
                        $string270 = "net1  group \"Domain Computers\" /domain" nocase ascii wide
                        $string271 = "net1  group \"domain computers\" /domain" nocase ascii wide
                        $string272 = "net1  group \"enterprise admins\" /domain" nocase ascii wide
                        $string273 = "net1 group \"Domain Admins\" /domain" nocase ascii wide
                        $string274 = "net1 group \"SQL Admins\" /domain" nocase ascii wide
                        $string275 = /net1\sgroup\s.{0,100}Account\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string276 = /net1\sgroup\s.{0,100}Backup\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string277 = /net1\sgroup\s.{0,100}Domain\sComputers.{0,100}\s\/domain/ nocase ascii wide
                        $string278 = /net1\sgroup\s.{0,100}Domain\sControllers.{0,100}\s\/domain/ nocase ascii wide
                        $string279 = /net1\sgroup\s.{0,100}Enterprise\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string280 = /net1\sgroup\s.{0,100}Exchange\sTrusted\sSubsystem.{0,100}\s\/domain/ nocase ascii wide
                        $string281 = /net1\sgroup\s.{0,100}Microsoft\sExchange\sServers.{0,100}\s\/domain/ nocase ascii wide
                        $string282 = /net1\sgroup\s.{0,100}Print\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string283 = /net1\sgroup\s.{0,100}Schema\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string284 = /net1\sgroup\s.{0,100}Server\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string285 = /net1\slocalgroup\s\\"Remote\sDesktop\sUsers\\"\s.{0,100}\s\/add/ nocase ascii wide
                        $string286 = /net1\slocalgroup\s.{0,100}Backup\sOperators/ nocase ascii wide
                        $string287 = "net1 localgroup admin" nocase ascii wide
                        $string288 = "net1 stop badrv" nocase ascii wide
                        $string289 = "net1 stop gupdatem" nocase ascii wide
                        $string290 = /net1\.exe.{0,100}\sgroup\s.{0,100}Account\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string291 = /net1\.exe.{0,100}\sgroup\s.{0,100}Backup\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string292 = /net1\.exe.{0,100}\sgroup\s.{0,100}Domain\sComputers.{0,100}\s\/domain/ nocase ascii wide
                        $string293 = /net1\.exe.{0,100}\sgroup\s.{0,100}Domain\sControllers.{0,100}\s\/domain/ nocase ascii wide
                        $string294 = /net1\.exe.{0,100}\sgroup\s.{0,100}Enterprise\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string295 = /net1\.exe.{0,100}\sgroup\s.{0,100}Exchange\sTrusted\sSubsystem.{0,100}\s\/domain/ nocase ascii wide
                        $string296 = /net1\.exe.{0,100}\sgroup\s.{0,100}Microsoft\sExchange\sServers.{0,100}\s\/domain/ nocase ascii wide
                        $string297 = /net1\.exe.{0,100}\sgroup\s.{0,100}Print\sOperators.{0,100}\s\/domain/ nocase ascii wide
                        $string298 = /net1\.exe.{0,100}\sgroup\s.{0,100}Schema\sAdmins.{0,100}\s\/domain/ nocase ascii wide
                        $string299 = /net1\.exe.{0,100}\sgroup\s.{0,100}Server\sOperators.{0,100}\s\/domain/ nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

75d2af78-7688-4f28-9783-58debce46886
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
