[[ fm.text ]] Click here

sha384_hashed_default_creds_cisco

YARA detection rule by Alaa Jubakhanji@ndaal Gesellschaft fürSicherheit in der Informationstechnik mbH & Co KG · GPL-2.0

Hashed values of default credentials for cisco.

rule sha384_hashed_default_creds_cisco
{
    meta:
        version = "1.0"
        status = "RELEASED"
        sharing = "TLP:WHITE"
        source = "NDAAL GESELLSCHAFT FÜR SICHERHEIT INDER INFORMATIONSTECHNIK MBH & CO KG"
        author = "Alaa Jubakhanji@ndaal Gesellschaft fürSicherheit in der Informationstechnik mbH & Co KG"
        description = "Hashed values of default credentials for cisco."
        category = "INFO"
        info = "SHA384"
        reference = "https://gitlab.com/ndaal_open_source/ndaal_yara_passwords_default/-/tree/main/yara_rules"

strings:
    $a0="6fcd6936f1e8335f957b67195263a7241d1ff221c0fe3b2caafa2098cbd98219be32b056ea25e7d9b2d23952a92cac43"
    $a1="6fcd6936f1e8335f957b67195263a7241d1ff221c0fe3b2caafa2098cbd98219be32b056ea25e7d9b2d23952a92cac43"
    $a2="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a3="cb5d13481d7585712e60785bb95b43ce5a00a4c6380ce30785be8b69c0ab257195d89b9606b266ba5774c5e5ef045a10"
    $a4="aad60e1491e35b81089fb2a929c6b8fa5a1138295df2ac65fa3435a2986f20aadb2dd6b5302d62380290f51469462698"
    $a5="aad60e1491e35b81089fb2a929c6b8fa5a1138295df2ac65fa3435a2986f20aadb2dd6b5302d62380290f51469462698"
    $a6="3ace75c2597a98b4cd30615974d948d04c45108044d7340538736366249c454f6320f7c99a4f23649dc498c9eaa47977"
    $a7="3ace75c2597a98b4cd30615974d948d04c45108044d7340538736366249c454f6320f7c99a4f23649dc498c9eaa47977"
    $a8="aad60e1491e35b81089fb2a929c6b8fa5a1138295df2ac65fa3435a2986f20aadb2dd6b5302d62380290f51469462698"
    $a9="7ed8c2c790aa83d6c3e404b5368f6832c18d46a0e98b9c7a7a5e3ef823e2c9f0e310abbf6f7ea9d9d883ccb64ec2736a"
    $a10="7d49d02c105312b2b69de69141b27de1f4f4c202b4afb19d7ff7ab9849e9ce2da165a87eeec971bca66c8eb8a9243f5e"
    $a11="cb5d13481d7585712e60785bb95b43ce5a00a4c6380ce30785be8b69c0ab257195d89b9606b266ba5774c5e5ef045a10"
    $a12="7358e138849b00437bc337b10a7668db240ab0bf1c0edc4cc1a4678bac7a61f5bc0c91afdd3089b79ef7c6f2179593c4"
    $a13="6820c826b008f82f683bfa6143e8517a63ca225102b550f88b6ad378b1999b4e2bac92bf689340697cf3bf353706c360"
    $a14="7d49d02c105312b2b69de69141b27de1f4f4c202b4afb19d7ff7ab9849e9ce2da165a87eeec971bca66c8eb8a9243f5e"
    $a15="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a16="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a17="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a18="46f01a0f7720c67ef4fac7b956be1e5240e03e357dca04f5c09a6df82ec90b3898401010efa938721dabc17b81562c15"
    $a19="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a20="a8b64babd0aca91a59bdbb7761b421d4f2bb38280d3a75ba0f21f2bebc45583d446c598660c94ce680c47d19c30783a7"
    $a21="7ed8c2c790aa83d6c3e404b5368f6832c18d46a0e98b9c7a7a5e3ef823e2c9f0e310abbf6f7ea9d9d883ccb64ec2736a"
    $a22="3ace75c2597a98b4cd30615974d948d04c45108044d7340538736366249c454f6320f7c99a4f23649dc498c9eaa47977"
    $a23="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a24="2873e20562a039aedf3a5294dd35fe919e957e62ed2bca68de73f6ea82e98af954aef0e6906de368919c4221866f4009"
    $a25="2873e20562a039aedf3a5294dd35fe919e957e62ed2bca68de73f6ea82e98af954aef0e6906de368919c4221866f4009"
    $a26="42f7113044c011e770740189f408d58fa50b795bd67a83a5dffe7b31a6463841de17df777ecbd9666ebb69e3a5be7d32"
    $a27="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a28="06a47713836b025a53e61ee8f591af9afd6eb706b1497ebb345278be467c725276054625af336a73c6d516f32e5cdef8"
    $a29="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a30="a8b64babd0aca91a59bdbb7761b421d4f2bb38280d3a75ba0f21f2bebc45583d446c598660c94ce680c47d19c30783a7"
    $a31="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a32="cab49b09ab00df854ede5cbcf1f5c599fd0262890d269981246edec6222f2cb9bd59fa3f11fef6f27a22077fc4b8a079"
    $a33="3a58563889e7939aab1c27949eaaaec03700e49d91c97cf186dbfd17a1d5e9210a2643d9ef7ff591b6f1a804605e8f8d"
    $a34="23c50a63420f7958981f6189acd20184618457f0e673bd0a8ef1e8f7c489949f3c8f9d712e4c193f3af00690c4729925"
    $a35="7ed8c2c790aa83d6c3e404b5368f6832c18d46a0e98b9c7a7a5e3ef823e2c9f0e310abbf6f7ea9d9d883ccb64ec2736a"
    $a36="58a775ba4112be3005ae4407ce757d88fda71d40497bb8026ecac54d4e3ffc7232ce8de3ab5acb30ae39760fee7c53ed"
    $a37="97f72cdaf982b5f8138e06321875ec913429f0260699bccaea842a579e242fea177f0598a8910f8e316f3a537dd651bc"
    $a38="856a24efd702a2ca0d1685bf0f704c0d2370def2cd51fead525025a1019635740d140d2d9ab78a6a8d774ab140d74b70"
    $a39="856a24efd702a2ca0d1685bf0f704c0d2370def2cd51fead525025a1019635740d140d2d9ab78a6a8d774ab140d74b70"
    $a40="23d0c0426482e45f5a63510919dd16463996bd0c9a504daf09c2c29510c613bc7eb42dc21b510bb9fd4fc98ebbbad3ef"
    $a41="394c3b8c63d8441451a85f988c8d076261a258c2ec56f32057ef2f4d2c81246ba5fc83105f6e46aa5c72ad67ffa927ff"
    $a42="23d0c0426482e45f5a63510919dd16463996bd0c9a504daf09c2c29510c613bc7eb42dc21b510bb9fd4fc98ebbbad3ef"
    $a43="7ed8c2c790aa83d6c3e404b5368f6832c18d46a0e98b9c7a7a5e3ef823e2c9f0e310abbf6f7ea9d9d883ccb64ec2736a"
    $a44="7d49d02c105312b2b69de69141b27de1f4f4c202b4afb19d7ff7ab9849e9ce2da165a87eeec971bca66c8eb8a9243f5e"
    $a45="63fc52ff0cf52087b8b5fc53850973d288f6982570d4b469c8dac1e963a93772d928ae1350913b121946085f0a63b853"
    $a46="6ee05d71ccc11b5a8ee3d89641894f24d782206525977c19b175a4b6dcc2e871e1ee093d77d8fcad9420b44a535c20e8"
    $a47="c7018bb0a830d21c76d846d046a747728a51bb60db4767454ccd22a549afd992ae3ac8a3c285524c4f03d69fa9c15d11"
    $a48="07de10e6d781745b055f19fe46b0cfde3a5d8bb06fdfa917aac891ff9b054db42f2442a5a0ffd0b533d73d48dd998266"
    $a49="46cb0934bc1afda5a06031f9849b0281bb5cd03767e318e0a877c5a51962dbaa7d7f0dc146ce1bd85176d856907aa2c9"
    $a50="e6a54efa7eb8b3690d545e8a6c7cfbe22763fec0b829f70857437f4f5f47c1aefc1ac335fdc1dbe3f7401bd97e5a748c"
    $a51="5a3bcd019ae5cbea9506ee6684141e935a3f8e912cb3d304aa623553e9eaafac619a66814e996df8848cdada70c8abc3"
    $a52="284919e1b5d0ae67fff4511f408b94f3246a22921a1b6cfc4f198b1055010aaeee0f6dc01c712a58ed3c4af71568912c"
    $a53="6795271e5e50358a3fa51bd485521d6f8e7b380a07955eb5a731027f7e1a31052cba60661e9630216deb71d517856da7"
    $a54="f12dc7d941f6f40fd382e63fa29bd2a8293b9df34dfdc763c288af5a1a10f11e9c0a7b0850a46fb8dde59e3638fc3df4"
    $a55="9d89fd689fcb6b371f82c84b43f53b6a22c4df092f0ca35866af692ab0c10502679f038a01052bde40ed7976f4002266"
    $a56="9b3ada6f845435f6cc3fcd89a89405c037363fe6e7c160b9cb66bdf9de55b46fcc5b36260bf4b2ae9f1df733aa2fff02"
    $a57="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a58="3ace75c2597a98b4cd30615974d948d04c45108044d7340538736366249c454f6320f7c99a4f23649dc498c9eaa47977"
    $a59="ba1d0ce03378f0301b318284b584e308a42e937e08d257adb6928e177bc2a9747c474f1992ca002ec703c74149042a45"
    $a60="73d4b7e57dd82dbba8ceb15456c0fd5570c6a95789a3398290380da3b5fbc4d81465ed7ffebf77164e891d1ecb8c4a56"
    $a61="a3cf6ade250a6a7f3eea12c6b9e5ceb1c09dfb7a46dcabc0f74127feeb9fa5596b516223e54240c0d5a47c7ac99479ec"
    $a62="d6d778513a1afbdc6c4802d8efb1a85e945365cc60c3ec9bb124b744e3cd94aebf7c59f036fffe232bdc6de836376f99"
    $a63="d6d778513a1afbdc6c4802d8efb1a85e945365cc60c3ec9bb124b744e3cd94aebf7c59f036fffe232bdc6de836376f99"
    $a64="2fe0c40202867afd9246fd5da2a54441b51c7ee73e68cb7f92416fac42860023b303c0d67e2992af88b598a7ee480d4d"
    $a65="0643e50b824d8b0b8ce5810c20f11113b42ef2cbe3b02cb9421e8f93bc1ba1ee18c72fe41b876a8e10cf35f8b35e2875"
    $a66="58a775ba4112be3005ae4407ce757d88fda71d40497bb8026ecac54d4e3ffc7232ce8de3ab5acb30ae39760fee7c53ed"
    $a67="0749b472d750552d9f2951f81919fea9d76f858030cb23497b4cda11ff87b53c5c72b38a576eae371b23ea63b7f424be"
    $a68="e3dfa5ca1cd35062a652e083c95246b7468bb4d15ebbc3dacb360ab0839c0c81c972996795e73c79444ad4e48d93b3fc"
    $a69="7ed8c2c790aa83d6c3e404b5368f6832c18d46a0e98b9c7a7a5e3ef823e2c9f0e310abbf6f7ea9d9d883ccb64ec2736a"
    $a70="a8b64babd0aca91a59bdbb7761b421d4f2bb38280d3a75ba0f21f2bebc45583d446c598660c94ce680c47d19c30783a7"
    $a71="84240b872912ff4d9724f8bfde1373b53d993c00db7928060b3618808b4b1acceb1a1a4462e1a36e5ed350b1c150fae6"
    $a72="f6dbb4d5687a9ea5fe44f4c88ff5e0447805006b48b8ac6c52dad8e24c7617299e4a46551039841132c3e8ffb8862287"
    $a73="9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782"
    $a74="bf2cb0daea873c3ca006aaae92d9def250388fccf336a54889843426ec25c46283a34ccf222d45d7073abc63c1cdfe38"
    $a75="4cfb880e9b3d538c7671cb5de2f6523956d42f011838486320897688aee9c49724207bd39e04d9b74d67ea8dd30ec3c1"
condition:
    ($a0 and $a1) or ($a2 and $a3) or ($a4 and $a5) or ($a6 and $a7) or ($a8 and $a9) or ($a10 and $a11) or ($a12 and $a13) or ($a14 and $a15) or ($a16 and $a17) or ($a18 and $a19) or ($a20 and $a21) or ($a22 and $a23) or ($a24 and $a25) or ($a26 and $a27) or ($a28 and $a29) or ($a30 and $a31) or ($a32 and $a33) or ($a34 and $a35) or ($a36 and $a37) or ($a38 and $a39) or ($a40 and $a41) or ($a42 and $a43) or ($a44 and $a45) or ($a46 and $a47) or ($a48 and $a49) or ($a50 and $a51) or ($a52 and $a53) or ($a54 and $a55) or ($a56 and $a57) or ($a58 and $a59) or ($a60 and $a61) or ($a62 and $a63) or ($a64 and $a65) or ($a66 and $a67) or ($a68 and $a69) or ($a70 and $a71) or ($a72 and $a73) or ($a74 and $a75)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a14483c9-8b50-4c38-be27-dacf0ef4b218

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion